1.1Strong passwords & password manager
The essentials in 30 seconds
- Length over complexity: a 14-character passphrase beats a short complicated password — aim for a 12-14 character minimum.
- One account = one password: reuse is the cardinal sin — one breached site compromises all identical accounts.
- Email first: it is the ROI account that resets all the others — then the encrypted manager does the rest.
Threaded mini-case — Karim, office worker in Algiers
Karim, an office worker at a services company in Algiers, uses the same short password everywhere, email included. After a leak alert on an online shopping site, he installs the manager recommended by his IT manager, creates a 14-character passphrase as his master password, then changes his email, his bank and his work account first. Each week, he migrates a few accounts as he logs in.
This same case returns in the lesson, the diagram, the script and the 48h challenge — and continues in 1.2, 1.3, 1.4 and 1.5.
1. Length beats complexity
A weak or reused password remains attackers' first entry point: nearly one breached account in two falls to a password that is too simple or reused. The rule: length comes first — a 14-character passphrase beats a short password packed with symbols.
Karim remembers a string of words with a digit and a symbol: easy to memorise, very long to crack. He aims for a 12-14 character minimum, never less.
2. One account = one password
Reuse is the cardinal sin: one breached site = all your accounts with the same password compromised (credential stuffing attack). Email is the ROI account: whoever controls it resets all the others.
Karim changes his email first, then his bank and his work account: three generated passwords, all unique. The rest will follow as he logs in.
3. Outsource memory
A password manager is an encrypted vault: a single master password to remember, all others unique and generated. You no longer change passwords on a schedule, but as soon as any doubt or leak arises.
Karim lets the manager generate each password: he only remembers his master one. Ten minutes a day is enough to migrate everything else.
🔎 Concrete example — 🔎 Concrete example — Major cleanup operation
Secure the critical accounts first.
1) Install the manager recommended by IT.
2) Master password as passphrase (4-5 words + digit + symbol).
3) Change first: email, bank, work account (generated, unique).
→ each account ends up unique and strong, 10 min/dayTakeaway: email first, because it resets the others.
Lesson: the manager makes uniqueness painless day to day.
Section vocabulary
- Strong password
- A password long above all: a passphrase of at least 12-14 characters — length beats complexity.
Simple example: The 14-character passphrase Karim uses as his master password.
What it is not: a short password packed with symbols but reused everywhere.
Reflex: 12-14 character minimum, otherwise make it longer.
- Passphrase
- A string of words easy to remember and hard to guess, plus a digit and a symbol.
Simple example: The 4-5 words + digit + symbol Karim remembers as his only password.
What it is not: a single dictionary word with an exclamation mark.
Reflex: 4-5 words + digit + symbol: the only one to remember.
- Reuse
- Using the same password on several accounts: one breached site then compromises all the others.
Simple example: Karim used the same password for his email and a breached shopping site.
What it is not: a unique manager-generated password for each account.
Reflex: one account = one password, no exceptions.
- Password manager
- An encrypted vault that generates and stores unique passwords: a single master password to remember.
Simple example: The IT-recommended tool into which Karim migrates his accounts 10 min/day.
What it is not: a “passwords.xlsx” file or sticky notes on the screen.
Reflex: the IT-recommended one, with 2FA on it (see 1.2).
In practice — In practice — Major cleanup operation
- Install a password manager (the one recommended by your IT, or a recognised one for personal use).
- Create your master password as a passphrase: 4-5 words + a digit and a symbol — it is the ONLY one to remember from now on.
- Change the 3 critical accounts first: email (it resets all the others!), bank, main work account — unique generated passwords.
- Schedule the rest: 10 minutes a day, accounts migrate as you log in.
Ready-to-say script — ask IT for the manager (30 s)
“I want to secure my accounts: which password manager do you recommend here? I will start with my email, my bank and my work account, with a 14-character passphrase, then migrate 10 minutes a day.”
Say to the IT manager; never share the master password, even with IT.
Copy-paste template — migration plan
MANAGER CHOSEN: _______________
MASTER (passphrase 4-5 words + digit + symbol): created on _______________
CRITICAL CHANGED: email [ ] | bank [ ] | work account [ ]
MIGRATION 10 MIN/DAY: _______________
CHANGE IF: doubt or leak [ ] (never on a schedule)Overwhelmed beginner
Do not change everything at once: install the manager today, change email tomorrow, then 10 minutes a day as you log in.
Office in Algiers
Karim follows the tool recommended by his company and asks the IT manager when in doubt: internal guidance beats personal habits.
Already breached account
If a leak is reported: immediately change the affected password AND every account reusing it, starting with email.
No approved manager
While waiting for the approved tool: at minimum long, unique passphrases per critical account — never sticky notes or a “passwords.xlsx” file at the office.
✓ Best practices
- 12-14 minimum length.
- Email first.
- Generating manager.
✗ Common pitfalls
- Same password everywhere.
- Sticky note / passwords.xlsx.
- Scheduled changes.
Key takeaways
- Length over complexity: a 14-character passphrase beats a short complicated password.
- One account = one unique password, no exceptions — the manager makes this painless.
- Email is the ROI account: whoever controls it resets all the others.
- No more scheduled password changes — change as soon as any doubt or leak arises.
48h Challenge - apply tomorrow
Install the recommended manager (template above), create your 14-character master passphrase and change your email to a unique generated password. 30 minutes is enough.
- I can explain why length beats complexity (12-14 minimum).
- I know why email is the ROI account.
- I installed the manager + changed my email to unique.
Frequently asked questions
Isn't a password manager a single point of failure?
The risk exists but stays far below reuse: vaults are encrypted, and a strong master password + 2FA (next section) protects them. Official guidance explicitly recommends them.
Can I write my passwords in a notebook?
At home, a stored notebook beats reuse. At the office: never (sticky notes, “passwords.xlsx” Excel file: the first things found in an intrusion). The manager remains the real solution.
What mostly makes a password strong?