Please use a password manager

There are two sorts of people in the world; those who know they are stupid and those who think they are clever.

Stupid people use a password manager. They know they can't remember a hundred different passwords and so outsource the thinking to something reasonably secure. I'm a stupid person and am very happy to have BitWarden generate and save fiendishly complex unique passwords which are then protected by the app's MFA. Lovely!

But people who think they are clever decide to bypass that and use their own super-secret algorithm.

...

Pick a password manager. Secure it with a reasonably strong password and multi-factor authentication. Let it do the hard work of remembering.

No security is perfect. And some security is so hard to use that it becomes completely untenable in everyday lives. Thankfully a password manager strikes the balance between somewhat secure and mostly usable.

When choosing a strong password for your password manager, I prefer the xkcd approach.

For cross platform compatibility I recommend 1Password. Apple’s Passwords app is slowly getting better though, and I’d happily recommend it to anyone not using a password manager already. It will at least get them in the door of using randomly generated passwords instead of some guaranteed to fail attempt at a personal algorithm.

So, nuts and bolts of all this if you haven’t tried it already.

If you’re setting up a Password Manager, you’ll want to allow the app to generate all your passwords for you. Don’t try to create your own. Let it be random, and as long as is reasonable. Those types of passwords are hard to crack. And, in the almost guaranteed event the password gets leaked, you won’t have to worry about that single use password allowing access to other apps you use.

So, a single password for each application, locked under a strong password for your password manager.

If you’re using Apple Passwords the app will be locked under Face ID. Which is a good middle ground to keep your online stuff safe.