How do you create a strong password and protect it with MFA?
To create a strong password, make it long and unique: four or more random words, or at least 16 characters, used for one account only. A password manager creates and remembers them for you. Then turn on multi-factor authentication (MFA), ideally a passkey or an authenticator app, so a stolen password alone can't open your account.
▶ Try it
Why it matters
A reused password falls to credential stuffing as soon as any one site leaks it. A password manager makes every password long and unique. A second factor or a passkey stops most account takeovers even when the password is known.
In 8 minutes you'll be able to
- Length beats complexity: long passphrases are hard to crack and easy to remember.
- Reused passwords turn one leak into many break-ins. Use a password manager.
- Turn on MFA everywhere. Passkeys and security keys are the strongest option.
What you'll practise
How fast would it crack?
Try the examples, then build your own passphrase. Never type a real password here.
One leak, many doors
An old gaming forum you used years ago gets hacked. Watch what a bot does with your leaked password.
Rank the second factors
Tap the login protections from weakest to strongest.
- Password only, no second factor
- Code by SMS
- Code from an authenticator app
- Push approval with number matching
- Passkey or hardware security key
Password habits
Last check before Ada lets you loose.
What's the best way to manage passwords for 80 accounts?
- A password manager that creates a long, unique password for each account (Answer)
- One very strong password used everywhere
- Variations like Summer2025!, Summer2026!
What should protect your password manager itself?
- A long passphrase only you know, plus MFA (Answer)
- Your birthday, so you never forget it
Your phone shows an MFA approval request you didn't start. What do you do?
- Deny it, change the password and tell IT: someone knows your password (Answer)
- Approve it so the notifications stop
Remember
A unique password for every account, a manager to remember them, and MFA everywhere.
Use one unique password per site, a manager to remember them, and MFA on every account that matters.
Key facts
- Microsoft found that MFA can block more than 99.9% of account compromise attacks. · Source: Microsoft Security Blog, 2019
- CISA recommends passwords that are long (at least 16 characters), random and unique for every account, stored in a password manager. · Source: CISA, Secure Our World: Use Strong Passwords
- In a Google study, an SMS code blocked 100% of automated bots, 96% of bulk phishing attacks and 76% of targeted attacks. Security keys blocked all three. · Source: Google Security Blog, 2019 (with NYU and UC San Diego)
- Credential stuffing works because people reuse passwords: attackers replay leaked email and password pairs on many other sites, automatically.
Updated:
Questions people ask
What makes a password strong?
Length and uniqueness. A passphrase of four or more random words, or a password of at least 16 random characters, used for one account only, is far stronger than a short password with symbols.
Is a password manager safe?
A reputable password manager is much safer than reusing passwords. It encrypts your vault, so protect it with a long passphrase and MFA.
What is the safest type of MFA?
Passkeys and hardware security keys are the strongest, because they only work on the real website. Authenticator apps and push approvals with number matching come next. SMS codes are weaker, but still much better than no second factor.
What is MFA fatigue?
MFA fatigue is when an attacker who already knows your password sends approval request after approval request, hoping you tap Approve to make them stop. Deny it, change your password and report it.
Related terms