Tools · Passwords and sign-in

Using a password manager

A password manager creates, stores and fills in a different strong password for every account, so one data breach can't unlock the rest. You remember a single master passphrase of 4 to 7 unrelated words. Good free options exist, including ones built into browsers. Set it up in this order: choose a reputable one, make the master passphrase, turn on two-step sign-in, then replace your email and bank passwords first with random 16+ character ones. Write the master passphrase down and keep it somewhere physically safe; most managers can't recover it.

Easy30 min to set up; a few weeks to cover every accountFree options; paid plans add featuresChecked October 2, 2026

You'll need

Your phone and computer
A quiet half hour
A safe place for one written-down master passphrase

What to know

Choose a reputable password manager. Many good ones are free, including those built into browsers; dedicated managers often add stronger security features and work better across devices. Compare reviews from a trusted source like Consumer Reports. Source: CISA Cybersecurity Alliance¹²
Look for "zero-knowledge" design: the company can't see your passwords and never stores your master password. Source: Cybersecurity Alliance²
Create the master passphrase: 4 to 7 unrelated words, like CISA's example "Horse Purple Hat Run Bay Lifting." Spaces are fine. Source: CISA¹ Don't use that example itself.
Turn on two-step sign-in for the password manager right away. Source: Cybersecurity Alliance²
Install its browser extension and phone app so it can autofill and sync. Source: Cybersecurity Alliance²
Replace your most important passwords first: email, social media and financial accounts. Source: CISA¹ Let the manager generate each one: at least 16 characters, random, and unique. Source: CISA¹
Let the rest come over time. Save passwords as you log in, or import them all at once. Source: Cybersecurity Alliance²

Watch out Reusing a password, even with a letter or symbol added, is risky. If one account is breached, that password becomes a skeleton key to the others. Source: Cybersecurity Alliance² In CISA's example, one reused password let a hacker into someone's email and start a $700 bank transfer. Source: CISA¹

Strong password rules

A strong password follows all three rules. Source: CISA¹

Rule	What it means
Long	At least 16 characters. Longer is stronger.
Random	A random mix of upper- and lowercase letters, numbers and symbols, or a passphrase of 4 to 7 unrelated words.
Unique	A different password for every account.

Safer than what you're doing now

Reusing the same password across accounts Source: Cybersecurity Alliance²
Writing passwords in a notebook or on sticky notes Source: Cybersecurity Alliance²
Saving them in a spreadsheet, notes app or file on your computer Source: Cybersecurity Alliance CISA²¹
Short or guessable passwords like 12345, birthdays or pet names Source: CISA¹

See it done

Video by CISA Government

How to Make Strong Passwords! (We Can Secure Our World)

Watch on YouTube: How to Make Strong Passwords! (We Can Secure Our World)

2024 · Checked October 3, 2026

Video won't load at school or work? No problem. Everything you need is in the steps; the video's just a bonus. Watch it on YouTube later.

If it doesn't work

Forgot the master password? Most managers can't recover it, because they never store it. Memorize it or keep it somewhere secure, like a safe, and set up any recovery option offered. Source: Cybersecurity Alliance²
Autofill not working on a site? Open the manager and copy and paste instead.
Got a breach alert? Many managers warn you about breached, weak or reused passwords. Source: Cybersecurity Alliance² Change that password right away. Source: FTC³
A site won't accept a long password? CISA suggests asking the company why it allows weak ones. Source: CISA¹

Good to know

The details, if you want them. Tap a line to open it.

Phishing warnings

Many managers also warn you about suspicious or phishing websites. Source: Cybersecurity Alliance²

Is one vault risky?

Reputable managers encrypt your data, so it's unreadable even if intercepted. Using one is far safer than reusing passwords. Source: Cybersecurity Alliance²

Take it with you

Printable card Download card (PDF)

Sources

Cybersecurity and Infrastructure Security Agency Use strong passwords (archived)
National Cybersecurity Alliance What is a password manager?
Federal Trade Commission Use two-factor authentication to protect your accounts

Lesson T3.1 · Last checked October 2, 2026 against the sources listed.

Report a mistake

Next in ToolsTurning on two-step sign-in

Once a week, if you want it

One new lesson or checklist a week. Totally optional. The lessons never need a sign-up.