Why password reuse is risky
A password used on several websites can put multiple accounts at risk. If one service is compromised, criminals may try the same password on email, shopping, social media and financial accounts. Give every important account its own password.
Choose long, difficult-to-guess passwords
Length matters. A passphrase made from several unrelated words can be easier to remember than a short, predictable password. Avoid names, birthdays, common phrases and keyboard patterns. Do not make small predictable changes to one password for different accounts.
Use a password manager
A reputable password manager can generate and store unique passwords. Protect it with a strong master password and understand its recovery options. Use a trusted provider and secure your device with a screen lock.
Enable additional account protection
Turn on two-step verification wherever available. This requires another form of verification in addition to your password. Authentication apps, security keys and passkeys may offer stronger protection than text-message codes, depending on the service and your circumstances.
Protect verification codes
Never give a one-time code, recovery code or password to someone who contacts you unexpectedly. Legitimate support staff should not need you to disclose your secret sign-in credentials. Review account security settings and recovery methods periodically.