Passwords and MFA

In plain English

A password manager is a program that generates, stores and fills in a different password for every account, so you only remember one master password. For guessing resistance, length matters more than complexity, and a five-word passphrase beats a short password full of symbols. Multi-factor authentication (MFA) asks for a second proof of identity, such as a code or a security key, so a stolen password alone is not enough to log in. Phishing-resistant MFA uses a hardware security key or passkey that cannot be typed into a fake login page, while recovery codes are one-time backup codes stored offline for when that key is lost. Session timeouts automatically sign you out after inactivity, so an unattended or stolen session cannot be reused for long.

Step by step

1. 1Install a password manager and set a long, memorable master password you have never reused.
2. 2Generate a unique passphrase for your most important account and save it in the manager.
3. 3Enable multi-factor authentication and choose a phishing-resistant method such as a security key or passkey.
4. 4Save the recovery codes the service gives you in an offline place you can find later.
5. 5Confirm the account signs you out after a period of inactivity, or shorten the session timeout.

shuf -n 5 /usr/share/dict/words | paste -sd ' '
pass generate email/work 20
pass show email/work

Common mistakes

• Reusing one strong password everywhere means a single leak unlocks every account at once.
• Adding a symbol and a number to a short password does little, because attackers try those common substitutions first.
• Storing recovery codes inside the same password manager entry as the password means losing the manager loses both.
• Leaving sessions logged in indefinitely lets a stolen laptop or shared device stay authenticated for a long time.