Password security best practices

It’s easy to feel overwhelmed by the number of online accounts you maintain for your business and personal use. Between social media, streaming platforms, news sites, banking, shopping, and all manners of apps, memberships, and subscriptions, it’s simply impossible to remember so many passwords.

One solution that many have opted for is to use weak passwords or the same password across multiple or even dozens of accounts—but these ‘solutions’ only make your accounts easier to hack. In the event one site is compromised, all your accounts using that email and password  combination also become compromised.

Fortunately, there are plenty of ways to keep your passwords and accounts secure.

Why should I securely store my passwords?

As cybersecurity becomes more sophisticated, so do the capabilities of cybercriminals. Take steps to defend yourself with some basic password safety tips, and avoid outcomes like these:

• Financial loss. Weak bank, investment, and shopping account passwords leave your finances vulnerable to hackers, who can breach your accounts to make unauthorized purchases and transfer out money. 
• Account takeover fraud. By using the same password for multiple accounts, a hacker only needs to crack one account to crack them all. The more accounts a hacker has access to, the easier it is for them to convince your friends, family, or bank that they’re you.
• Identity theft. Chances are you’ve stored your personal and payment information in a lot of different accounts. Criminals can use these to impersonate you in official circumstances, such as opening credit cards or bank accounts in your name to make fraudulent purchases. 

Don’t panic—remember that passwords aren’t your only shield from cyberattacks. Choose a personal or business checking account provider that encrypts your information and offers multi-factor authentication when you sign in.

Create a strong password

Crafting a password that’s easy to type but hard to crack is essential. Here are the basic steps for creating a strong password: 

1. Make it longer. Some sites may require you to create a password that’s at least a certain amount of characters. Generally, 10 or more characters is strongest.
2. Consider a passphrase. A passphrase is as it sounds—instead of a word, use a string of words such as lyrics, expressions, or quotations. Using a phrase will protect you from dictionary attacks and password sprays, basic hacking techniques for quickly guessing simple or common passwords.
3. Combine and substitute—uppercase, lowercase, numbers, and special characters. Hacking software is well-equipped to guess predictable sequences of letters, so mix the upper and lowercase letters of your phrase with numbers and special characters. An easy way to do this is to replace letters with numbers or add symbols between words. 

Use a unique password for each account, and use these techniques to shape a strong one. For example, start with a memorable phrase like “ARoseByAnyOtherName,” then add special characters to create “AR0se_ByAnyOtherN4me.” 

Use a password manager

Identity or account theft can be dire, but having to remember hundreds of passwords might sound even more oppressive. A primordial solution was to write one’s passwords on a sheet of paper, but this is easier to misplace than an app on the cloud.

The best storage for your passwords is a password manager app, such as 1Password, Bitwarden, LastPass, or Dashlane. With these, you’ll only have to remember one master password to access your vault. These apps sync across your devices and encrypt your passwords to keep them safe. 

Many internet browsers offer integrated password managers. While these are a convenient option, they’re usually accessible by anyone on your device. Instead, download the browser extension for your password manager app, which will give you the same capabilities but requires a sign-in and offers more security features. 

5 more ways to keep your passwords safe

The specter of a hacked account shouldn’t keep you awake at night. If you have a password manager filled with strong passwords, your accounts will be much safer than most. But there are other easy ways to defend your accounts, including: 

1. Change your passwords regularly.

Cybersecurity experts recommend changing your passwords as often as every 90 days. This might be inconvenient to do for all your accounts, but be sure to update passwords for your sensitive accounts like banking and email more frequently.

2. Use multi-factor authentication when possible.

Don’t settle for one line of defense. Multi-factor authentication (MFA) is a sign-in method which requires an additional credential. You’ve probably used this before—if you’ve been texted a code, answered a personal question, or scanned your fingerprint to access a site or app, then you’ve used MFA. 

3. Update your software.

Software developers or their users will often discover security vulnerabilities in their software and fix them with a patch. Keep your operating system, browsers, and apps up to date so they remain safe and compatible with one another.

4. Stay vigilant.

Set up email or text alerts to notify you about unauthorized sign-ins or transactions on your accounts. Keep an eye out for phishing scams in your emails, text messages, or phone calls and don’t give out personal or sign-in information unless you’ve verified where the message is coming from.

5. Never give your password to anyone.

Do not share your password with anybody, especially if they’re asking for it. Bluevine, nor any reputable company, will ever ask you for your password, so you should be wary if somebody ever requests it via email, text, or over the phone.