Simple Guide to Best Practices for Setting Passwords and MFA

Use long, unique passphrases for every account, manage them with a password manager, and always enable multi-factor authentication—these steps provide the strongest everyday protection for your digital life.

Secure passwords and Multi-Factor Authentication (MFA) are your best defenses against unauthorized access. Follow these straightforward tips for everyday computer use:


Create Strong, Memorable Passwords (or Passphrases)

  • Use passphrases instead of single words—think of a string of four or more unrelated words (e.g., “coffee-laptop-moon-bicycle”) to build passwords at least 15 characters long.
  • Make passwords hard to guess but easy to remember, such as a short, vivid sentence or a description of something unique to you.
  • Don’t use personal information (like names, birthdays, or sports teams) or simple patterns (like “123456”, “qwerty”, or common words).
  • Add complexity if possible—mix in numbers, uppercase and lowercase letters, and symbols, but length is more important than complexity.
  • Avoid dictionary words or combinations that are easily guessed—even with added numbers or symbols.

Maintain Password Hygiene

  • Use a unique password for every account. Never reuse passwords between services, especially not your email account password.
  • Never share your password with anyone, and don’t write it down in easily accessible places.
  • Change passwords immediately if you suspect an account has been compromised.

Leverage Password Managers

  • Use a password manager to generate, store, and autofill strong, unique passwords for each site. This helps manage dozens or even hundreds of logins securely and conveniently.

Enable Multi-Factor Authentication (MFA)

  • Always turn on MFA (also called Two-Factor Authentication) when available, especially for email, banking, and social media accounts.
  • MFA means you use something you know (your password) plus something you have (a code from your phone or a hardware token) or something you are (like a fingerprint).
  • Prefer using authenticator apps or hardware security keys, as they are more secure than SMS codes.

Quick Reference Table

PracticeWhy It Matters
Use passphrases/long passwordsHarder to crack and easier to remember
Make passwords uniquePrevents a breach on one site from affecting others
Avoid common/guessable passwordsStops attackers using easy guesses
Use a password managerHandles many complex passwords securely
Enable MFAAdds a critical security layer