Breaches & Passwords
Password Managers and 2FA: A No-Nonsense Guide
The short version
Two changes turn a leaked password into a non-event. A password manager makes every password long, random and different, so a breach at one company cannot open your other accounts. Two-factor authentication blocks the login even when someone has the right password. Google's own research put numbers on the second one: an on-device prompt stopped 100% of automated bot attacks and 90% of targeted attacks. Both take an evening to set up. Start with your email account, because every other reset runs through it.
Why a password manager beats any system you invent
A password manager exists to remove the thing that causes reuse: your memory. It generates a different random password for every site, stores them encrypted, and fills them in for you. You stop needing a scheme, and a password stolen from one company stops being a key to anything else.
Reuse is the actual problem. In a February 2019 survey of 3,000 US adults by Google and Harris Poll, 52% said they reused the same password across multiple accounts and 13% reused one password for everything, while only 24% used a password manager. That gap is what attackers monetise - see how credential stuffing works for the mechanics.
Every trick people use instead - a base word plus the site name, a number that increments, a "strong" password reserved for important accounts - is a pattern. Patterns survive contact with a leaked list. Random strings do not.
What actually makes a password strong now
Three things: length, uniqueness, and not appearing in a breach list. The rules many of us were trained on - a capital, a number, a symbol, changed every quarter - were dropped by the US standards body years ago because they made passwords harder for humans and no harder for software.
NIST's Digital Identity Guidelines (SP 800-63B) now tell the sites you log into what they must and must not do:
| Old habit | What NIST SP 800-63B says now |
|---|---|
| Change it every 90 days | Verifiers "SHALL NOT require subscribers to change passwords periodically" - force a change only on evidence of compromise |
| Mix upper, lower, digits, symbols | Verifiers "SHALL NOT impose other composition rules (e.g., requiring mixtures of different character types)" |
| 8 characters is fine | A minimum of 15 characters when the password is your only factor; at least 8 when it is part of multi-factor |
| Short cap on length | Sites "SHOULD permit a maximum password length of at least 64 characters" |
| Any password you can remember | Sites "SHALL compare the prospective secret against a blocklist" of known compromised passwords |
| Type it in by hand | Verifiers "SHALL allow the use of password managers and autofill functionality" |
Source: NIST Special Publication 800-63B, Digital Identity Guidelines, section 3.1.1.2 (pages.nist.gov/800-63-4/sp800-63b.html).
Read across that table and it describes a password manager. Fifteen or more characters, no pattern, checked against breach lists, never typed: that is the default output of a generator, and a chore for a human.
How to choose one
Any reputable manager beats reuse, so do not stall on the comparison. What matters is that it works everywhere you log in, that the provider cannot read your vault, and that you can get your data back out. Ignore feature lists and check those three.
- Zero-knowledge encryption - the vault is encrypted with your master password, so the company holds ciphertext it cannot decrypt.
- Every device you use - phone, laptop, and the browsers you actually open. A manager you cannot reach is a manager you will work around.
- A real export - you can pull your entries out in a standard file and move providers later.
- Independent security audits published by the vendor, and a public track record of how past incidents were handled.
- Breach checking and passkey support, so the manager can tell you which stored passwords are already circulating.
The manager built into your browser counts. It is a large upgrade on reuse, and it is free and already installed. Its limits are portability across browsers and scope, since it usually will not hold recovery codes and secure notes alongside your logins.
Setting one up without losing a weekend
The setup that fails is the one where you try to change 200 passwords on a Saturday. Do the install and the top handful of accounts, then let the rest happen by attrition: each time you log into something over the next few months, let the manager replace that password.
- Install the manager on your phone and your main computer, plus the browser extension.
- Set a long master passphrase - four or five unrelated words you can picture. Nothing reused.
- Save the recovery kit or emergency sheet on paper, before you put anything valuable in the vault.
- Turn on two-factor for the manager itself.
- Import the passwords already saved in your browser, then delete them from the browser.
- Change the passwords on email, banking, and your mobile carrier account first, using the generator.
- Run the manager's breach or health report and fix whatever it flags as reused or exposed.
That last report is the satisfying part. Most people find one password sitting on a dozen accounts, which is exactly the shape of failure attackers count on.
The two passwords you still have to remember
A manager does not eliminate memorised passwords, it reduces them to two: the master passphrase for the vault, and the password or PIN that unlocks your device. Everything else can be a random string you never see. Both survivors should be long passphrases rather than clever short ones.
Length is doing the work here, and sites are meant to accept at least 64 characters, so a five-word phrase is well within range. If you can also memorise your primary email password, do - it is the account you may need to reach when you are locked out of the vault.
Write the master passphrase down once, on paper, and put it somewhere only you can reach, such as a home safe or a sealed envelope with important documents. Paper in your house is not the threat model; forgetting is.
What two-factor authentication actually stops
Two-factor authentication asks for something beyond the password - a code, a prompt, a key - so a stolen password alone is not enough to get in. Google, with researchers from New York University and UC San Diego, measured how much each method blocked across three kinds of attack.
| Method | Automated bots | Bulk phishing | Targeted attacks |
|---|---|---|---|
| Recovery phone number on the account | 100% | 99% | 66% |
| SMS code to that number | 100% | 96% | 76% |
| On-device prompt | 100% | 99% | 90% |
Source: Google Security Blog, "New research: How effective is basic account hygiene at preventing hijacking", May 17, 2019, with New York University and UC San Diego.
Two things stand out. Automated attacks - the bulk, indiscriminate kind that most of us face - were stopped completely by every method tested. And the gap between methods only opens up under targeted attack, which is where the ranking below starts to matter.
The methods, ranked from weakest to strongest
All four of these are worth having over nothing. They differ in one specific way: whether an attacker who has built a convincing fake login page can get past them by relaying what you type. That property is called phishing resistance, and only the last two have it.
- SMS codes. The weakest, and still a big improvement. NIST treats sending codes over the phone network as a "restricted" method and tells sites to watch for "device swap, SIM change, number porting" - the mechanics behind a SIM swap attack.
- Authenticator app codes. The six-digit codes generated on your device. Nothing to intercept in transit, and no phone number to steal.
- Push prompts. An approve or deny notification on a device you already hold. This is the on-device prompt that scored 90% against targeted attacks.
- Security keys and passkeys. Hardware or cryptographic keys built on WebAuthn, which NIST names as an example of a standard that provides phishing resistance.
NIST is blunt about where the line falls: authenticators "that involve the manual entry of an authenticator output" - which covers both SMS and app codes - "SHALL NOT be considered phishing-resistant". If you can read a code and type it somewhere, you can be talked into typing it into the wrong place.
Passkeys, and why they cannot be phished
A passkey replaces the password with a cryptographic key pair. The private half stays on your device or in your password manager, unlocked by your face, fingerprint or PIN. The site holds only the public half, so a breach of that site leaks nothing that can log in as you.
The reason it resists phishing is binding. Your device signs a challenge tied to the real site's name, so a lookalike domain gets a signature that is useless to it. There is no code for a convincing caller to talk you into reading out, because there is no code.
In practice most sites still keep a password as a fallback, so a passkey usually sits alongside your vault entry rather than replacing it. Turn it on where it is offered, especially on email and financial accounts, and keep the strong password behind it.
Turn 2FA on in this order
Order matters, because accounts are not independent. Password resets cascade from your inbox, and phone-based verification cascades from your carrier account. Protecting a shopping site before your email is like locking the safe and leaving the front door open.
- Primary email. Everything else can be reset from here.
- Your password manager. The vault holding the rest.
- Your mobile carrier account. Control of your number defeats every SMS code you use.
- Banking, brokerage, and anything with a stored card.
- Cloud storage and work accounts, then the long tail as you come across it.
While you are in each account's security settings, remove old trusted devices and check the recovery email and phone number on file. Stale recovery details are a quiet back door that survives every password change you make.
Backup codes and the lockout everyone fears
The fear of being locked out is the single biggest reason people leave 2FA off, and it is a solvable problem. Every service that offers 2FA also issues one-time backup codes at setup. Saving them takes a minute and removes the risk that a lost phone becomes a lost account.
Print the backup codes or write them down and keep them with your other important documents. Storing them only inside the vault they might be needed to reach is a loop worth avoiding. Where a service allows a second factor - a spare security key, a second device - register it while you are there.
If your phone is your only factor and it goes missing, those codes are the difference between a bad afternoon and a permanent loss. Check them once a year when you review recovery settings.
What this does not fix
Strong unique passwords and 2FA protect your logins. They do nothing about data already in someone else's database, and nothing about the companies that publish your address and relatives. Credentials are the part of your exposure you control, not the whole of it.
Verizon's 2026 Data Breach Investigations Report, published May 19, 2026, found that exploitation of software vulnerabilities has become the most common way breaches start, at 31%, while credential abuse fell to 13% and lost its long-held top spot. Breaches will keep happening at companies you have no say over, which is why what you do after a breach still matters.
You can see which of your credentials are already circulating for free. Have I Been Pwned holds what it describes as hundreds of millions of passwords exposed in breaches, and its checker only ever sends the first five characters of your password's hash, so the password itself never leaves your device.
Check what is already out there
Run a free exposure scan to see which breaches include your email and which data brokers likely list you - no account, and nothing you type is stored.
Frequently asked questions
Is it safe to keep all my passwords in one place?
It is safer than the alternative you are doing now. A manager encrypts your vault so the provider cannot read it, and it removes the reuse that lets one breach open ten accounts. The single point of failure is real, which is why the master password gets 2FA too.
What happens if I forget my master password?
With most managers, nothing can be done - the encryption is designed so the company cannot recover it for you. That is why you save the recovery kit or emergency sheet on paper when you set up, before you put anything valuable in the vault.
Is the password manager built into my browser good enough?
It is far better than reusing one password, and NIST requires sites to allow autofill. Its limits are portability and scope: it is awkward to use across different browsers, and it usually will not hold your recovery codes, passkeys and secure notes in one place.
Do I still need to change my passwords every 90 days?
No. NIST SP 800-63B states that verifiers "SHALL NOT require subscribers to change passwords periodically" and should force a change only on evidence that the password has been compromised. Scheduled rotation pushed people toward predictable variations of one password.
Is SMS two-factor better than no two-factor?
Much better. In Google's research, an SMS code blocked 100% of automated bot attacks and 96% of bulk phishing. Its weakness is targeted attacks, where it stopped 76%, because a code you type can be relayed to a fake site and your number can be moved to another SIM.
What is a passkey, and do I still need a password?
A passkey is a cryptographic key stored on your device or in your manager and unlocked by your face, fingerprint or PIN. It is bound to the real site's name, so a lookalike login page gets nothing usable. Most sites still keep a password as a fallback.
Which accounts should I protect first?
Your primary email, then your password manager, then your mobile phone account. Email resets everything else, and control of your phone number defeats SMS codes. Banks and anything holding a saved card come next, then the long tail whenever you next log in.
What if a site offers no two-factor option at all?
Give it a long unique password from your manager and assume that account can fall on its own. Do not let it share a password with anything that matters, do not use it as a recovery address, and delete the account if you no longer need it.
Sources: NIST Special Publication 800-63B, Digital Identity Guidelines (pages.nist.gov/800-63-4/sp800-63b.html); Google Security Blog, "New research: How effective is basic account hygiene at preventing hijacking", May 17, 2019; Google / Harris Poll Online Security Survey, February 2019; Verizon 2026 Data Breach Investigations Report, May 19, 2026; Have I Been Pwned, Pwned Passwords.