You do not need to memorise dozens of complicated passwords. Secure the accounts that unlock everything else, let a password manager handle the rest, and plan for a lost phone.
Somewhere between your first email address and your latest online account, passwords became a second job. You know reusing the same one is a bad idea. You also know that memorising a different string of punctuation for every website is not going to happen.
The answer is not a heroic weekend spent resetting every account you have ever opened. It is to protect the few accounts that matter most, stop creating passwords by hand and make sure you can still get in if your phone disappears.
Start with your main email account. It receives password-reset messages for other services, so access to it can become access to much more. Give it a strong password that you do not use anywhere else, then switch on two-step verification: an extra check, such as a code or a prompt on your phone, when you sign in.
Next, look at your password manager or the account that synchronises saved passwords across your devices. Then deal with banking, shopping accounts holding payment details, and services containing sensitive personal information. That might include your HMRC account or, if you use it, NHS login. There is no need to pretend an abandoned forum account from 2009 deserves the same urgency.
Check the recovery options while you are there. Is the backup email address still yours? Is the phone number current? If a service gives you recovery codes, store them somewhere you can reach without the phone you normally use to sign in. An account is not particularly secure if you are locked out the moment you change handsets.
If you discover that one password is used across several accounts, replace it on each of them. A criminal who obtains it from one service can try it elsewhere. Do the important accounts first; you can work through the less consequential ones as you encounter them.
On your own, properly secured device, yes: the UK’s National Cyber Security Centre (NCSC) says a browser or device password manager is a sensible way to save them. It can also generate a long, unique password for each new account. Let it. You do not have to be able to recite the password for a shop you visit twice a year.
Protect the device with a PIN, password or biometric unlock, and keep its software and browser updated. Do not save passwords on a library computer or a shared household profile if other people should not be able to use your accounts. Convenience stops being convenient when somebody else has it too.
You do not need a better memory. You need fewer passwords that depend on it.
A separate password-manager app can make sense if you use a mixture of browsers and devices, or want features such as controlled password sharing. It is not automatically a better purchase than the tools already built into your phone and browser. Whichever route you take, secure the account behind it with two-step verification and learn how its recovery process works before you need it.
Keep a memorable, unique password for the accounts you may have to reach without your usual device, especially email and, where required, your password manager. The NCSC suggests combining three unrelated words rather than relying on predictable substitutions such as swapping letters for numbers. Do not use its published examples, your children’s names or your football club. A private note kept safely at home can be a reasonable backup; check the terms of any service before writing down its login details, particularly online banking.
If a service offers a passkey, it is worth considering. A passkey is a sign-in credential created for one particular website or app and stored on your device or in a compatible password manager. You typically approve the login with the same fingerprint, face check or PIN you use to unlock your device. Unlike a password, there is no secret to type into a convincing-looking fake login page.
The NCSC recommends choosing passkeys where they are available. NHS login offers them too: if you use the NHS App, you may already see the option in your login settings. The NHS App is for people registered with a GP practice in England or the Isle of Man; do not assume the same app is available for GP services in Scotland, Wales or Northern Ireland.
A passkey does not remove the need to think about recovery. Before changing phones, check where yours are stored, whether they synchronise to another device and how you would sign in if you lost access. NHS login, for example, explains how to add another passkey and what to do if a device is lost. Keep any remaining password and recovery methods secure as well: a passkey cannot protect an account if an easier route back in is left exposed.
You need not convert everything in one sitting. Use a passkey when a familiar service offers one and you understand how to recover access. For services that do not, a unique password and two-step verification remain the practical answer.
Do not start by clicking a link in a frightening text about your tax account. Open the app yourself or find the service through its official website. If you can still sign in to a compromised account, follow its recovery instructions. For email, check for unfamiliar forwarding rules: someone may have arranged to receive copies of your messages, including password resets.
Change the affected password and any other account passwords that match it. Sign out other devices or sessions if the service allows it, review recovery details and turn on two-step verification. If banking or card information may have been taken, contact your bank promptly. A password manager cannot undo a breach, but unique passwords help contain the damage.
For suspicious messages, forward emails to the NCSC at report@phishing.gov.uk and texts to 7726. If the message claims to be from HMRC, you can instead forward the email to phishing@hmrc.gov.uk or the text to 60599; HMRC says texts sent to 60599 are charged at your network rate. Reporting is useful, but do not mistake it for securing an account you think has been accessed. That part still needs your attention.
Secure your email, password storage and other important accounts first, using unique passwords and two-step verification. Let a browser or reputable password manager create and remember the rest. Choose passkeys where offered, but check how you would get back in without your phone.
Fingerprint and face unlock make signing in easier, but passkeys do the important security work. Here’s what stays on your device, what can go wrong and where to start.
Your best summer pictures are buried beneath screenshots and receipts. Here is how to find them, keep a safe copy and reclaim phone space without another subscription.
A robot vacuum can keep everyday dust under control, but it cannot retire your ordinary vacuum. Here is how to decide whether your floors justify the expense.
AI can sift applications, set shifts and flag performance. That does not make it a good manager. Here is where the software helps, where it fails and what you can challenge.
Newsletter
The best guides of the week — collected, without the noise, for anyone who likes to stay a step ahead.
