Nano-lesson · usually takes 2–3 minutes

Strong passwords & two-factor

Long passphrases, a password manager and MFA — the short version.

Get started →

Do you reuse your password?

Do you use the same password at work as on a webshop? When the webshop gets breached — and it will — criminals automatically try that same password everywhere else. That's why reuse is one of the most common ways in.

Next →

Do

• Use long passwords (a passphrase of 4+ words is better than "Summer2024!").
• Never reuse the same password across multiple services.
• Use a password manager — an app that remembers and fills in your passwords for you. Your phone already has one built in (iPhone: the "Passwords" app · Android: Google).
• Turn on two-factor (MFAMulti-factor authentication (MFA/2FA): an extra step beyond your password — such as a code or a tap on your phone — so a thief can't log in with the password alone.) everywhere you can.

Next →

Where is it safe to type your password?

🔒 https://login.my-company.co.uk

Only on the genuine site with https and a padlock — and let your password manager fill it in. It will refuse to autofill on a fake domain, so a missing autofill is a red flag.

Next →

If you get an unexpected MFA prompt

don't approve it — it can mean someone is trying to log in with your password.

Next →

Remember

💡

Length + uniqueness + MFA beats complexity.

Next →

What the research says

Two-factor (MFA) reduces the risk of account takeover by roughly 99.2% — even after a password leak. However, a password manager only helps if you let it generate new, unique passwords for you; and only around 13% change a leaked password within three months, so reuse is the big culprit.

Microsoft Research 2023 · Lyastani et al., USENIX Security 2018 · Bhagavatula et al., CMU 2020.

Next →

Question 1 of 3

Which password is hardest to crack?

Kx9!b# — short, but with symbols and numbers Summer2026! — and you change the year each year horse coffee window bicycle — four random words

Question 2 of 3

You use the same password for work and a webshop. The webshop gets hacked. What does that mean for your work account?

Only something if you also used the same username It's at risk — leaked passwords are automatically tried everywhere else Nothing — the webshop has nothing to do with work

Question 3 of 3

You need to create a login for a new system. How do you choose a password?

Let the password manager generate and remember a new, unique password Use your usual password, but change a digit at the end Use your very best password — it's strong, after all

Well done!

You've completed one of the foundation courses — the ones everyone gets for free.

With a free login:

• Your points, progress and course certificate are saved.
• You get courses tailored to your role — not just the foundation courses.
• We send training exactly when you need it — for example, as a follow-up to a phishing test.

Create a free login → ← See the other courses