← back

password hygiene & account security

password managers, 2fa, passkeys, hardware mfa — what to actually use and why

passwords 2fa passkeys hardware mfa

core rules

tl;dr — the non-negotiables
  • never reuse passwords across sites — one breach cascades to every account that shares the password
  • never save passwords in your browser’s built-in manager — browser vaults are trivially decrypted by any malware with local access
  • never use personal info (name, dob, family, pet, sports team) — anyone with a cursory web search can derive these
  • rotate passwords for critical accounts (email, bank, cloud, identity) every 3–6 months; more often if you suspect exposure
  • use a real password manager for everything
  • use 2fa everywhere it’s offered
  • never share passwords — even with people you trust. use a manager’s share feature if you must

password hygiene isn’t about picking one clever password — it’s about how the system fails. a strong password is worth nothing if it’s shared with the site that leaked last year, and a weak password on a low-value account still matters if it opens the door to the email that resets everything else.

what a good password looks like

tl;dr
  • uppercase, lowercase, numbers, and top-row symbols
  • use spaces if the site allows them — they widen the keyspace attackers must brute-force
  • 16+ characters. length beats complexity at high lengths
  • generated by your password manager, not by you
  • never use emojis — unicode codepoint differences between platforms mean the password may not match on another device

the old “P@ssw0rd!” advice is dead. modern password crackers know every substitution pattern humans reach for and try them in the first few million guesses. what actually resists brute force is length and randomness — a manager-generated 24-character random string is trivially better than any “creative” password you can memorize, and you never have to remember it anyway.

password managers

tl;dr — pick one, use it for everything

the specific manager matters less than actually using one. all of the reputable managers below use zero-knowledge encryption; the vendor cannot read your vault. the master password is the single most valuable secret in your life — make it long, unique, and write it down somewhere physical (safe deposit box, home safe).

managertypenotes
1Passwordcloudpolished ui, family sharing, secret key adds a second factor to your master password
Bitwardencloud / self-hostopen source, generous free tier, self-hostable (vaultwarden) if you want your own server
LastPasscloudwidely used but had major breaches in 2022 that exposed encrypted vaults; treat historical vault contents as compromised if you were a user then
Keepercloudenterprise-friendly, strong compliance story
Dashlanecloudbuilt-in vpn on higher tiers, dark-web monitoring bundled
KeePasslocalfree, open source, offline-only; vault is a file you sync yourself. steepest learning curve; best if you don’t trust cloud vaults at all

email hygiene

tl;dr
  • don’t reuse your primary email across every site — the email is half your credentials, and it’s the reset vector for the other half
  • use a mask/relay service (mozilla relay, apple hide-my-email, addy.io) to generate a unique forwarder per site
  • use plus-addressing (you+netflix@gmail.com) to identify who leaked your address when you start getting spam — but note some sites strip plus signs, so this is a supplement, not a replacement, for relays

email addresses are your login username almost everywhere. treat them the same way you treat passwords — not one address for the whole internet. relay services give you a unique forwarder per site; when one site leaks, only that one address becomes spam-bait and you can disable it in a click without touching your real inbox.

2fa / mfa

tl;dr — pick the strongest option the site offers
  1. hardware security key (yubikey, titan, nitrokey) — strongest, phishing-resistant
  2. passkeys — nearly as strong, easier to set up (see next section)
  3. totp app (aegis, ente auth, 2fas, google authenticator, authy) — strong; the 6-digit rotating code
  4. push-based mfa (duo, microsoft authenticator push) — ok, watch for prompt-fatigue attacks
  5. email codes — weak; only as strong as your email account
  6. sms codes — weakest; use only if nothing else is offered
gotcha — sms is easy to bypass sim-swap attacks (social-engineering your carrier into porting your number to an attacker’s sim) are common and successful. every account you have with sms 2fa is protected by your carrier’s call center. move to totp or a hardware key on every account that offers it, especially banks, email, and crypto.

the two main 2fa flavors are totp (time-based one-time password — the 6-digit code that rotates every 30 seconds in your authenticator app) and hotp (hmac-based one-time password — the same idea but incremented by a counter instead of the clock, used by some hardware tokens without an internal clock). both are strong; use whichever your account and device support.

passkeys

tl;dr

passkeys replace both the password and the second factor with a cryptographic keypair stored on your device. they can’t be phished, guessed, or brute-forced, and the private key never leaves your device. use them wherever a site offers them.

two flavors matter:

for accounts you access from multiple devices and can’t afford to lock yourself out of, synced passkeys are the pragmatic choice. for your most sensitive accounts — a security key for your email, root aws credentials, or crypto exchange — device-bound passkeys on a hardware key are the safest option.

hardware keys

tl;dr — buy two and register both

always register at least two hardware keys per account, so a lost key doesn’t lock you out. store the backup somewhere physically separate.

site red flags

watch for these if a site tells you your password “can’t contain #, ;, /, $, @, or !” — that’s a strong signal that they’re storing your password in plaintext (or a poorly-escaped database column) instead of a hash. use a unique manager-generated password for that account, enable every mfa option they offer, and mentally flag it as untrustworthy.