Setting Up a Strong Password and Two-Factor Authentication

Why Password Strength Matters

The average data breach exposes billions of username/password combinations. Attackers use automated tools to try these against every major website. If you reuse passwords, one breach can unlock all your accounts.

What Makes a Strong Password

• Length: At least 16 characters. Length beats complexity every time.
• Random: A string of random words (e.g., correct-horse-battery-staple) is stronger than P@ssw0rd!
• Unique: Never reuse a password across sites
• No personal info: Avoid names, birthdays, pet names, or anything in your social media profile

Use a Password Manager (Essential)

A password manager generates, stores, and auto-fills unique passwords for every site. You only need to remember one strong master password.

• Bitwarden — free, open-source, works on all devices (our top recommendation)
• 1Password — excellent family and business plans (~$3/month)
• Apple Keychain — built into iPhone/Mac, great if you are all-Apple
• Google Password Manager — built into Chrome, free, works well for Google users

Setting Up Two-Factor Authentication (2FA)

2FA adds a second step to login — even if someone steals your password, they cannot get in without also having your phone.

Types of 2FA (best to worst)

1. Hardware key (e.g., YubiKey) — most secure, phishing-proof
2. Authenticator app (e.g., Google Authenticator, Authy, Microsoft Authenticator) — very secure
3. SMS text code — better than nothing, but vulnerable to SIM-swap attacks

Enabling 2FA on Common Services

• Gmail: myaccount.google.com → Security → 2-Step Verification
• Microsoft/Outlook: account.microsoft.com → Security → Advanced security options
• Facebook: Settings → Security & Login → Two-Factor Authentication
• Apple ID: Settings → [Your Name] → Password & Security → Two-Factor Authentication

Priority Accounts to Secure First

If you do nothing else today, enable strong passwords and 2FA on these:

1. Your primary email address (everything else resets through email)
2. Online banking and financial accounts
3. Your Apple ID or Google account
4. Work email and VPN