Passwords made simple: managers, 2-step and passkeys

Last checked November 2026. Offers and rules change: confirm with the provider before you rely on them.

You do not need to remember dozens of complicated passwords. Use a strong, separate password for your email, let a password manager or a carefully kept notebook remember the rest, and switch on two-step verification for the accounts that matter most.

The three rules that do most of the work

Protect your email above all. Your email is the master key: anyone who gets into it can press "forgotten password" on your other accounts and take them over. Give it a strong password used nowhere else.
Never reuse a password on important accounts. When a shop's website is broken into, criminals try the stolen passwords on banks and email. A different password for each account stops one leak becoming many.
Turn on two-step verification for email, banking and shopping accounts that hold your card details.

Making a strong password you can remember

The UK's National Cyber Security Centre (NCSC), part of GCHQ, recommends joining three random words, such as "teapotcanalvelvet". It is long, which is what makes a password strong, yet easy to picture. Add a capital, number or symbol if a website insists.

Choose words with no link to you. Avoid names of family or pets, your street, your football team and dates of birth, all of which can be guessed or found online.

The NCSC's advice for individuals is on its Cyber Aware pages.

Three ways to keep track of them

1. Let your phone, tablet or browser save them

iPhones, iPads, Android devices and the main web browsers offer to save each password and fill it in next time. This is free, already installed and, according to the NCSC, a safe choice for most people. The passwords are locked behind your device's PIN, fingerprint or face. This is the simplest option if you use one or two devices.

2. A password manager app

A password manager is a secure digital notebook. It creates a long random password for every account, stores them, and fills them in on all your devices. You remember just one "master password", which should be three or more random words and never reused. Some are free; paid versions typically cost from around £20 to £50 a year, as a rough guide at the time of writing (November 2026).

3. Writing them down

Writing passwords in a notebook is fine, provided you treat it like a valuable. A burglar is a far smaller risk than a criminal on the internet, and a notebook cannot be hacked.

Keep it at home, out of sight, away from the computer. Not in a handbag, wallet or the car.
Never keep a list of passwords in an ordinary document or email on your computer or phone.
Use an address-style book with A to Z tabs so entries are easy to find, and write clearly, noting which letters are capitals.
Never write down your bank card PIN alongside the card.

Two-step verification in plain English

Two-step verification (also called 2SV, two-factor authentication or 2FA) means that logging in from a new device needs two things: your password and a second proof that it is really you. Even if a criminal learns your password, they are stuck without the second step.

The second step is usually one of these:

A code sent by text message to your mobile.
A code from an authenticator app on your phone, which shows a fresh six-digit number every 30 seconds.
A prompt on your phone asking "Is this you?", which you approve.

You will find it under Security in an account's settings. Start with your email. When you switch it on, save the backup codes you are offered in your notebook, in case you lose your phone.

Watch out: A verification code is for you to type in yourself. No bank, shop, phone company or police officer will ever ring or message asking you to read one out. Anyone who does is trying to break into your account. Hang up. See spotting scams.

Passkeys: logging in without a password

A passkey is a newer, safer replacement for a password. Instead of typing anything, you unlock your account the way you unlock your phone: with your fingerprint, your face or the device PIN.

Behind the scenes your device holds a secret digital key for that one website, and proves it has the key without ever sending it. In practical terms that means:

there is nothing to remember and nothing to type;
there is nothing a fraudster can trick you into revealing, because you do not know the key yourself;
a passkey only works on the genuine website, so a fake look-alike site gets nothing.

Many large services, including the main email providers, big retailers and some government services, now offer passkeys. If a site you trust invites you to "create a passkey", it is generally sensible to say yes. Your passkeys are saved to your Apple or Google account or your password manager, so they move to a new phone when you upgrade. Keep the password as a fallback while you get used to it.

Setup tips a family member can help with

List the important accounts together: email, bank, supermarket, the main shopping sites, GP and NHS login, energy and phone.
Change the email password first, then any password used on more than one site.
Switch on two-step verification for email and record the backup codes.
Check the account recovery details: an up-to-date mobile number and a second email address.
Set a screen lock on every phone and tablet.
Agree where the notebook lives, and who should know where it is in an emergency.

A helper should set things up with you, not for you. They should not keep your banking passwords; if someone needs to manage your money, ask your bank about third-party access or see GOV.UK on lasting power of attorney. Our guide to shopping for someone else covers safer ways to share.

Mistakes to avoid

One password for everything.
Typing a password into a page reached from a link in an email or text. Go to the website yourself instead; see online shopping safety.
Letting a caller "help" by remote control of your device.
Forgetting the master password to a password manager. Write that one down and store it somewhere very safe.

Common questions

Do I need to change my passwords regularly?

No. Current NCSC guidance is to change a password when you think it may have been discovered or the service tells you it was involved in a breach, not on a schedule.

What if I think someone has my password?

Change it immediately, and on any other account where you used it. If money is involved, ring your bank on the number on your card. See paying safely online.

What happens to my accounts if I die or lose capacity?

Tell someone you trust where your notebook is kept. Apple and Google both let you name a trusted contact in advance. For legal authority over finances, look at lasting power of attorney on GOV.UK.