Passwords and two-factor authentication, made simple

If you have one password for nearly everything, with a capital letter at the front and a “1” at the end, you have done nothing foolish — that is what the old advice trained us to do. The problem is not you; it is the reuse.

Why reuse is the real problem

Criminals rarely “crack” passwords one by one. They wait for a website — a shop, a forum, a takeaway app — to be breached, download the list of email addresses and passwords, and try the same pairs on email providers and banks. If your takeaway password is also your email password, the breach at the takeaway becomes a break-in at your email.

The UK’s National Cyber Security Centre (NCSC) puts it plainly: reuse means criminals “only need one password to access all your accounts”. And email is the one that matters most, because whoever controls your inbox can press “forgot password” on everything else.

So the most valuable change is: your email gets its own password, used nowhere else.

Three random words

The NCSC’s advice for making that password is disarmingly simple: pick three random words and run them together. Its own examples are “coffeetrainfish” and “walltinshirt”. They are long (which is what makes a password hard to crack), they are easy to remember, and they do not follow the predictable patterns — “Password1!”, “qwerty” — that attackers try first.

What to avoid: anything obvious, anything a stranger could find (pet names, children’s names) and phrases everyone reaches for (“onetwothree”). Three unrelated words, ideally with a picture in your head tying them together, is the whole method.

Let your phone remember the rest

You do not need to remember a different password for every website. The NCSC says password managers can create strong passwords for you and remember them — and that the built-in ones in your phone (Apple’s on iPhone, Google’s on Android) and browser are safe to use on your own devices and are “the easiest way to remember your passwords”.

In practice: when you sign up for a site, your phone offers to make a password; you tap yes; next time, it fills it in after checking your face or fingerprint. You never see the password and never need to. The NCSC’s two conditions are that you keep automatic updates on, and that you never save passwords on a shared or public computer such as a library machine.

If you use devices from different makers (an iPhone and a Windows laptop, say), a third-party password manager can sync across them. That is a refinement, not a requirement.

What two-factor authentication actually is

Two-factor authentication (2FA), which the NCSC calls two-step verification (2SV), means logging in takes something you know (the password) and something you have (your phone). Typically the service sends a short code by text, or asks you to approve in an authenticator app, or uses your fingerprint or face.

The point is that a stolen password alone is no longer enough. The NCSC describes turning it on as “one of the most effective ways to protect your online accounts”, and reassures that you will not be asked for the second step every time — usually only on a new device or for sensitive changes. The FTC lists multi-factor authentication among its four core protections against phishing.

How to turn it on. Every provider hides it somewhere slightly different, but the route is always: your account > Security > Two-step verification (or Two-factor authentication). Do email first, then online banking. Text-message codes are the most common option; the NCSC notes an authenticator app is more robust because it does not rely on phone signal, but a text code is far better than nothing.

Recovery codes: the bit people skip

When you switch on two-step verification, the service usually offers backup codes — single-use codes that get you in if you lose your phone. The NCSC’s guidance is to store them somewhere safe and have a backup plan for the day your usual second step is not to hand. Write them down and file them with your passport. This is the difference between losing your phone and losing your email.

If your details are in a breach

A free website, Have I Been Pwned, lets you type in your email address and see whether it has appeared in a known data breach. It lists roughly 17.8 billion breached accounts, so do not be alarmed if yours appears — most people’s do.

What to do next is mechanical: change the password on the breached site, and anywhere you used the same one. If that includes your email, do that first, then turn on two-step verification. The site can also email you if your address turns up in a future breach.

This week

Three tasks, none of which needs a memory for passwords: give email its own three-random-words password; let your phone save the others; turn on two-step verification for email and banking, and write down the backup codes.

For where this fits alongside settings, scams and getting help, start with the complete guide to tech confidence after 50. For the emails and calls that try to talk a password out of you, see How to spot a scam text, email or call. And if you would like a one-page worksheet for recording which accounts have two-step verification on and where the backup codes live, our Tech Confident guide includes one.