Password managers and two-factor authentication explained: a plain-English guide

TUREFF• •0

Two habits stop the most common ways ordinary people get hacked: using a different strong password for every account, and turning on two-factor authentication. Neither needs technical knowledge. This guide explains why they matter and how to set them up sensibly.

Why reusing passwords is so dangerous

Websites get breached all the time, and the stolen lists of email addresses and passwords end up traded and sold. Attackers then try those same combinations on hundreds of other sites automatically, a technique known as credential stuffing. If you used the same password on a small forum that leaked and on your email account, the forum's breach becomes your email's breach. You cannot control how well every site protects your password. You can make sure a leak from one site unlocks nothing else.

What makes a good password now

Current guidance from bodies such as the US National Institute of Standards and Technology (NIST) has moved away from forced complexity rules and regular changes. What matters most is:

Length: longer is stronger. A passphrase of several random words is both strong and memorable.
Uniqueness: never reused anywhere.
Not already leaked: common or previously breached passwords are tried first.

Nobody can remember dozens of long unique passwords, which is where a password manager comes in.

How a password manager works

A password manager is an app that stores all your passwords in an encrypted vault. You remember one strong master password (or unlock it with your fingerprint or face on your device), and it:

generates a long random password for each site
fills it in automatically when you log in
syncs between your phone and computer
often warns you about reused, weak or breached passwords

Reputable managers encrypt your vault on your own device, so the company running the service cannot read your passwords. The built-in options in your browser or phone are a big improvement on reuse; dedicated apps add features such as sharing with family and working across different brands of device. When choosing one, look for: a good security track record, independent security audits, support for all your devices, two-factor protection on the vault itself, and a clear way to export your data if you leave. Avoid anything that is not from a well-established provider. Your master password must be strong and never used elsewhere. Write it down and keep it somewhere physically safe at home until you have memorised it.

Two-factor authentication (2FA)

2FA means logging in needs two things: something you know (your password) and something you have (your phone or a key). Even if your password leaks, an attacker without the second factor cannot get in. The main types, from weakest to strongest:

SMS codes: a code sent by text. Far better than nothing, but vulnerable to SIM-swap fraud, where a criminal persuades your mobile operator to move your number to their SIM, and to phishing sites that ask you to type the code.
Authenticator apps: an app on your phone generates a new six-digit code every 30 seconds. Not tied to your phone number, so not affected by SIM swaps. Still vulnerable if a fake site tricks you into typing the code.
Push prompts: the app asks "Is this you signing in?" Convenient, but attackers sometimes send repeated prompts hoping you tap yes. Only approve a prompt you have just triggered yourself.
Passkeys and hardware security keys: these use cryptography tied to the real website's address, so they will not work on a lookalike phishing site. That makes them phishing-resistant, the strongest option available to most people. Passkeys live on your phone, computer or password manager and are unlocked with your fingerprint, face or PIN. Security keys are small physical devices you plug in or tap.

Use the strongest option each site offers, and start with the accounts that matter most: email first (it can reset everything else), then your password manager, banking, phone account and main social media.

Recovery codes: do not skip this step

When you turn on 2FA, many sites offer a set of one-time recovery codes. If you lose your phone, these are often the only way back in. Print them or store them somewhere safe and separate from your phone, such as in your password manager plus a paper copy at home. If you use security keys, register at least two and keep the spare somewhere safe.

Phishing: the attack that gets around all of this

Phishing is a message that tricks you into entering your details on a fake site. Habits that help:

Be suspicious of urgent messages about deliveries, account problems, prizes or unpaid bills.
Do not log in from a link in an email or text. Open the app or type the address yourself.
A password manager helps here: it will not autofill on a fake domain, which is a useful warning sign.
Never read out or forward a 2FA code to anyone who contacts you, whoever they claim to be. Genuine companies do not ask for it.

A 30-minute starter plan

Install a password manager and set a strong master password.
Change your email password to a unique one and turn on 2FA, ideally a passkey or authenticator app.
Save the recovery codes.
Do the same for banking and your password manager.
Over the next few weeks, update other accounts as you log into them.

Which 2FA method do you use, and have you ever been locked out? Share your questions or experience in the comments.