Password security: make unique passwords practical

By Ajay Ladva · 18 October 2026 · Account safety

A password can be long and still be a poor choice if it is reused, based on public information or easy to guess. The highest-value everyday habit is to use a unique credential for every account so that a breach at one service does not unlock another. That habit is difficult to maintain by memory alone, which is why a reputable password manager or a passkey is often more practical than inventing dozens of memorable variations.

Use unique credentials and a manager

Password reuse creates a chain reaction. Attackers routinely test credentials exposed in one breach against email, shopping, social, financial and workplace services. Changing only one character—such as adding a different number to a familiar base—does not reliably break that pattern. A password manager can generate and store random unique passwords, fill them into the correct site and make reuse easier to spot. Choose a manager with security practices you understand, protect its account with a strong master credential and secure its recovery route.

If using a master passphrase, choose several unrelated words or another method recommended by your manager's security guidance, and do not reuse it elsewhere. Length helps when the secret is genuinely unpredictable; a long quote, address or keyboard pattern can still be guessed. Keep recovery codes in a safe place separate from the device they protect. A manager reduces the memory burden but does not remove the need to keep devices updated and to watch for fake login pages.

Prefer passkeys when an account supports them

A passkey uses public-key cryptography and is typically unlocked using the device's screen lock or biometric check. It can resist phishing better than a password because authentication is tied to the website origin. Availability and syncing differ across platforms, so review the account's passkey setup and recovery options. If you use a passkey, maintain a secure recovery method and understand how you will sign in if a phone is lost or replaced.

Where passkeys are not available, enable multi-factor authentication (MFA), ideally with a security key or authenticator app when supported. SMS codes can still be better than a password alone, but may be exposed to SIM-swap and account-recovery attacks. MFA is not an excuse to reuse passwords; it is an additional layer. Store backup codes securely and never read an unsolicited login code to someone who calls or messages you.

Generate carefully and protect the result

The KRHTech Password Generator can create a random password in your browser. Select enough length for the service and avoid weakening the result just to make it memorable if you use a password manager. A random 16-character string from a large alphabet can have more uncertainty than a shorter human-made phrase, but exact strength depends on how randomness is generated, the allowed character set and how the account verifies credentials. A visual meter is an estimate, not a proof.

Never send a generated password through an unencrypted chat, place it in a public document or leave it visible in a screenshot. Check that the page address is correct before generating a secret, and close or clear the tool when finished on a shared computer. This website's tool is for generating values; it does not know whether a password was actually saved or later exposed. Avoid entering an existing password into any strength checker you do not fully trust.

Examples and common mistakes

Example one: you learn that a low-risk forum exposed your email and password. If that credential was unique, changing it at that forum may be enough; if it was reused, change every account with the same or similar password, starting with email and financial accounts. Example two: an account offers a passkey. Add it on a device you control, test recovery, then decide whether to keep a password as a fallback. Example three: a manager reports a password used on multiple sites. Replace each with a separate generated value instead of adding a suffix.

Common mistakes include reusing a “strong” password, using personal details in a passphrase, sharing a one-time code, storing recovery codes in the same unlocked notes app as the account password, and turning off MFA after a minor inconvenience. Also beware of password reset links sent unexpectedly: navigate to the service directly rather than following suspicious messages. No tool can guarantee an account will never be compromised; phishing, malware, service breaches and insecure recovery processes remain risks.

Make a sustainable checklist

Start with your primary email account because it often controls password resets. Give it a unique credential, turn on MFA or a passkey, verify recovery details and review active sessions. Then secure financial, work and cloud-storage accounts. Use the same process for other services over time rather than delaying until you have a perfect plan. Remove old accounts where practical, check breach alerts from reputable services and act directly on the account provider's official site.

Security is an ongoing practice, not a magic password length. Use unique passwords, a manager or passkeys, MFA, secure recovery and careful sign-in habits. Try the Password Generator to create a new random credential, and read the tool disclaimer for scope limitations. Do not use the generator to store or recover secrets; choose storage designed for that purpose.

Recognise phishing and protect recovery

A strong password can still be entered into a convincing fake login page. Check the domain before signing in, use a password manager's origin-aware autofill as one signal, and avoid logging in through unexpected email or text links. Attackers may target the recovery process rather than guess a password, so protect the email account and phone number used for resets. Review recovery addresses and trusted devices when you change phones or leave an organisation. Contact support using a known official channel if you receive an unexpected reset or MFA prompt.

Consider what happens if your primary device is lost. Keep recovery codes in a protected place, make sure another trusted device or account recovery option is available, and remove old sessions after a device is replaced. For workplace accounts, follow the organisation's approved manager and hardware-key policy rather than adding a personal workaround. These steps reduce lockout and takeover risks, but no checklist can eliminate the need to respond promptly to a provider's breach notice or suspicious login alert.