Passwords & Account Security: Questions and Answers
Strong passwords, password managers, multi-factor authentication, passkeys and what to do when an account is hacked or breached.
What makes a strong password?
Length and uniqueness matter most. A long passphrase of several random words, used for only one account, is stronger and easier to remember than a short password full of symbols. NIST’s digital identity guidelines favor length over complexity rules.
Full answer and next stepsAre password managers safe to use?
For most people, yes. A reputable password manager encrypts your vault with your master password and lets you use a unique, strong password everywhere, which removes the much larger risk of password reuse. Protect the vault with a long master passphrase and multi-factor authentication.
Full answer and next stepsShould I change my passwords regularly?
Not on a fixed schedule. Current NIST guidance advises against forcing periodic password changes and recommends changing a password when there is evidence it was compromised, for example after a breach notice or suspicious sign-in.
Full answer and next stepsWhat is multi-factor authentication and do I need it?
Multi-factor authentication (MFA) asks for a second proof of identity, such as an app prompt, a code or a security key, in addition to your password. You need it on your email, bank, social media and work accounts, because it blocks most attacks that rely on a stolen password.
Full answer and next stepsIs SMS two-factor authentication safe?
SMS codes are much safer than a password alone, but they are the weakest common form of MFA. Codes can be stolen through SIM swapping, fake login pages that relay the code in real time, or malware on the phone. Use an authenticator app, passkey or security key where the service offers one.
Full answer and next stepsWhat is a passkey and is it better than a password?
A passkey is a sign-in credential based on public-key cryptography that is stored on your device or in your password manager and unlocked with your fingerprint, face or device PIN. It is generally stronger than a password because it cannot be reused, guessed or typed into a fake site.
Full answer and next stepsHow do I check if my email or password was in a data breach?
Search your email address on a breach notification service such as Have I Been Pwned, and check whether your password manager offers breach alerts. If an address appears in a breach, change that service’s password and any account where you reused it, and turn on multi-factor authentication.
Full answer and next stepsWhat should I do if my email account is hacked?
Reset the password from a clean device, sign out all other sessions, turn on multi-factor authentication, and check that the recovery phone, recovery email and forwarding rules have not been changed. Then warn your contacts, because attackers often use a hacked account to scam them.
Full answer and next stepsWhat is credential stuffing?
Credential stuffing is an automated attack where criminals take usernames and passwords leaked from one site and try them on many other sites. It succeeds whenever people reuse passwords, which is why a unique password for every account is so important.
Full answer and next stepsWhat should I do after my data is exposed in a breach?
Change the affected password and any reuse of it, turn on multi-factor authentication, and watch for phishing that uses the leaked details. If government ID numbers or financial data were exposed, consider a credit freeze and monitor your bank statements.
Full answer and next stepsHow does an authenticator app compare to a password?
A password is a secret string of characters you memorize, representing something you know. An authenticator app is software on your device that produces temporary, changing numeric codes, representing something you have. While a password serves as a primary credential that remains static until you change it, an authenticator app acts as a secondary verification factor to block unauthorized access even if your password leaks.
Full answer and next stepsIs an authenticator app better than SMS for two-factor authentication?
Yes, an authenticator app is significantly more secure than SMS for two-factor authentication. SMS verification codes travel over cellular networks where attackers can intercept them through techniques like SIM swapping. An authenticator app generates one-time passcodes locally on your device without relying on mobile carriers. This prevents phone-based interception and provides stronger defense for your accounts.
Full answer and next stepsWhat are the differences between using an authenticator app and a security key for two‑factor authentication?
An authenticator app creates time‑based one‑time passwords on your phone, while a security key is a separate hardware token that performs a cryptographic challenge‑response without exposing a secret. The key requires physical presence and resists phishing, whereas the app relies on the device’s security and manual code entry.
Full answer and next stepsWhat is the difference between an authenticator app and a passkey?
An authenticator app provides a second verification factor alongside a password, as outlined by CISA. In contrast, passkeys provide passwordless authentication based on FIDO Alliance guidance. Authenticator app codes can be phished if a user enters them on a fraudulent site, whereas passkeys are designed to be phishing-resistant.
Full answer and next stepsCan password managers be hacked?
Yes, password managers can be targeted and compromised by cyber criminals. Even when you use a complex password or a password manager, CISA warns that malicious actors still have ways to harvest or get past single passwords. Layering your protection with multi-factor authentication stops attackers from gaining access if your password is compromised.
Full answer and next stepsCan passkeys be hacked?
Passkeys provide strong defense against common account takeover methods, but your accounts can still be compromised if underlying devices or recovery channels are breached. As guidance from CISA highlights, multi-factor authentication and phishing-resistant authenticators significantly reduce the likelihood of account compromise compared to passwords alone. However, an unauthorized user can still gain access if they compromise your unlocked device or breach linked recovery services.
Full answer and next stepsDoes an authenticator app transfer to a new phone?
An authenticator app does not always transfer automatically to a new phone. Whether your accounts move over depends on the specific app and its backup settings. Because an authentication application acts as something you have, you must follow the vendor's setup process to connect your new device. You should always verify that your codes work on the new phone before deleting the app or erasing your old device.
Full answer and next stepsCan two-factor authentication be turned off?
Yes, you can turn off two-factor authentication on most personal accounts, but doing so leaves your account vulnerable. Disabling it strips away an essential defensive layer, leaving only your password to stop unauthorized logins. If an attacker guesses or steals your password, they gain immediate access. In workplace environments or regulated services, administrators often enforce multi-factor authentication, meaning you cannot disable it yourself.
Full answer and next stepsGo deeper
Step-by-step articles on this subject are in the Personal Security guides.