Passwords that survive a data breach
Breaches are routine; losing your accounts because of one is not. Unique passwords, passphrases and two-step sign-in, explained in plain language.
Large services are breached every year, and the email addresses and passwords stolen from one site are tried automatically on thousands of others. This is called credential stuffing. It works because most people reuse a handful of passwords.
Three habits that close the door
- One password per site. If a shopping site leaks your password, your email and bank stay safe.
- Long beats clever. A passphrase of four or five unrelated words is easier to remember and harder to guess than a short password full of symbols.
- Turn on two-step sign-in for email, banking and social media. Prefer an authenticator app to SMS where the service offers it.
Your email account deserves the strongest protection of all: whoever controls it can reset every other password.
Remembering them all
A password manager stores a different strong password for every site and fills it in for you. It also refuses to fill a password on a look-alike site — which makes it a quiet defence against phishing.
How TotalHeal helps
Every TotalHeal plan includes a password breach check, so you can see whether a password appears in known breaches. A password manager with Touch ID unlock, exact-site autofill and a family vault is built for Ultimate and arrives in an upcoming desktop update. See identity protection.