Passwords and a password manager

Many break-ins at small offices do not need a clever attacker. They need one password that was guessed, reused from a site that was breached, or written on a note beside the screen.

This lesson covers what a strong password is today, which password matters most, and the tool that makes good passwords practical: a password manager.

What a strong password is

The Cybersecurity and Infrastructure Security Agency (CISA) uses three words in its public guidance: long, random and unique.

• Long: at least 16 characters. Longer is stronger.
• Random: a random string of letters, numbers and symbols, or a passphrase of several unrelated words.
• Unique: a different password for every account.

Unique is the rule people break most. When one website leaks its passwords, criminals try the same email and password on banks, email services and payroll portals. If you reused it, every one of those accounts falls with the first.

What changed in the rules

You may have been taught to change your password every 90 days and to mix in a capital letter, a number and a symbol. The federal standard no longer says that.

The National Institute of Standards and Technology published its current digital identity guidance, SP 800-63B, in August 2025. It tells systems not to force periodic password changes and not to impose composition rules. It does tell them to check new passwords against lists of common and leaked ones.

A password should change when there is evidence it was exposed: a breach notice, a phishing click, a former employee who knew it. Forced schedules tend to produce "Spring2025!" followed by "Summer2025!", which helps nobody.

If your institution still requires scheduled changes, follow the policy and mention the NIST guidance to whoever owns it. Policy changes are their call, not a reason to work around the rule.

The password that matters most

Your email password protects everything else. Nearly every service sends its "reset your password" link to email. Whoever controls your inbox can reset your payroll login, your website account and your social media pages.

Remember: Your email password protects everything else. Give it the strongest password you have, used nowhere else, with two-step sign-in.

So your email gets the strongest password you have, used nowhere else, with two-step sign-in turned on. Lesson 2 covers two-step sign-in.

Why a password manager

No one can remember 40 random 16-character passwords. A password manager does it for you. CISA describes it as a program that generates, stores and fills in your passwords.

You remember one main password, a long passphrase. The manager creates a new random password for every account and fills it in when you sign in. Good managers also warn you about weak or reused passwords and about sites that were breached.

Options you will see:

• The one your institution provides. Use it if there is one. Ask your IT contact or clerk.
• The one built into your browser or phone. Chrome, Edge, Firefox and Safari all include one. It is far better than reuse.
• A standalone product that works across devices and can share passwords with a team. Lesson 4 covers sharing.

Keep work passwords in a work account, not in a personal browser profile on a home computer.

Habits to retire

• A notebook or sticky note of passwords at the desk.
• A spreadsheet called "passwords" on the shared drive.
• One base password with a different number at the end for each site.
• Sending a password by email or text. Share through the manager, or say it on a phone call and change it afterward.

Protect the manager itself

The manager's main password gets the same care as your email: long, used nowhere else, with two-step sign-in. Most managers offer a recovery kit or emergency code. Print it and keep it where your office keeps other sensitive originals, such as a locked cabinet.