The most dangerous thing most people do online isn't clicking dodgy links or ignoring software updates. It's reusing the same handful of passwords across dozens of accounts. A password manager solves this problem almost entirely, and a layer of two-factor authentication (2FA) closes what's left. Together they represent the highest return on security effort available to ordinary people — yet surveys consistently find most people still haven't set either up.
The real problem: credential stuffing
When a website is breached — and billions of credentials have leaked over the years, from major retailers to forums to healthcare providers — the stolen email-and-password pairs don't just sit there. Attackers take those lists and run them automatically against hundreds of other sites. This is called credential stuffing: trying a leaked login from Site A to unlock accounts on Sites B, C, and D.
If you've reused a password, one breach can cascade across your entire digital life. Your email gets in, which means password-reset links work, which means everything else is one click away. The chain is long, and it's entirely avoidable.
How a password manager fixes this
A password manager is an encrypted vault that generates and stores a unique, long, random password for every account you have. Instead of remembering dozens of passwords — or reusing the same few — you remember exactly one: your master password (or just use your fingerprint or face on a device you trust). The manager autofills everything else.
The key insight is uniqueness. If every site gets its own randomly-generated password, a breach on any one of them reveals nothing useful for any other. The credential stuffing attack stops before it starts.
Reputable password managers use zero-knowledge (end-to-end) encryption: your vault is encrypted on your device before it ever leaves it, using your master password as the key. The provider's servers store only the encrypted blob — they cannot read your passwords, and neither can anyone who breaches their servers. Your master password never leaves your device in a usable form.
Adding 2FA: a second lock on the door
Two-factor authentication (also called MFA — multi-factor authentication) requires a second proof of identity beyond your password. Even if someone obtains your password through a breach, a phishing attempt, or a lucky guess, they still can't log in without that second factor.
Not all 2FA is equal. Here are the main types, ranked weakest to strongest:
- SMS text codes — a one-time code sent to your phone. Better than nothing, but vulnerable to SIM-swap attacks, where a criminal socially engineers your mobile carrier into transferring your number to a SIM they control. Your phone loses signal; their phone starts receiving your codes. High-value accounts (banking, email) deserve better.
- Authenticator apps (TOTP) — apps like Google Authenticator or Authy generate rotating 6-digit codes that expire every 30 seconds. These are tied to a secret key stored in the app, not to your phone number, so a SIM swap leaves an attacker empty-handed. A substantial step up from SMS.
- Hardware security keys and passkeys (FIDO2) — the gold standard. Hardware keys are physical devices you plug in or tap; passkeys are device-based cryptographic credentials unlocked by your fingerprint or face. Both are built on the FIDO2 standard backed by the FIDO Alliance and major technology companies. What sets them apart is that they are phishing-resistant: they cryptographically verify the real domain of the site before responding. A fake login page — however convincing — gets nothing, because the key knows it's not the real site.
Passkeys: the beginning of after passwords
Passkeys represent a longer-term shift. Rather than storing a secret (a password) that can be stolen and replayed, a passkey works through public-key cryptography: a private key stays on your device, a public key goes to the website, and login is a cryptographic handshake that proves you hold the private key without ever revealing it. The FIDO Alliance and major technology companies — Apple, Google, Microsoft — have been driving adoption since the early 2020s, and an increasing number of services now support logging in with a passkey instead of a password entirely.
The practical upside: no password to steal, no code to intercept, no phishing attack that works. Your fingerprint or face unlocks the credential; the credential proves your identity.
What good password hygiene actually looks like
It's worth noting what modern guidance says on the topic, because a lot of common advice is counterproductive. NIST's Digital Identity Guidelines (SP 800-63) favour long passphrases over forced complexity rules, and explicitly discourage mandatory periodic password resets — which, in practice, push people toward weak, predictable patterns like Password1! incrementing to Password2!. Length and uniqueness matter far more than uppercase-number-symbol soup.
The practical setup that covers most people:
- Pick a reputable password manager and import or update all your existing passwords to unique, generated ones.
- Choose a strong, memorable master password you've never used anywhere else — a passphrase of four or five unrelated words works well.
- Enable 2FA on anything that matters: email first (because it controls password resets everywhere else), then banking, then everything else. Use an authenticator app at minimum; hardware keys or passkeys where available.
That's largely it. The setup takes an hour or two. The protection compounds every year you use it.
Sources & further reading
Related
- ✅ Play Human Verification — a surreal CAPTCHA gauntlet.
- 📚 How CAPTCHA works — what "I'm not a robot" really checks.
- 📚 The psychology of doomscrolling
- 📚 More explainers in the Learn hub