Loading…
Loading…
One reused password can bring down every account you own.
Your passwords are the locks on your digital life, and most break-ins are not sophisticated: a short password is guessed in seconds, and a reused one shows up in a data leak and gets tried automatically everywhere else. That's called credential stuffing, and it's the leading cause of account takeovers.
The good news: protecting yourself is simpler than it looks. One long, unique password per account, a password manager so you don't have to remember them, and two-factor authentication (2FA) on the accounts that matter. This theme teaches you to judge real password strength and set all of this up without friction.
Learn to judge a password's real strength, beyond appearances.
A good password is long and unpredictable: aim for a phrase of several random words.
10 exercises per level, mixing decision, spotting and quiz. The first 2 levels are free; the next ones open with any subscription.
Each level ends with a mission: what remains to be done once the lesson is understood. Some rely on your report, others on a setting we cannot see: it says so each time.
Your email receives the reset links for your other accounts, so that's where to start. Replace its password with a phrase of several randomly chosen words, used nowhere else.
Check whether your scan finds one of your passwords in a breach. If you used it on other accounts, change it everywhere, starting with your email and your bank. A leaked password is never used again.
Save your email and bank logins in a password manager: free ones exist, and your browser has one built in. If it can spot weak or reused passwords, run that check and fix what it finds.
In your email account's security settings, turn on two-factor authentication, with an authenticator app rather than text messages if you have the choice. Write the backup codes on paper and keep them away from your inbox.
Open your email account's recovery options. The backup address and number must be yours and current: remove an old number or an abandoned address. Whoever controls them can take over the account without your password.