Passwords: what to do
and what to stop doing

If each one is different, long and stored in a manager, there is no need to change them on a schedule: change one when there is a reason to. That is what the US NIST digital identity guidelines (SP 800-63B) say, and many organisations follow them: they forbid requiring periodic changes and require a forced change when there is evidence a password has been compromised. The reason is practical: someone who has to change their password every month ends up using «Summer2026!» and then «Autumn2026!», which protects against nothing. Spain's OSI (part of INCIBE) still advises reviewing them at least every six months, but no serious source recommends doing it monthly. Reasons to change one straight away: a notice that the service has suffered a data breach, a sign-in you don't recognise, having typed it into a suspicious page, or having given it to someone over the phone.

Yes, and it is a better basket than the real alternative, which is the same password on twenty sites or a notebook next to the computer. The manager stores your passwords encrypted and only opens them with a master password that never leaves your hands; if any service suffers a breach, the attacker gets a password that works nowhere else. Spain's OSI recommends managers for exactly that reason, and the NIST guidelines require services to allow managers and autofill. What it does demand is looking after the basket: a long master password you use nowhere else, two-step verification switched on for the manager itself, and a plan in case you forget it, because without it there is no way to recover what it stores. The one built into your browser or phone is already far better than using none.

A long phrase you can remember that has nothing publicly to do with you: four or five unrelated words, with spaces if the service accepts them. Length matters more than odd symbols: NIST asks for at least 15 characters when the password is an account's only protection, and advises against imposing composition rules such as «one capital, one number and one symbol». Avoid sayings, song lyrics, your dog's name or your wedding date, which are the first things tried. This is the only password you need to memorise, so it is worth spending five minutes on it and writing it down once on paper, kept somewhere at home other than the desk drawer, until you have learnt it. And turn on two-step verification for the manager.

Because it is the one that opens all the others. Almost any service, from an online shop to a social network or your invoicing software, lets you reset your password with a link sent to your email. Whoever controls the mailbox can request that link on every site and take over your accounts one by one, without knowing a single other password. On top of that, from your email they can write to your customers or family pretending to be you, which is how many fake invoices start. That is why your email deserves the best password you have, unlike all the others, two-step verification with the strongest method it supports, and an occasional check of open sessions and forwarding rules. If you are only going to protect one account properly this week, make it this one.

It is much better than having no second step, and worse than the alternatives. SMS depends on your phone line, and there are scams that involve getting a duplicate of your SIM card or diverting your messages; what's more, the code can be read aloud to someone calling you while pretending to be your bank. NIST classes SMS as a «restricted» method and does not consider it phishing-resistant. An authenticator app on your phone generates the code without relying on the line, so it avoids SIM duplication, although it still won't protect you if you type the code into a fake page yourself. Physical security keys and passkeys go a step further: they only work on the genuine site. Use the strongest method each service offers, and SMS only where there is no other option.

That is why, when you switch it on, each service offers you recovery codes: a list of single-use codes that let you in without your phone. Print them or store them off the phone, in your password manager or on paper at home, and don't leave them in a screenshot on the same phone you might lose. If the service allows it, add a second method: another device, a spare physical key or a backup phone number. The most common authenticator apps also let you back up their codes to move them to a new phone; check this before you change phones, not after. Losing your phone without any of this is rarely permanent, but it turns recovering each account into a lengthy process with each service's support team, and some never resolve it.

A notebook at home is safer than the same password repeated everywhere, because to read it someone has to get into your house, and most attacks come from the internet, not the living room. The problem with a notebook is less about theft than everything else: it isn't easy to carry around, it doesn't generate long passwords, it tempts you to choose short ones to save copying effort, and in an office it ends up as a sticky note on the monitor, which is exactly where it shouldn't be. For an older person using three services it can be a reasonable solution. For anyone with more than ten accounts, or a business holding customer data, a password manager wins by a mile: it remembers, generates and fills in for you. What is never a good idea is an unprotected document on the computer desktop called «passwords».

Many password managers and the main browsers already warn you on their own: they compare your saved passwords with lists of leaked passwords without sending them in the clear, and tell you which are exposed or reused. Check that section now and then; it is usually called something like «security check» or «password checkup». Services themselves may also email you when they suffer a breach; in that case, sign in by typing the address into your browser yourself, not by clicking the link in the message, in case the notice is fake. If a password shows up as leaked, change it on that service and anywhere else you used the same one. And if you notice something odd, such as sign-ins you don't recognise, sent messages you didn't write or email rules you didn't create, don't wait for a warning: change the password and sign out of all open sessions.