Passwords and Two-Step Sign-In, Explained Without Jargon

Good passwords are less about cleverness and more about not reusing them. A plain guide to the two habits that protect most accounts.

Why reusing a password is the real danger

When a company's records are stolen, the thieves often try the same email and password on other websites. If you use one password everywhere, a leak at a small shop can open your email, and your email can be used to reset almost everything else. The fix is simple to state: a different password for every important account.

What makes a password good

• Length. Longer is stronger. Several unrelated words strung together are easier to type and remember than a short jumble of symbols.
• Nothing personal. Avoid names of family, pets, streets and birthdays. These are easy to find out.
• Unique. Never the same as another account.

How to remember them all

You are not expected to. There are two respectable ways to keep track:

1. A password manager. A password manager is a program that stores passwords and can fill them in for you, so that you only need to remember one strong main password. Phones, tablets and web browsers usually have one built in.
2. A notebook kept at home. A paper book in a drawer is out of reach of anyone on the internet. Do not carry it in your handbag or wallet, and do not label it "passwords".

Either is far better than using one password everywhere. Choose the one you will actually keep up to date.

Two-step sign-in

Multi-factor authentication, often called two-step verification, means that you prove who you are in more than one way, typically something you know (the password) and something you have (your phone). After typing your password you are asked for a short code sent to your phone or shown in an app.

The benefit is that a stolen password alone is no longer enough. Turn it on first for your email, then for banking and shopping accounts. The setting is normally found under "Security" or "Sign-in" in the account settings.

The one rule about codes

Never read a sign-in code out to anybody, however polite or urgent they sound. A genuine bank, shop or government office will not telephone you and ask for the code they have just sent. Anyone who asks for it is trying to get into your account.

Looking after your email first

Your email account is the master key, because "forgot my password" links are sent there. Give it your strongest password and two-step sign-in, and check that the recovery phone number and backup address are still yours.

Getting help safely

It is sensible to ask a trusted relative or a volunteer at a digital help session to sit beside you while you set this up. Type the passwords yourself, and do not let anyone you do not know well keep a copy. If a helper needed to know a password, change it afterwards.

A short routine

• Install updates on your phone, tablet and computer when they are offered.
• Lock your phone with a PIN or fingerprint.
• Once a year, look through your list and close accounts you no longer use.

Written by Winifred Castellan · last checked 2026-11-12