Make each password different
When one service is breached, criminals try the exposed password elsewhere. Reusing it for email, shopping and banking lets one breach spread. Give every account its own password, starting with your main email.
Use a manager or a memorable passphrase
A password manager can generate and store long random passwords so you do not have to memorise each one. Choose a reputable, actively maintained manager, install it from its official source and protect it with a strong master passphrase and MFA where available. Learn its recovery process before relying on it.
For a password you must remember, use several unrelated, randomly selected words. Aim for at least 16 characters when the service permits, and follow its length rules. Avoid names, dates, song lyrics, Kenyan ID numbers, team names and predictable substitutions. Do not copy an example password from any guide.
Move away from reused passwords
Secure your email and password manager first.
Replace repeated passwords on financial and other sensitive accounts.
Enable MFA or adopt passkeys where available.
Remove saved passwords from shared computers and review who can unlock your own device.
Know when a change is needed
Change a password when it has been shared, exposed in a breach, reused on a breached service or entered on a suspicious page. Do not respond to a password-expiry email by following its link: open the service directly. Routine changes are less helpful than unique, strong passwords and responding promptly to actual exposure.
If someone may know your password
Use a trusted device to change it, sign out other sessions and check recovery settings. Replace it anywhere it was reused. If your device may be infected, secure or replace it before entering new credentials. Never send a password to anyone claiming to be support.
Useful references
Here to help
Something doesn’t look right?
Prepare an incident report with the details that matter.