How to protect your passwords in 2025

Let’s be honest: most people still use terrible passwords. “123456”, the dog’s name, a birthday date… time goes by, technology advances, but password habits seem stuck in 2005. And that’s a serious problem, because hackers have also evolved — a lot.

The good news is that protecting your passwords today is much easier than it sounds. With a few habit changes and the right tools, you can lock down your accounts in a pretty painless way. Let me show you how.

Why weak passwords are so dangerous

First, understand how attacks actually work. Criminals rarely sit there manually guessing your password. They use automated programs that test millions of combinations per second. A password like “mary1985” can be cracked in under a minute. Something like “T!r9#mK2@pL”, on the other hand, would take centuries to break using the same method.

There’s also the data breach problem. Sites and apps get hacked all the time, and when that happens, your credentials can end up in criminal hands. If you reuse the same password across multiple places, compromising one account means compromising all of them.

Use a password manager — this is the single most important advice

I know it sounds like extra work at first, but a password manager completely changes the game. Tools like Bitwarden, 1Password, or Apple’s built-in Keychain store all your passwords in encrypted form, accessible through a single master password.

In practice, you end up with long, random passwords for every site without having to memorize anything. The manager fills them in automatically. It’s more secure and, honestly, more convenient than reusing the same weak password everywhere.

Bitwarden, for example, is free, open source, and works across all your devices. There’s really no excuse not to use it.

Always enable two-factor authentication (2FA)

Two-factor authentication is like a second lock on the door. Even if someone discovers your password, they’d still need a second code — usually sent by SMS or generated by an app like Google Authenticator or Authy — to get in.

Whenever a service offers this option, turn it on. And prefer authenticator apps over SMS, because SIM swapping — where criminals clone your phone’s SIM card — is a real and increasingly common attack.

Create actually strong passwords

If for some reason you need to create a password manually, follow these rules: at least 16 characters, mixing uppercase and lowercase letters, numbers, and symbols. A technique that works really well is passphrases: pick four random words and combine them — “green-knight-table-lunar” is easier to remember and harder to crack than most traditional passwords.

Never reuse passwords. Ever.

Stay alert to data breaches

The website haveibeenpwned.com lets you check if your email has shown up in any known data breach. It’s free and incredibly useful. If it has, change the password for the affected service immediately — and for any other place where you were using the same combination.

At the end of the day, protecting your passwords doesn’t require being a security expert. It just takes a bit of discipline and the right tools. And now that you know what to do, there’s no excuse to leave your accounts vulnerable.