The most effective way to protect your accounts is to use a different, long password for each one, store those passwords in a well-vetted password manager, and enable the strongest multifactor authentication (MFA) each service supports. Change a password when there is evidence it has been exposed—not just because a calendar reminder says it is time.
Why every account needs its own password
If you reuse a password, a breach at one service can put other accounts at risk: someone who obtains that password may try it elsewhere. CISA recommends unique passwords and password managers to help avoid reuse (CISA: Use Strong Passwords).
As an Amazon Associate I earn from qualifying purchases.
Use a long, randomly generated password for each account. Avoid predictable personal details and easy substitutions. A password manager can generate and remember distinct credentials so you do not have to memorize them all.
How long should a password be?
NIST’s current digital identity guidance, SP 800-63B-4, was published in July 2025. For organizations that verify passwords centrally, it requires a minimum of 15 characters when a password is used as a single factor. If a password is used only as part of MFA, the verifier may allow a shorter one but must require at least eight characters. Verifiers should allow passwords of at least 64 characters (NIST SP 800-63B-4; NIST publication record).
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
These are requirements for verifiers and credential service providers under the standard, not a guarantee that every consumer website follows them. As a user, choose a long password wherever a service allows one.
NIST’s standard also says verifiers must not require arbitrary mixtures of uppercase and lowercase letters, numbers, and symbols; must not require periodic changes unless there is evidence of compromise; and must check new passwords against a blocklist of common, expected, or compromised values. Passwords are not phishing-resistant, which is one reason MFA matters.
Rank #2
- Requires 3 "AAA" batteries (included)
- Unit auto-locks for 30 minutes after 5 consecutive incorrect PINs
CISA’s guidance for state, local, tribal, and territorial (SLTT) government audiences offers an example of 16 or more characters or a passphrase of five to seven unrelated words, alongside uniqueness and password-manager use (CISA: Securing Our World: Strong Passwords). This is an illustrative recommendation for that audience; NIST’s verifier requirements are a separate, broader standard.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteHow to choose a password manager
A password manager can create and store unique credentials, but you should understand how it fits your devices and how you would recover access before entrusting it with account logins. CISA’s selection guidance suggests checking these points (CISA: Use Strong Passwords):
- Device and browser support: Confirm it works on every computer, phone, tablet, and browser you use.
- Password generation: Check that it can generate long, random, unique passwords that meet the services’ limits.
- Storage and sync: Cloud sync is convenient across devices but can create exposure to sophisticated attacks. A locally maintained database may reduce some exposure, but you are responsible for careful backups and maintenance.
- Vault protection: Understand the master-password requirements and enable MFA for access to the vault if available.
- Recovery: Learn how account recovery works before you need it. Consider what happens if you forget the master password or lose access to a device.
- Product and developer security: Assess the manager and its developer. The vault holds credentials to your other accounts, so its security practices matter.
No single password manager can be called best on this evidence alone. Product security, recovery behavior, device coverage, and current features should be checked for the specific option you are considering.
Which MFA method should you use?
MFA adds a verification step beyond a password, so knowing the password alone may not be enough to sign in. Turn it on wherever it is offered, prioritizing email and other high-impact accounts, then financial, cloud-storage, social, shopping, and work accounts as available (CISA: Turn On MFA).
Rank #4
- FIDO-ONLY FUNCTIONALITY: Supports FIDO2 (passkeys) and FIDO U2F protocols for passwordless and second-factor authentication. Does not support OTP, TOTP, Smart Card (PIV), or other advanced features - upgrade to YubiKey 5 Series for extended functionality
- SECURE AND CONVENIENT: Passwordless MFA login with the YubiKey Bio authenticator and biometric information using a fingerprint, with a PIN as a fallback. Simply plug in via USB and use your fingerprint to authenticate
- DEVICE & OS COMPATIBILITY: Compatible with Windows, macOS, ChromeOS, and Linux. Works seamlessly with supported services like Google and Microsoft accounts, and major password managers. See the full compatibility list at "Works With YubiKey"
- DURABLE & RELIABLE: Resistant to tampering, water, and crushing. No batteries or network connectivity required, offering dependable authentication without any downtime. Securely manufactured in USA & Sweden
- Yubico Authenticator App - Fingerprint enrollment, passkey management and PIN configuration available via the app app - Upgrade to YubiKey 5 Series to generate one-time-passwords (OTP) via Yubico Authenticator and for advanced compatibility (OATH, PIV)
CISA’s business guidance ranks its listed choices from strongest to weakest as follows. Availability depends on the account and device; use the strongest option the service supports (CISA: Implementing Phishing-Resistant MFA):
Free tools Windows power users keep installed
One-click scans. No signup required.
| Method | Practical guidance |
|---|---|
| Physical security key | Strongest phishing protection among the methods in CISA’s listed hierarchy. Use one only where the account and device support it. |
| Authenticator app with number matching | Use it when a service offers this option and a security key is unavailable. |
| Authenticator app with one-time code | A stronger choice than text or email codes when that is the app-based option the service provides. |
| Biometrics | CISA lists biometrics as best when paired with another method. |
| Text or email code | Weaker than the other methods in this list; use when stronger options are unavailable. |
Should you use a security key?
A FIDO-compatible physical security key is an optional MFA factor, not a replacement for unique passwords across accounts. Before buying one, check that the services you need and your devices support it; compatibility is not universal. CISA identifies a physical key such as a YubiKey as its strongest listed choice for phishing protection, but that does not establish that a particular key works with every account (CISA: Implementing Phishing-Resistant MFA).
When should you change a password?
Change a password when a service reports that it was exposed or you otherwise have evidence it may be compromised. NIST advises against mandatory periodic changes without evidence of compromise; changing passwords on a fixed calendar is not a substitute for using unique credentials and MFA.
Quick Recap
- Change the affected account’s password to a new, unique one.
- If you reused that password elsewhere, replace it on every account where it was used.
- Turn on MFA for the affected account and review its available sign-in and recovery options.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
