Password security without memorizing forty passwords

The biggest password problem isn't weak passwords. It's reused ones. When one site is breached, criminals try the same email and password on banks, email and shopping sites. That's called credential stuffing, and it works because so many people use one favorite password everywhere.

The fix is less work than it sounds. A password manager creates and remembers a different password for every account, and you remember one strong passphrase to open it. Passkeys, now offered by many large services, go further by replacing the password with your phone's or computer's own screen lock.

This section covers choosing a password manager, writing a passphrase you'll actually remember, checking whether your email shows up in known breaches, and a sensible order for fixing old passwords. You don't have to change everything tonight. Start with email, then banking, then everything else.