Using passwords or passphrases that are long and unique can strengthen your cyber resiliency because they are harder for cybercriminals to guess, which helps protect your online accounts and the information you have stored in them - personal information and finanical data (credit card and bank accounts numbers). Strong passwords/passphrases serve as the first line of defense for protecting your information.

• Strong passwords rely on length and complexity (using different character types).
• Strong passphrases rely on five to seven unassociated words. They are usually longer than a password and can be easier to remember.

Different websites or apps have their own rules for meeting password requirements. Follow what is required, but never reuse the same password or use one that is similar to another – Password1! and Password2! are too similar and easy for cybercriminals to guess.

Think of it this way:

• A short, weak password is like locking your front door but leaving the key in the lock. 
• Reusing the same password for multiple accounts is like using a master key for your house, car, and safe – and leaving it in the front door. If a cybercriminal gets it, everything is at risk.

Protect your online accounts and devices, as well as the sensitive or personal data that you keep there.

What you can do

• Use /mnit/assets/Stay%20cyber%20smart%20-%20Use%20strong%20passwords_tcm38-710079.pdfthis handout to create strong passwords.
• Review this /mnit/assets/Passwords%20and%20Passphrases_tcm38-708144.pdfPasswords & Passphrases handout for helpful tips.

Seven tips to protect your accounts and devices:

 1. Use long, unique passwords/passphrases. 

Use a long, unique password or passphrase to protect each of your devices (phone, work laptop, home computer, and WiFi equipment) and each of your online accounts, including bank, social media, retail, and email. 

Each password/passphrase should be different than the next, so if a cybercriminal compromises your social media password, they can't access your bank account because you've set up a different password for that account.

• A long, strong password/passphrase uses multiple random words, special characters, numbers, and is at least 14 characters long.

2. Create non-personal passwords or passphrases.

Many people incorporate personal information like family names and dates into their passwords to make them easier to remember; but that’s not safe. 

Do not use passwords or passphrases that include personal data. With so much data available online, using personal information makes it easier for cyber attackers to hack those accounts quickly. 

3. Avoid using common names, interests, or places in your passwords or passphrases.

• Places: Rome, London and other major cities are popular choices for passwords. Pick a random place that means something only to you.
• Teams, musicians, and people: The Phoenix Suns and Miami Heat are used by 2 million people. Although the Twins and Vikings aren’t in the Top 10, those names and Taylor Swift aren’t the best choices because cybercriminals can easily guess them.
•  Check out the list of most common passwords for 2026.

4. Avoid using common names, words or sequences.

• Personal data: Family or pet names and birthdates. The most common names to use in a password are Eva, Alex, Anna, Max, and Ava.
• Curse words: The top-used curse word has over 26 million occurrences.
• Number/letter sequences and years: 12345678 is no better than 123 or qwerty, your birth year, or the current year. 

5. Use a password manager.

A reliable password manager can generate and store all your passwords and passphrases in one place. Then, you only need to remember one password – the one for the password manager. 

Check industry expert recommendations from recognized sources like CNET, PC Magazine, and Wired.

6. Check for data breaches.

Regularly check the https://haveibeenpwned.com website to see if your accounts have been compromised or if there are known exposures.

7. Immediately change passwords/passphrases involved in a data breach.

If your account has been compromised, or if your credentials (username and/or password) were involved in a known or suspected data breach, change your password/passphrase immediately. Also, change any passwords and passphrases that are similar.

It’s faster to change passwords and passphrases now, than to resolve data exposure issues later.