Quick tips

• Length wins. A long passphrase of random words beats a short password full of symbols.
• One site, one password. Leaked passwords get tried everywhere. A password manager keeps them unique.
• Turn on two-step. An authenticator app or passkey stops most account takeovers, even with a stolen password.
• Never share a code. Banks never ask for a one-time code. The caller asking for it is the attacker.
• A padlock isn't proof. Fake sites have padlocks too. Check the domain, or let a password manager do it.