Is it safe to let my browser save passwords?

Yes, for most households. The built-in managers in Chrome, Edge, Firefox and Safari are competent and encrypted. Using one is vastly safer than reusing the same password across sites, which is the actual risk most people face.

How often should I change my passwords?

Not on a schedule. Forced regular changes make people pick weaker, more predictable passwords. Change one when there is a reason — a breach notification, or a password you know is reused.

Is writing passwords in a notebook really acceptable?

It is far better than reusing one password everywhere, provided the book stays at home. The realistic threat to your accounts is an automated attack from the other side of the world, not somebody in your kitchen.

What if I forget the master password to my password manager?

Most managers cannot recover it by design — that is what makes them secure. Write the master passphrase down and keep it somewhere safe at home. It is the one password worth having on paper.

28 Jul 2026 · 6 min read

Passwords: the only three rules that matter

Forget the special-character rituals. Length, uniqueness and a manager to remember them — that is the whole of it.

Most password advice is a decade out of date, including the advice still printed on the sign-up page of plenty of Australian websites. The rules that actually protect you are shorter and easier to follow than the ones most people were taught.

Rule one: length beats complexity

The old advice — a word with a capital, a number and a symbol — produces passwords that are hard for humans to remember and easy for computers to guess. `P@ssw0rd1` follows every one of those rules and is among the first things any attacker tries.

What actually resists guessing is length. Four unrelated words strung together is both stronger and far easier to type than a mangled single word, because each additional character multiplies the number of possibilities an attacker has to work through.

Under 12 characters is a formality — treat it as no protection at all
14 to 16 characters is a sensible floor for anything that matters
A passphrase of four or five random words is easy to remember and genuinely strong

Rule two: uniqueness matters more than strength

This is the rule that actually protects people, and the one most often ignored.

When a website is breached, the stolen email-and-password pairs are fed into automated tools that try the same combination against banks, email providers, retailers and social networks. That is called credential stuffing, and it is the mechanism behind the overwhelming majority of ordinary account compromises.

A very strong password reused across ten sites protects you against none of this. The moment one of those ten sites is breached — and you have no control over which, or when — every account sharing that password is open. A weaker password used in exactly one place is safer.

Variation schemes do not work

People commonly use a base password with the site name added: `bluehouse-netflix`, `bluehouse-ebay`. It feels clever and it does not survive contact with a human attacker for thirty seconds. If your credentials appear in a breach, the pattern is obvious from a single example.

Rule three: use a manager, because you cannot do this by memory

The first two rules are impossible to follow manually. Nobody remembers forty unique 16-character passphrases, and any system simple enough to remember is simple enough to guess.

A password manager generates and stores them, and you remember exactly one strong passphrase to unlock it. This is not a compromise or a lesser option — it is what security professionals do.

The browser one: Chrome, Edge, Firefox and Safari all have a competent built-in manager, free, syncing across your devices. For most households this is genuinely enough, and it is vastly better than reuse.
A dedicated manager: Bitwarden, 1Password and similar add sharing, secure notes and better recovery. Worth it if you have a business, or need to share logins with family.
A notebook: Genuinely better than reusing one password everywhere, if the book stays at home. The threat to your accounts is an automated attack from overseas, not a burglar reading your notebook.

The thing that matters more than any password

Turn on two-factor authentication for your email account first, before anything else.

Your email is the master key. Every other account has a "forgot password" link that sends a reset to it, so an attacker with your email does not need any of your other passwords. Secure that one account properly and you have protected everything downstream.

Email first — it controls resets for everything else
Then banking and anything holding your money
Then anything with your card stored: retailers, food delivery, app stores
Then the rest, as you get to them

Which second factor to choose

An authenticator app on your phone is better than SMS codes, because SMS can be intercepted by having your number transferred to another SIM. Both are enormously better than nothing, so if SMS is the only option a site offers, use it rather than skipping it.

What to do this week

You do not need to fix forty accounts. Do these three things and you have addressed most of your actual risk.

Turn on two-factor authentication for your email account
Change your email password to a long unique passphrase, stored in a manager
Change your banking password to a different long unique passphrase

Then change others opportunistically — every time a site makes you log in again, take the extra thirty seconds. If you would like help setting a manager up across a household's devices, that is a normal part of a setup visit.

Want us to just handle it? Free diagnosis, fixed price, no fix no fee.

0423 680 596