Home / Learn / Privacy / Password Security Guide

Password Security Guide: How to Create, Store, and Protect Strong Passwords

A complete guide to password length, unique credentials, password managers, MFA, passkeys, phishing, breach response, recovery, and modern NIST password guidance.

Passwords remain one of the most common ways people prove who they are online. They protect email, banking, shopping, social media, cloud storage, healthcare portals, work systems, and countless other accounts. Yet passwords are also one of the easiest security controls to weaken through reuse, predictable patterns, phishing, data breaches, or poor recovery practices.

The modern goal is not to invent a clever password you can remember for every site. The better approach is to use unique credentials, let a reputable password manager handle most of the complexity, add multi-factor authentication, and adopt passkeys where they are available and appropriate.

This FreeTempTools Learning Center guide explains current password best practices, how password attacks work, why length matters, when to change a password, how password managers help, how passphrases differ from passwords, how passkeys fit into the future of authentication, what to do after a password breach, and how businesses and families can improve account security without creating impossible rules.

The recommendations in this guide reflect current guidance from NIST, CISA, and the Federal Trade Commission. NIST's current Digital Identity Guidelines, SP 800-63B-4, were published in July 2025 and supersede the older SP 800-63B.

Key Takeaways

• Password length matters more than arbitrary complexity rules.
• Password reuse is one of the most dangerous everyday habits.
• A password manager makes unique credentials practical.
• Passwords are not phishing-resistant.
• Multi-factor authentication reduces the damage of a stolen password.
• Passkeys can provide stronger phishing resistance when implemented correctly.
• NIST no longer recommends arbitrary periodic password changes.
• Security questions should not rely on facts easily found online.
• A breached password should be replaced immediately everywhere it was reused.
• Primary email deserves exceptional protection because it often controls recovery.
• Shared passwords create accountability and revocation problems.
• Business password policies should support users rather than force predictable workarounds.
• Temporary email can reduce exposure of a permanent email address for low-risk, disposable registrations, but it should not recover valuable accounts.

What Makes a Password Strong?

A strong password is difficult for an attacker to guess or discover.

Strength depends on several factors:

• Length
• Randomness
• Uniqueness
• Whether the password appears in known compromised-password lists
• Whether it contains predictable personal information
• Whether it is reused
• Whether the account adds other authentication factors

A 20-character unique random password stored in a password manager is generally far better than a short password with predictable substitutions such as replacing an "a" with @.

The strongest practical password is often one you do not need to memorize.

Current NIST Password Guidance

NIST SP 800-63B-4 contains modern technical guidance for passwords used in digital identity systems.

Important points include:

• Passwords used as a single authentication factor must be at least 15 characters in systems following the NIST requirement.
• Passwords used only as part of multi-factor authentication may be shorter, but NIST requires at least eight characters.
• Services should compare new passwords against a blocklist of commonly used, expected, or compromised values.
• Arbitrary password composition rules should not be imposed.
• Periodic password changes should not be required unless compromise is suspected or known.
• Password managers and paste functionality should be allowed.
• Passwords are not phishing-resistant.

These are verifier requirements for systems implementing NIST guidance, but they also provide useful direction for ordinary users: prioritize length, uniqueness, compromise detection, and MFA rather than memorizing complex formatting rules.

How Long Should a Password Be?

For a manually chosen password, longer is generally better.

NIST's current guidance uses 15 characters as the minimum for single-factor passwords in covered systems.

FTC consumer guidance also emphasizes making passwords long and notes that a passphrase can make a long credential easier to remember.

Practical Recommendation

For passwords generated by a password manager:

• Use the longest random credential the service reliably supports.
• Twenty or more characters is a practical choice on many sites.
• Do not shorten a password merely to make it memorable if the manager stores it.

For a password you must remember:

• Use a long passphrase.
• Choose unrelated words.
• Avoid famous quotes, lyrics, slogans, or predictable sequences.
• Do not reuse the passphrase elsewhere.

Password vs Passphrase

A passphrase is simply a longer password made from words or text.

Example structure:

random-word random-word random-word random-word

The important part is randomness, not whether the phrase sounds meaningful.

Weak passphrases include:

• Famous quotations
• Song lyrics
• Movie lines
• Common sayings
• Sports chants
• Predictable keyboard phrases

Attackers can include common phrases in guessing dictionaries.

A long, random passphrase can be easier to remember than an arbitrary string while still providing useful strength.

Why Password Reuse Is Dangerous

Password reuse turns one company's security problem into your problem everywhere.

Suppose the same credential is used for:

• Email
• Shopping
• Social media
• Cloud storage

If the shopping site is breached, attackers can try the same email and password on the other services.

This is called credential stuffing.

Attackers do not need to crack the password if another breach has already revealed it.

The Rule

One account = one password.

Do not reuse a password even for "unimportant" accounts. Low-value sites are often exactly where breaches happen.

How Credential Stuffing Works

Credential stuffing generally follows this pattern:

1. A website is breached.
2. Username/password pairs are stolen.
3. Attackers obtain or trade the data.
4. Automated systems test the credentials against other services.
5. Reused passwords result in account takeover.

Defenses include:

• Unique passwords
• MFA
• Passkeys
• Login monitoring
• Credential breach detection
• Rate limiting by service providers

For ordinary users, uniqueness is the most important defense.

How Password Guessing Works

Attackers may use several methods.

Dictionary Attacks

Attackers try common passwords, phrases, words, and known patterns.

Brute Force

Automated systems try many possible combinations.

Password Spraying

An attacker tries a small number of common passwords across many accounts to avoid lockouts.

Credential Stuffing

Stolen credentials are reused against other websites.

Phishing

The victim is tricked into entering the password on a fake page.

Malware

Malicious software may capture credentials or steal browser sessions.

Social Engineering

An attacker persuades support staff or the user to reveal or reset access.

Long passwords help with guessing resistance, but length cannot protect a password voluntarily entered into a phishing site. That is why authentication should be layered.

Password Entropy in Plain English

Entropy is a technical way of discussing unpredictability.

Users do not need to calculate entropy manually.

The practical lessons are:

• Random is better than personally meaningful.
• Longer is better than shorter when other factors are equal.
• Machine-generated is usually better than human-invented.
• Unique is mandatory.

A predictable 30-character quotation may be easier to guess than a shorter randomly generated string.

Why Complexity Rules Often Backfire

Traditional policies often required:

• One uppercase letter
• One lowercase letter
• One number
• One symbol
• Password changes every 60 or 90 days

People responded predictably.

Examples:

Summer2026!

then:

Fall2026!

The password technically meets complexity rules but remains guessable.

NIST's current guidance rejects mandatory composition requirements and routine forced changes.

Better systems:

• Require sufficient length.
• Block known compromised or commonly used passwords.
• Allow password managers.
• Support MFA.
• Rate-limit login attempts.
• Detect suspicious activity.

Do You Need to Change Your Password Every 90 Days?

Usually not.

Routine password expiration can encourage predictable changes and password reuse.

Current NIST guidance says verifiers should not require periodic password changes unless there is evidence the password has been compromised.

Change a password when:

• It appears in a breach.
• You entered it into a phishing site.
• Malware may have captured it.
• Someone else knows it who should not.
• An account shows suspicious activity.
• A provider instructs you to change it after a real security incident.
• You discover it was reused.
• A shared-password relationship ends.

Do not change a strong, unique password solely because a calendar says it is old unless your organization requires it.

Should Passwords Contain Symbols?

Symbols can increase the possible character space, but symbols do not fix a short or predictable password.

Password!1 remains weak.

If a password manager generates a credential with symbols, use them if the website accepts them.

If you are creating a long passphrase, prioritize length and unpredictability.

Do not weaken a password because a site has poor character support; instead, use the strongest unique credential the site permits.

Avoid Personal Information

Do not build passwords from:

• Name
• Birthday
• Address
• Phone number
• Pet name
• School
• Employer
• Favorite sports team
• Children's names
• Anniversary
• Car model
• Social media username

Attackers can gather these details from:

• Social media
• Public records
• Data brokers
• Breaches
• Company directories

Personal information feels memorable because it is familiar. That is exactly why it can be predictable.

Avoid Keyboard Patterns

Weak examples include:

• qwerty
• 123456
• asdfgh
• 1q2w3e
• qazwsx

Longer keyboard walks are not automatically strong.

Attackers know common keyboard layouts and patterns.

Never Use the Same Password With a Different Number

Examples:

• MySecret1
• MySecret2
• MySecret3

These are effectively one password pattern.

If one is exposed, the others are easy to infer.

Each account should have a completely independent credential.

Password Managers

A password manager stores credentials in an encrypted vault and can generate unique passwords.

It solves the biggest practical problem in password security:

A password manager can:

• Generate passwords
• Store passwords
• Autofill credentials
• Synchronize across devices
• Store passkeys
• Store secure notes
• Store security-question answers
• Alert users to reused credentials
• Alert users to known compromised passwords

Features vary by provider.

Are Password Managers Safe?

No security technology is risk-free, but reputable password managers can dramatically reduce password reuse and weak-password habits.

The alternative for many users is:

• Reuse
• Predictable patterns
• Passwords in notebooks
• Passwords in spreadsheets
• Passwords in email
• Forgotten accounts

A good password manager concentrates security, so the vault itself deserves strong protection.

Protect it with:

• A strong master password
• MFA
• Updated software
• Secure recovery
• Trusted devices

Review the provider's security model and independent reputation before choosing one.

How to Choose a Password Manager

Look for:

• Strong encryption design
• Clear security documentation
• Independent security reviews
• MFA support
• Passkey support
• Secure recovery
• Cross-device availability
• Export capability
• Breach notification
• Reuse detection
• Good update history
• A business model you understand

Also consider usability. A tool that is too difficult to use consistently will not improve security.

How to Create a Master Password

The master password protects the vault.

It should be:

• Long
• Unique
• Never reused
• Memorable enough to enter when necessary
• Not based on public facts

A long random passphrase is often appropriate.

Do not store the only copy of the master password inside the locked vault.

Create a secure recovery plan.

Password Manager Recovery

Recovery deserves as much planning as login.

Consider:

• Emergency kit
• Recovery code
• Trusted device
• Family or business emergency access
• Hardware key backup
• Secure offline copy

Do not create a recovery system weaker than the vault itself.

Multi-Factor Authentication

MFA combines more than one authentication factor.

Common factors include:

• Something you know: password or PIN
• Something you have: phone, security key, authenticator
• Something you are: biometric

MFA reduces the usefulness of a stolen password.

CISA lists turning on MFA as one of its core Secure Our World recommendations.

MFA Method Strength

Not all MFA methods provide the same protection.

Passkeys and Security Keys

Can provide strong phishing resistance when correctly implemented.

Authenticator Apps

Generally stronger than SMS for many users because they are not dependent on the mobile phone network.

Push Notifications

Convenient, but users must reject unexpected prompts.

SMS Codes

Better than password-only access in many situations, but vulnerable to SIM-swapping and social engineering.

Email Codes

Depend on the security of the email account itself.

Use the strongest practical method supported by the account.

MFA Fatigue Attacks

An attacker who has a password may repeatedly send login approval prompts.

The goal is to make the user approve one accidentally or out of frustration.

If unexpected prompts appear:

• Do not approve them.
• Change the password.
• Review active sessions.
• Report suspicious activity.
• Review MFA devices.

Repeated MFA prompts can be a sign that someone already knows the password.

Passkeys

Passkeys are an alternative to passwords based on public-key cryptography.

They can be stored on:

• Phones
• Computers
• Password managers
• Security keys

Passkeys can provide phishing-resistant authentication because the credential is bound to the legitimate website or service.

NIST recognizes syncable authenticators such as passkeys in its modern authentication guidance.

Passwords vs Passkeys

Passkeys do not eliminate the need for account recovery, device protection, and secure cloud accounts.

Should You Use Passkeys?

Use them when:

• The service supports them.
• You understand how they sync or are backed up.
• Recovery is available.
• Your devices are protected.

For critical accounts, consider registering more than one secure method where supported.

Protect Your Primary Email Password

Your email is often the most important password you have.

Password-reset links for other services usually arrive there.

Protect primary email with:

• Unique password
• MFA
• Passkey or security key when available
• Updated recovery
• Session review
• Forwarding-rule review
• Minimal public exposure

Never reuse the primary email password.

For low-risk disposable registrations where future recovery is unnecessary, FreeTempTools provides Temp Mail. Do not use a temporary inbox for financial, healthcare, tax, government, employment, or valuable long-term accounts.

Security Questions

Security questions can become weak alternate passwords.

Examples:

• Mother's maiden name
• First car
• Birth city
• First school
• Pet name

Many answers can be found online.

When a service allows it, use a random answer rather than a factual one.

Store the answer in your password manager.

Example:

Question: "What city were you born in?"

Stored answer: a random value unrelated to the real city.

Do not reuse security-question answers.

Password Recovery Codes

Recovery codes can bypass ordinary authentication.

Treat them as high-value secrets.

Do not:

• Email them to yourself unprotected.
• Store them in an ordinary cloud note.
• Photograph them if photos automatically upload insecurely.
• Share them.

Store them:

• In a password manager
• In encrypted storage
• In a secure physical location

Keep recovery separate enough that one account compromise does not expose everything.

Password Sharing

Avoid sharing passwords.

Shared passwords create problems:

• No individual accountability
• Difficult revocation
• Password changes disrupt everyone
• Credentials may spread through email or chat
• Former employees or partners may retain access

Use:

• Family-sharing features
• Delegated access
• Role-based business accounts
• Password-manager sharing
• Separate user accounts

When access should end, revoke the individual rather than changing a shared secret whenever possible.

Sending a Password Securely

The safest approach is often not to send the password at all.

Better alternatives include:

• Invite the user through the service.
• Use delegated access.
• Use a password manager's secure-sharing feature.
• Create a temporary account.
• Require the recipient to set their own password.

Do not send highly sensitive passwords through ordinary email or SMS.

FreeTempTools provides Self-Destructing Notes, but an expiring note does not stop a recipient from copying the content and should not automatically be considered appropriate for critical credentials.

Passwords on Shared Computers

Avoid entering critical passwords on public or untrusted devices.

Risks include:

• Keyloggers
• Malicious extensions
• Saved credentials
• Browser history
• Screen recording
• Session theft

If necessary:

• Do not save the password.
• Do not mark the device trusted.
• Sign out.
• Revoke the session afterward.
• Change credentials if compromise is suspected.

Private browsing does not protect against a compromised device.

Browser Password Storage

Modern browsers can generate and store passwords.

This is generally better than password reuse.

Protect the browser account with:

• Strong authentication
• MFA
• Device security
• Screen lock

Review saved credentials.

Remove passwords from shared devices.

Understand how synchronization works across devices.

Password Security on Phones

Phones hold:

• Password managers
• Email
• Authentication apps
• Passkeys
• Banking apps
• Recovery channels

Use:

• Strong device passcode
• Biometric unlock
• Automatic lock
• Encryption
• Remote wipe
• Software updates

A four-digit PIN can be easier to observe than a longer device passcode.

Protect lock-screen notification previews.

Password Security for Families

Families should avoid one shared password for:

• Email
• Streaming
• Banking
• Cloud storage

Use provider family features.

Teach children:

• Never share passwords with friends.
• Never share authentication codes.
• Verify unexpected account-reset messages.
• Use separate passwords.

Parents should protect family administrator accounts with MFA.

Password Security for Students

Students may have:

• School accounts
• Financial aid
• Cloud storage
• Social media
• Gaming
• Career portals

Use unique passwords.

Do not use a school password for personal accounts.

School email may stop working after graduation, so migrate recovery methods.

Password Security for Businesses

Business password security requires more than telling employees to "make strong passwords."

Organizations should:

• Use SSO where appropriate.
• Require MFA.
• Support password managers.
• Block compromised passwords.
• Avoid arbitrary complexity rules.
• Avoid unnecessary periodic resets.
• Use role-based access.
• Separate administrator accounts.
• Revoke access during offboarding.
• Monitor suspicious authentication.
• Protect recovery processes.
• Train users against phishing.

NIST guidance is particularly useful for designing password policy because it addresses both security and usability.

Administrator Passwords

Administrator accounts deserve extra protection.

Use:

• Separate admin identity
• Unique credential
• MFA
• Security key or passkey when supported
• Limited use
• Logging
• No ordinary browsing from admin accounts

Never share administrator credentials among staff if individual accounts can be created.

Service Accounts and API Credentials

Developers and businesses should not treat API keys as ordinary passwords.

Secrets may include:

• API keys
• Tokens
• Database passwords
• Private keys
• Cloud credentials

Do not commit secrets into source-control repositories.

Use:

• Secret managers
• Environment variables when appropriate
• Rotation
• Least privilege
• Logging
• Automated secret scanning

Temporary Pastebin is not an appropriate storage system for production secrets.

What to Do if a Password Is Exposed in a Data Breach

1. Verify the breach notice.
2. Change the affected password.
3. Change every reused or similar password.
4. Review active sessions.
5. Turn on MFA.
6. Review recovery settings.
7. Watch for targeted phishing.
8. Review account activity.
9. Save the breach notice.

If the primary email password was exposed, prioritize email recovery immediately.

What to Do if You Entered a Password on a Phishing Site

Act quickly.

1. Go to the legitimate website directly.
2. Change the password.
3. Revoke sessions.
4. Turn on or review MFA.
5. Change reused passwords.
6. Review recent activity.
7. Review email forwarding and recovery if email was involved.
8. Report the phishing message.

If you approved an MFA request, report that too.

What to Do if Malware May Have Stolen Passwords

Changing passwords on an infected device may simply expose the new passwords.

First:

• Disconnect or contain the device when appropriate.
• Run trusted security tools.
• Update software.
• Seek professional help if the infection is serious.

Then use a trusted device to:

• Change critical passwords.
• Revoke sessions.
• Review MFA.
• Monitor accounts.

What to Do if Someone Knows Your Password

Change it immediately.

Then ask:

• Was it reused?
• Does the person know security-question answers?
• Do they have access to your phone or email?
• Are sessions already active?
• Are shared recovery methods involved?

Revoke access comprehensively.

For situations involving stalking or abuse, account changes may require safety planning; do not make changes in a way that increases personal danger.

Password Breach Checklist

• [ ] Password replaced
• [ ] Reused passwords replaced
• [ ] Similar password variations replaced
• [ ] MFA enabled
• [ ] Active sessions reviewed
• [ ] Recovery methods reviewed
• [ ] Connected apps reviewed
• [ ] Email rules reviewed if email involved
• [ ] Financial activity reviewed if account involved
• [ ] Breach notice saved

Password Audit Checklist

Review your password habits.

• [ ] I use a password manager.
• [ ] Every important account has a unique password.
• [ ] My primary email password is unique.
• [ ] My password-manager master password is unique.
• [ ] MFA is enabled on email.
• [ ] MFA is enabled on financial accounts.
• [ ] MFA is enabled on cloud storage.
• [ ] I have removed reused passwords.
• [ ] I have removed weak passwords.
• [ ] Recovery codes are stored safely.
• [ ] Security-question answers are not easy public facts.
• [ ] I know which accounts support passkeys.
• [ ] Old shared credentials have been revoked.
• [ ] Former devices have been removed.
• [ ] Business admin accounts are separate.
• [ ] Critical credentials are not stored in ordinary notes.

Common Password Mistakes

Using One Strong Password Everywhere

Strength does not fix reuse.

Changing One Character Between Accounts

Attackers can infer patterns.

Trusting Complexity Over Length

A short complicated password can still be weak.

Changing Passwords Too Often

Unnecessary forced changes may encourage predictable patterns.

Ignoring MFA

Passwords are phishable.

Using Public Facts in Security Questions

Those facts may be searchable.

Sharing Passwords by Email

Email may be forwarded, retained, or compromised.

Saving Passwords on Shared Devices

Other users may access them.

Treating Recovery Codes Casually

Recovery codes may bypass ordinary MFA.

Using Temporary Email for Critical Recovery

If access disappears, recovery may become impossible.

Password Myths vs Facts

How FreeTempTools Fits Into Password Security

FreeTempTools' Password Generator is currently listed as coming soon and should not be linked until it appears in a future sitemap.

Existing tools can support adjacent privacy workflows.

Temp Mail

Temp Mail can reduce exposure of a permanent email address during appropriate low-risk disposable registrations.

It should not be used for accounts where password recovery matters.

Self-Destructing Notes

Self-Destructing Notes can support short-lived sharing, but should not be treated as a universal secure password-sharing solution.

What Is My IP

What Is My IP shows your current public IP address. It does not determine whether a password is secure or whether an account has been compromised.

Temporary Pastebin

Temporary Pastebin should not be used to store production passwords, API keys, recovery codes, or confidential secrets.

Password Security Priority Plan

If your password habits need a complete reset, use this order.

Today

1. Secure primary email.
2. Install or configure a password manager.
3. Change reused financial passwords.
4. Turn on MFA.
5. Secure password-manager recovery.

This Week

1. Replace reused social and shopping passwords.
2. Review cloud storage.
3. Review phone carrier.
4. Review government and tax accounts.
5. Store recovery codes safely.

This Month

1. Review old accounts.
2. Add passkeys where appropriate.
3. Remove old devices.
4. Review security questions.
5. Audit family or business shared passwords.

Advanced Password Security: Threats Beyond Guessing

Strong passwords protect against guessing, but modern account attacks often bypass guessing entirely.

Attackers may target:

• Session cookies
• Recovery channels
• Browser extensions
• OAuth permissions
• API keys
• Help-desk processes
• SIM cards
• Authentication prompts
• Cloud synchronization
• Password reset flows

This is why password security should be viewed as part of a larger authentication system.

A strong password is essential, but it is not sufficient when the recovery email, phone number, or session is weak.

Session Hijacking

After login, many services issue a session token so the user does not need to enter the password repeatedly.

If an attacker steals that token, the attacker may gain access without knowing the password.

Potential defenses include:

• Keeping browsers updated
• Avoiding untrusted extensions
• Avoiding malware
• Signing out unfamiliar sessions
• Revoking sessions after compromise
• Using device security
• Monitoring login activity

Changing the password may not always revoke every session automatically.

When recovering from a serious account compromise, use the service's "sign out everywhere" feature when available.

Password Reset Security

A password reset process can become the weakest link.

Common reset methods include:

• Email link
• SMS code
• Authenticator
• Recovery code
• Security questions
• Help-desk verification

Review recovery methods periodically.

Remove:

• Old phone numbers
• Old email addresses
• Former work accounts
• Unused devices
• Old security keys

A secure password with an abandoned recovery email is not a secure account.

Email Account Recovery Hierarchy

Prioritize recovery protection in this order:

1. Primary email
2. Password manager
3. Financial accounts
4. Mobile carrier
5. Cloud storage
6. Government and tax accounts
7. Business administration
8. Social media
9. Shopping and subscriptions

If your primary email can reset another account, treat the email as part of that account's authentication system.

Password Security and Data Breaches

A breach may expose:

• Plaintext passwords
• Password hashes
• Email/password combinations
• Password reset answers
• Session tokens
• Usernames

The correct response depends on what the company reports.

If the password itself is known or likely compromised:

• Change it immediately.
• Replace reused copies.
• Review MFA.
• Review active sessions.

If the company says only a salted password hash was exposed, the risk depends on the hashing implementation and password strength. Ordinary users usually cannot evaluate that system in detail, so follow official incident guidance and change the password when the provider recommends it.

Do not wait for suspicious activity before replacing a known compromised password.

How Password Hashing Works

Well-designed services should not store passwords in readable form.

Instead, they store a derived value created by a password hashing function.

When the user logs in:

1. The password is processed.
2. The service derives a value.
3. The result is compared with the stored value.

A salt is a unique random value added to make identical passwords produce different stored results.

Users do not need to manage salts.

The practical lesson is that website security matters even when your own password is strong. A service can still be breached.

Your defense is uniqueness: if one site fails, the password should not unlock another site.

Why "Have I Been Pwned"-Style Alerts Matter

Password managers and browsers may warn that a credential appears in known breach datasets.

Treat a credible alert seriously.

If a password is listed:

• Change it.
• Change reused versions.
• Enable MFA.
• Review activity.

Do not assume that because no fraudulent login has occurred the credential is safe.

Attackers may retain breach datasets for years.

Password Security for High-Value Accounts

Some accounts deserve stronger protection.

Primary Email

Use a unique long password and strong MFA.

Password Manager

Use a unique master passphrase and MFA.

Banking

Use unique credentials, MFA, alerts, and trusted devices.

Mobile Carrier

Use a unique password and account PIN.

Domain Registrar

Use strong MFA, ideally a security key or passkey when supported.

Cloud Storage

Protect because it may contain documents, photos, tax records, and backups.

Government and Tax Accounts

Use strong recovery and current contact information.

The more an account can affect other accounts, the stronger its authentication should be.

Password Security for Low-Value Accounts

"Low-value" does not mean reuse is acceptable.

A forum or newsletter account may still expose:

• Email
• Username
• Personal profile
• Password

If that password is reused, a minor site becomes the entry point to something important.

Use a password manager so unique passwords do not require extra memory.

Password Security and Temporary Accounts

Temporary or disposable accounts have a different risk profile.

Use temporary email only when:

• The interaction is low risk.
• The account does not matter later.
• No payment is involved.
• No important identity is attached.
• Password recovery will not be needed.

Do not use temporary email for:

• Banking
• Healthcare
• Government
• Taxes
• Employment
• Paid subscriptions
• Purchases
• Long-term social accounts

FreeTempTools Temp Mail can support disposable registrations where future recovery is unnecessary.

Password Security When Traveling

Travel can expose credentials through unfamiliar devices and networks.

Before travel:

• Update devices.
• Review MFA.
• Verify recovery methods.
• Back up recovery codes.
• Remove unnecessary sensitive accounts from a travel device when appropriate.

During travel:

• Avoid public computers for critical accounts.
• Do not save passwords on shared devices.
• Verify Wi-Fi networks.
• Avoid entering credentials into unexpected captive portals.
• Keep devices physically secure.

After travel:

• Review active sessions.
• Remove unfamiliar networks.
• Check security alerts.
• Revoke suspicious sessions.

Password Security for Remote Work

Remote work blends business and personal environments.

Use:

• Separate work profiles
• Managed business devices
• Approved password manager
• MFA
• Strong router security
• Screen locking
• Secure video-call practices

Do not move business credentials into personal notes or browsers without authorization.

Password Security for Shared Households

Shared devices create special risks.

Each person should have:

• Separate operating-system account
• Separate browser profile
• Separate password-manager account or approved family vault
• Separate email
• Separate MFA methods

Avoid one family email and one password for everything.

Password Security During Relationship Changes

When a household, relationship, partnership, or business arrangement changes, review:

• Shared passwords
• Streaming services
• Cloud storage
• Home-security systems
• Wi-Fi
• Shared email
• Financial accounts
• Password-manager vaults
• Location sharing
• Smart-home apps

Revoke access rather than assuming changing one password is sufficient.

For situations involving abuse or stalking, seek appropriate safety planning before changing account access in a way that could increase risk.

Password Security for Older Adults

Useful practices include:

• Password manager with trusted recovery
• MFA
• Trusted family contact
• Account alerts
• Simple written recovery plan
• Avoiding phone-based password disclosure

Teach one central rule:

Password Security for Children and Teenagers

Teach:

• Unique passwords
• Never share codes
• Do not share passwords with friends
• Avoid using personal facts
• Use family password-manager features
• Report suspicious resets
• Secure gaming accounts

Gaming and social accounts can contain purchases, saved payment methods, and valuable digital items.

Gaming Account Password Security

Gaming accounts are frequent targets because they may contain:

• Purchased games
• Virtual currency
• Skins/items
• Payment methods
• Friend networks

Use:

• Unique password
• MFA
• Account recovery
• Purchase alerts
• Official marketplace only

Do not trade credentials.

Cryptocurrency Account Password Security

Cryptocurrency services can create irreversible financial loss.

Use:

• Unique password
• Phishing-resistant MFA
• Hardware security key when supported
• Withdrawal allowlists when available
• Strong email security
• Verified bookmarks

Do not store wallet seed phrases in ordinary password fields, cloud notes, email, temporary pastebins, or self-destructing notes.

Seed phrases require specialized secure backup practices.

Password Security for Social Media

Social accounts can be used to scam contacts.

Use:

• Unique password
• MFA
• Login alerts
• Recovery review
• Connected-app review

If compromised:

• Reset password.
• Revoke sessions.
• Remove unknown apps.
• Warn contacts.

Password Security for E-Commerce Accounts

Shopping accounts may store:

• Addresses
• Payment methods
• Order history
• Gift-card balances

Use unique passwords.

Remove saved cards from accounts you rarely use.

Review shipping addresses and recent orders after suspicious access.

Password Security for Healthcare Portals

Healthcare accounts can contain highly sensitive information.

Use:

• Permanent email
• Unique password
• MFA
• Current phone
• Secure recovery

Do not use Temp Mail for healthcare.

Password Security for Government Accounts

Government services may affect taxes, benefits, identity records, or licenses.

Use:

• Strong permanent recovery
• Unique credentials
• MFA
• Passkeys/security keys where available
• Official bookmarks

Never use disposable contact methods.

Password Manager Migration Checklist

When moving from one password manager to another:

• [ ] Export only from a trusted device.
• [ ] Protect the export file.
• [ ] Import into the new manager.
• [ ] Verify records.
• [ ] Delete plaintext export files securely.
• [ ] Enable MFA on the new manager.
• [ ] Configure recovery.
• [ ] Test autofill.
• [ ] Review passkeys.
• [ ] Remove access to the old vault only after confirming migration.

Exports may be unencrypted depending on the format. Treat them as highly sensitive.

Password Manager Backup Checklist

• [ ] Know how recovery works.
• [ ] Store recovery codes separately.
• [ ] Keep hardware keys backed up if used.
• [ ] Document emergency access.
• [ ] Avoid insecure plaintext exports.
• [ ] Test recovery before an emergency.
• [ ] Review family/business emergency access annually.

Business Password Policy Checklist

A modern policy should:

• [ ] Require sufficient length.
• [ ] Block compromised passwords.
• [ ] Allow password managers.
• [ ] Allow paste/autofill.
• [ ] Require MFA for important systems.
• [ ] Avoid arbitrary composition rules.
• [ ] Avoid unnecessary periodic changes.
• [ ] Separate administrator accounts.
• [ ] Provide secure recovery.
• [ ] Remove access promptly during offboarding.
• [ ] Monitor suspicious authentication.
• [ ] Provide phishing training.

Policies should make secure behavior easier, not harder.

Developer Password Storage Checklist

Applications should not:

• Store plaintext passwords.
• Log passwords.
• Email passwords back to users.
• Include passwords in URLs.
• Store secrets in public repositories.

Developers should follow current platform and security standards for password hashing, authentication, session management, and reset flows.

Password storage is a specialized security task; use established libraries rather than inventing cryptographic schemes.

Password Reset Email Checklist

A reset email should make users cautious.

Before using it:

• Did you request the reset?
• Is the sender correct?
• Is the domain correct?
• Does the message create unusual urgency?
• Can you open the site independently?

If you did not request it:

• Do not click.
• Review account activity.
• Consider changing password if other suspicious signs exist.

Passwordless Does Not Mean Security-Free

Removing a password does not remove security responsibilities.

Passkey systems still depend on:

• Device security
• Cloud account security
• Recovery
• Synchronization
• Backup authenticators
• Account support

Passwordless authentication can improve phishing resistance but should still be designed with recovery and device compromise in mind.

Password Security Decision Tree

Can the Service Use a Passkey?

If yes, consider setting one up.

Does It Still Require a Password?

Generate a unique long password.

Can You Use MFA?

Enable the strongest practical option.

Is the Account Valuable?

Use permanent recovery and strong MFA.

Is the Account Disposable?

Temporary email may be appropriate if losing access does not matter.

Was a Password Exposed?

Replace it immediately and check for reuse.

Annual Password Security Review

Once per year:

• Review password-manager health.
• Review reused credentials.
• Review compromised-password alerts.
• Review passkey adoption.
• Review MFA devices.
• Review security keys.
• Review recovery phone numbers.
• Review recovery email addresses.
• Remove old accounts.
• Remove old devices.
• Review business shared access.
• Test emergency recovery.

Do not rotate every strong password just because you perform an annual audit.

Password Security Scorecard

Password Security for Email Aliases and Secondary Accounts

Using aliases and secondary email addresses can reduce the amount of your primary identity exposed across the web, but the password rules remain the same.

Each account should still have:

• A unique password
• MFA when available
• Secure recovery
• A clear purpose

Do not assume an alias or secondary inbox can safely use a weaker password simply because it is not your primary address.

If the alias forwards to your primary inbox, a compromise may still expose useful account information or trigger reset attempts against the primary account.

For disposable, low-risk registrations where future recovery does not matter, a temporary inbox may be more appropriate than creating another permanent account.

Password Security for Password Reset Links

Password reset links are authentication credentials in their own right.

Treat them carefully.

Do not:

• Forward them
• Post screenshots containing them
• Leave them open on shared devices
• Save them in notes
• Reuse an old reset email days later without confirming it is still valid

If you receive an unexpected reset link:

1. Do not click it.
2. Open the service independently.
3. Review recent account activity.
4. Check whether your email address or username appears in a breach.
5. Change the password if other suspicious signs exist.

A reset email can be harmless if someone mistyped an address, but repeated unexpected reset attempts may indicate account targeting.

Password Security and Browser Extensions

Browser extensions can sometimes see or modify page content.

Before installing an extension:

• Review the developer.
• Review permissions.
• Read recent reviews.
• Check whether the extension is still maintained.
• Remove extensions you no longer need.

A malicious extension may potentially access:

• Login pages
• Form data
• Browsing history
• Session information

Keep the extension list minimal, especially in the browser profile used for banking, password management, or administration.

Password Security and Autofill

Autofill can improve security by allowing long random passwords that users do not need to type manually.

It also helps detect phishing because a password manager may refuse to autofill on the wrong domain.

Still:

• Verify the domain.
• Keep the password manager updated.
• Lock the device.
• Do not leave the vault unlocked on shared systems.

Autofill is a convenience feature, not a substitute for verifying the website.

Password Security and Shared Vaults

Family and business password managers often provide shared vaults.

Use shared vaults for:

• Household subscriptions
• Shared utilities
• Team systems
• Vendor portals

Avoid sharing:

• Personal email credentials
• Personal banking
• Personal government accounts
• Individual MFA recovery codes

Shared access should be limited to accounts that are genuinely shared.

Review membership when:

• An employee leaves.
• A contractor finishes.
• A household changes.
• A subscription changes owners.

Password Security and Account Recovery Planning

Every high-value account should have a recovery plan.

Record:

• Primary recovery email
• Recovery phone
• MFA method
• Backup authenticator
• Recovery codes
• Trusted devices
• Support process

Do not place all of those recovery methods in one location.

For example, if your password manager stores both the password and the only recovery code for the same account, loss of the manager account may make recovery more difficult.

Use sensible separation for critical accounts.

When to Replace an Old Password Even Without a Breach

Routine expiration is not recommended solely because time passed, but there are legitimate reasons to replace a password.

Replace it when:

• It was reused.
• It is too short.
• It is predictable.
• It contains public personal information.
• It predates your password manager and you are unsure where else it was used.
• It is shared with someone who no longer needs access.
• It was entered on an untrusted device.
• You suspect malware exposure.
• The provider reports compromise.
• Your threat level changed.

The goal is targeted improvement, not constant rotation.

Password Security During Device Replacement

When replacing a phone or computer:

1. Confirm password-manager synchronization.
2. Confirm MFA access.
3. Confirm passkeys.
4. Confirm recovery codes.
5. Confirm trusted-device changes.
6. Remove payment methods from the old device.
7. Sign out of critical services.
8. Remove the old device from trusted lists.
9. Factory-reset using manufacturer guidance.

Do not erase the old device before confirming you can access critical accounts from the new one.

Password Security During Phone Number Changes

A phone number may recover dozens of accounts.

Before giving up a number:

• Search your password manager for accounts that use it.
• Update banking.
• Update email.
• Update cloud storage.
• Update social accounts.
• Update carrier security.
• Update government and tax services.
• Update work systems.

After the number is reassigned, another person may receive texts intended for the old owner.

Treat phone-number changes as an authentication migration.

Password Security During Email Address Changes

Before abandoning an email address:

• Move critical account recovery.
• Update financial services.
• Update cloud storage.
• Update social accounts.
• Update shopping accounts.
• Update subscriptions that matter.
• Update password-manager recovery.
• Export anything you need.

Keep the old address active during a transition period when practical.

Do not abandon an email account while important services still send password resets there.

What Makes a Password Policy User-Friendly?

A secure password policy should not punish users for trying to behave securely.

Good policies:

• Allow long passwords.
• Allow spaces and common printable characters.
• Allow paste and autofill.
• Support password managers.
• Block known compromised passwords.
• Offer MFA.
• Avoid forced composition rules.
• Avoid arbitrary expiration.

Poor policies often create workarounds.

Examples:

• Sticky notes
• Predictable suffixes
• Reused passwords
• Shorter credentials
• Shared accounts

Security and usability should reinforce each other.

How to Measure Password Security Progress

For an individual, track:

• Number of reused passwords
• Number of weak passwords
• Number of accounts with MFA
• Number of accounts with passkeys
• Number of critical accounts with verified recovery
• Number of old accounts closed
• Number of old devices removed

For a business, track:

• MFA coverage
• Compromised-password blocking
• Password-manager adoption
• Shared-account reduction
• Admin-account separation
• Offboarding completion
• Authentication-related incident volume

The goal is measurable reduction of weak authentication paths.

Password Security Recovery Worksheet

Use this after a suspected compromise.

Account

Service: ______________________

Username/email: ______________________

Date discovered: ______________________

What Happened?

• [ ] Password exposed in breach
• [ ] Password entered on phishing page
• [ ] Suspicious login
• [ ] Malware suspected
• [ ] Shared password no longer trusted
• [ ] Device lost
• [ ] Recovery method compromised
• [ ] Other: ______________________

Actions

• [ ] Password changed
• [ ] Reused credentials changed
• [ ] MFA reviewed
• [ ] Sessions revoked
• [ ] Recovery email reviewed
• [ ] Recovery phone reviewed
• [ ] Connected apps reviewed
• [ ] Financial activity reviewed
• [ ] Support contacted

Follow-Up

• [ ] Monitor for 30 days
• [ ] Review alerts
• [ ] Document case number
• [ ] Review related accounts

Password Security: 20-Point Fast Reset

If your password habits are poor, start here:

1. Install or choose a reputable password manager.
2. Secure the password manager with a strong master credential.
3. Turn on MFA for the password manager.
4. Change the primary email password.
5. Turn on MFA for primary email.
6. Change banking passwords.
7. Change cloud-storage passwords.
8. Change reused social-media passwords.
9. Change reused shopping passwords.
10. Review phone-carrier security.
11. Remove weak security questions.
12. Save recovery codes safely.
13. Review active sessions.
14. Remove old devices.
15. Add passkeys where appropriate.
16. Stop sharing passwords through email.
17. Stop storing passwords in ordinary notes.
18. Review breach alerts.
19. Close unused accounts.
20. Repeat the audit periodically.

Frequently Asked Questions

How long should a password be?

NIST's current guidance requires at least 15 characters for passwords used as a single authentication factor in systems following SP 800-63B-4. Longer unique passwords are generally preferable.

Is 12 characters enough?

Twelve characters is better than a short password, and some consumer guidance historically used 12 as a practical target. Current NIST guidance for single-factor passwords uses 15 characters as the minimum for covered systems.

Should I use symbols in my password?

Symbols are fine, especially in generated passwords, but they do not compensate for short length, predictability, or reuse.

Should I change passwords every 90 days?

Not simply because 90 days passed. Current NIST guidance says periodic changes should not be required unless the password is compromised or another specific reason exists.

Is a passphrase safer than a password?

A long random passphrase can be strong and easier to remember. Avoid famous phrases and predictable word combinations.

Are password managers safe?

A reputable password manager can greatly reduce password reuse. Protect the vault with a strong unique master credential, MFA, and secure recovery.

What if my password manager is breached?

Follow the provider's official incident guidance. Secure the master account, review MFA and sessions, and rotate credentials that are actually at risk.

What is credential stuffing?

Credential stuffing is the automated use of stolen username/password pairs against other services. Unique passwords stop one breached credential from unlocking other accounts.

Are passwords phishing-resistant?

No. NIST explicitly notes that passwords are not phishing-resistant.

Are passkeys better than passwords?

Passkeys can provide strong phishing resistance and eliminate traditional password guessing. Recovery and device security still matter.

Is SMS two-factor authentication safe?

It often provides more protection than password-only access but is vulnerable to SIM swapping and social engineering. Authenticator apps, security keys, and passkeys may offer stronger protection.

Should security-question answers be truthful?

When a service permits it, random unique answers can prevent public personal facts from becoming alternate passwords. Store them securely.

Can I send a password with a self-destructing note?

An expiring note does not prevent the recipient from copying the password. Prefer delegated access or a password manager's secure-sharing feature for important credentials.

Should I write passwords down?

A securely stored physical record may be safer than password reuse for some users, but it must be protected from unauthorized physical access. A password manager is usually more practical for many accounts.

What is the strongest password?

There is no universal strongest password. A long, unique, randomly generated credential stored in a reputable password manager is a strong practical choice.

What should I do if a password appears in a breach?

Replace it immediately and change every other account where the same or a similar password was used.

Should I use temporary email when creating an account?

Only when the account is disposable and does not require future recovery. Use stable contact information for valuable or sensitive accounts.

Can a hacker crack any password?

Given enough information, weak passwords may be guessed or cracked, while strong randomly generated passwords can be computationally impractical to guess. Phishing and malware can bypass guessing entirely.

Does MFA mean my password can be weak?

No. Use both a strong unique password and MFA unless the service uses a passwordless authenticator such as a passkey.

How often should I audit my passwords?

Review password health periodically and immediately after a breach, phishing event, suspicious login, device compromise, or major account change.

Final Recommendations

Modern password security is simpler than many old password rules make it seem.

Use a password manager. Create unique credentials. Make passwords long. Turn on MFA. Use passkeys where available. Protect primary email and recovery methods. Replace passwords when they are compromised rather than changing them arbitrarily on a calendar.

The biggest improvement most people can make is eliminating password reuse.

A strong password protects one account.

A unique strong password protects every other account from that breach.

Continue Learning

• Complete Guide to Temporary Email
• How to Avoid Email Spam
• Temporary Email vs Personal Email

Add newer flagship guides only after their live URLs appear in an updated FreeTempTools sitemap.

Frequently asked questions

Authoritative references

• NIST: Digital Identity Guidelines: Authentication and Authenticator Management
• NIST: Authenticators
• NIST: Strength of Passwords
• NIST: How Do I Create a Good Password?
• CISA: Secure Our World
• Federal Trade Commission: Creating Strong Passwords and Other Ways To Protect Your Accounts
• Federal Trade Commission: Use Two-Factor Authentication To Protect Your Accounts