If you have an email address, a bank app or a phone, you already rely on passwords every day. This article explains what they are in plain words, with no technical knowledge needed. It is the first step in our password basics guide.
What a password actually is
A password is a piece of information that only you should know. When you log in, you type your username to say who you are, and your password to prove it. The website has never met you, so the password is the only thing it has to go on.
Think of it as the key to your front door. The door does not care who is holding the key. If someone else has a copy, the lock opens for them just as it opens for you.
Why passwords matter so much
Your accounts hold far more than they appear to. A stolen password can open up:
- Your money: online banking, shopping accounts and saved cards.
- Your identity: an attacker can message your friends as you, or apply for things in your name.
- Your other accounts: your email can reset almost every other password you own, which is why it needs the strongest protection.
- Your private life: photos, messages and documents.
Most people are not attacked because someone chose them personally. Criminals run automated tools against huge lists of accounts and take whatever opens.
How passwords get stolen
You do not need to be careless to lose a password. The most common routes are simple:
- Guessing. Attackers try common passwords first, such as
123456orpassword, along with names and dates. - Data leaks. A company you use gets hacked and its customer list escapes. You did nothing wrong, but your password may now be for sale.
- Fake websites. A phishing message tricks you into logging in to a copy of a real site, and you hand over the password yourself.
- Reuse. One leaked password gets tried everywhere else you might have used it.
What makes a good password
A good password has three qualities. Each one has its own short guide:
- It is long. Length matters more than anything else. See how long a password should be.
- It is random. A real word with a few symbols swapped in is much weaker than it looks. See whether symbols and numbers really help.
- It is unique. One password, one account, every time.
That sounds like a lot to remember, and it is. Nobody can memorize a different random password for every account, so most people should use a password manager. Our guide on how to create a strong password shows the easy way to do it.
Three habits to start today
You can make a real difference in a few minutes:
- Change the password on your main email account to a long one you have never used before.
- Turn on two-factor authentication for that email account, which adds a second check after your password.
- Stop reusing old passwords, starting with your bank and email.
When you are ready, the next step is how long your password should be.