Use a unique password for every important account
Reusing the same password means one compromised account can put several other accounts at risk.
Tech Learning Hub · Cybersecurity Lesson 02
Passwords, Passkeys & Account Security
Learn practical ways to protect your online accounts using stronger passwords, password managers, multi-factor authentication and modern passkeys.
← Cybersecurity lessons
Published: October 26, 2026
Last updated: October 26, 2026
The basic idea
Your account security should not depend on one weak password
Online accounts can contain personal conversations, financial information, business records, photographs, documents and access to other services. Protecting those accounts is therefore an important part of everyday cybersecurity.
A password is one way of proving that you are authorised to access an account. However, passwords can be guessed, stolen, reused or exposed in data breaches. Strong account security uses better password habits together with additional protection where available.
Password security
Four important password habits
Prefer long passwords
Long passwords or passphrases are generally harder to guess or crack than short passwords, especially when they are unique.
Avoid predictable personal information
Names, birthdays, phone numbers and simple patterns can be easier for attackers to guess or discover.
Do not share passwords casually
Passwords should be treated as private credentials. Avoid sending them through ordinary messages, email or other insecure channels.
Why password reuse is dangerous
One stolen password can open several doors
Imagine that you use the same email address and password for a shopping website, your email account and a social media account. If the shopping website suffers a breach and those credentials are exposed, criminals may try the same combination on other services.
Using a unique password for each important account limits the damage that one exposed password can cause.
Password managers
You do not need to memorise every password
A password manager is software designed to securely store account credentials. Many password managers can also generate long, random passwords for you.
This makes it easier to follow one of the most important account security practices: using a different strong password for every important service.
The password manager itself should also be protected carefully. Use strong authentication for it and keep its recovery options secure.
Additional protection
Add more than one layer of account security
Password manager
A password manager can generate and store strong, unique passwords so you do not have to remember every password yourself.
Multi-factor authentication
Multi-factor authentication adds another verification step, such as an authenticator app, security key or other approved method.
Passkeys
Passkeys can allow you to sign in using a trusted device and methods such as a fingerprint, face recognition or device PIN instead of a traditional password.
Recovery information
Keeping your recovery email, phone number and recovery options current can help you regain access if an account is compromised or locked.
Multi-factor authentication
A password should not always be the only barrier
Multi-factor authentication, often called MFA or two-factor authentication, requires additional verification when you sign in. This can make it harder for someone with a stolen password to access your account.
Depending on the service, verification may use an authenticator app, a security key, a trusted device or another approved method.
Never approve an authentication request you did not initiate.
Repeated unexpected approval requests can be a sign that someone is attempting to access your account. Reject the request and review the account's security.
Passkeys
A modern alternative to traditional passwords
Passkeys are a newer sign-in method that can replace passwords on supported services. They use cryptographic credentials associated with your device or passkey provider.
You may unlock a passkey using a fingerprint, face recognition, device PIN or another method supported by your device. The secret used to authenticate you is not typed into the website like a traditional password.
Because passkeys are tied to the legitimate service they were created for, they can provide strong resistance to many common phishing attacks.
Warning signs
Signs that an account may be compromised
!
You receive a login alert from a device or location you do not recognise.
!
Your password suddenly stops working even though you did not change it.
!
Messages, posts or transactions appear that you did not create.
!
Your recovery email, phone number or security settings have been changed.
!
You receive unexpected multi-factor authentication prompts.
!
Contacts tell you they received suspicious messages from your account.
Practical checklist
Strengthen your important accounts
1
Use a different password for each important account.
2
Use a reputable password manager where appropriate.
3
Enable multi-factor authentication on important accounts.
4
Use passkeys when a trusted service offers them and you understand the recovery options.
5
Keep account recovery information up to date.
6
Never approve an unexpected login or authentication request.
7
Review important account security settings periodically.
Key takeaways
What to remember
✓
Password reuse can turn one compromised account into several compromised accounts.
✓
Long, unique passwords are generally safer than short and predictable passwords.
✓
Password managers can make it practical to use different strong passwords across many accounts.
✓
Multi-factor authentication provides an additional layer of protection beyond a password.
✓
Passkeys can reduce reliance on traditional passwords and provide strong protection against many phishing attempts.
✓
Unexpected login alerts or authentication prompts should always be treated carefully.
Next lesson
Phishing, Scam Messages & Social Engineering
Next, we will examine how attackers use deceptive emails, messages, calls and fake websites to manipulate people into revealing information, sending money or giving away account access.