Passphrases &
password managers

If you use the same password everywhere and just one site is breached, attackers take that leaked email-and-password combination and try it on your other accounts — banking, email, everything. It's called credential stuffing, it's fully automated, and it's relentless. One old leak from a forgotten forum can quietly hand someone the keys to your most important logins.

The good news is you can check whether your details have already turned up in a known breach — our short guide to checking if your email's been breached walks you through it in a couple of minutes.

For years we were told to make passwords "complex" — a capital here, a symbol there, a number on the end. The trouble is that "P@ssw0rd1" is both weak and annoying: short enough for a computer to crack, yet fiddly enough that you can never remember which symbol went where.

A passphrase flips this around. Something like "correct-battery-harbour-sunrise" is very hard to crack because it's long, but easy for you to remember because it's just four words you can picture. Length is what matters most — and you stop forgetting which symbol went where, because there's barely a symbol to forget.

• ▸ Creates a unique, strong password for every login — no more reusing the same one.
• ▸ Remembers and fills them in for you, so you're not typing (or forgetting) anything.
• ▸ Warns you about reused or breached passwords that need changing.
• ▸ Syncs securely across your devices, so your logins are there on your phone and laptop alike.

The trade-off is wonderfully simple: you only ever remember one strong master passphrase, protected with MFA — and the manager handles the hundreds of others.

1. Choose a reputable password managerPick a well-known, trusted one — your IT team can recommend the right fit for your business.
2. Protect it with a strong master passphrase and MFAThis is the one passphrase you'll remember, so make it long and unique — and switch on MFA for the manager itself.
3. Save your logins as you sign inYou don't need to do it all at once. Over the following weeks, let it capture each login as you use it.
4. Change reused passwords on your most important accounts firstStart with email, banking and work — the accounts an attacker would most want.
5. Turn on MFA everywhere you canA strong, unique password plus MFA is the combination that keeps accounts safe.