The basics of choosing a good password for every account

Passwords remain one of the simplest ways to protect your identity, money, messages and personal files online. A strong password can prevent an opportunistic attacker from entering an account, while a weak or reused one can expose several services at once. The safest approach is practical rather than mysterious: use long, unique login secrets and support them with extra security controls.

Australians manage a growing collection of digital accounts, from online banking and superannuation portals to email, shopping websites, streaming services and government platforms. Someone in Sydney may use the same phone for banking and transport apps, while a household in Perth or Melbourne may share devices across work, study and entertainment. Each account deserves protection that reflects what could happen if it were taken over.

Reliable online information should be clear and easy to navigate, especially when security advice needs to be applied quickly. A dependable online starting point can help visitors find straightforward guidance without unnecessary complexity. The most useful password habits are easy to explain, easy to repeat and strong enough to withstand common automated attacks.

Start with the value of the account

A password protects whatever sits behind the login screen. Email deserves high priority because it can be used to reset other accounts. Banking, investment, tax, health, education and workplace accounts also contain information that can be valuable to criminals. Social media profiles and shopping accounts may seem less important, yet they can hold payment details, private conversations and enough personal information to support impersonation.

Begin by identifying accounts that could cause serious harm if accessed by someone else. Your primary email, Australian bank account, myGov account, password manager and mobile service account should receive particularly careful attention. A criminal who controls an email inbox may intercept password-reset messages, while access to a mobile account can interfere with verification codes.

The purpose is not to create one perfect password for everything. It is to create a different barrier for each service, with the strongest protection reserved for the accounts that connect to your identity or finances. This simple priority system makes password security more manageable when dozens of logins are involved.

Make length your first priority

Long passwords are generally harder for automated tools to guess than short passwords packed with unusual symbols. A memorable passphrase made from several unrelated words can provide useful length without forcing you to remember a random string. For example, four or five unrelated words are usually easier to recall than a short word with predictable substitutions such as replacing “a” with “@”.

Avoid information that can be found through social media or casual conversation. Names, birthdays, children’s names, favourite AFL teams, local suburbs and pet names are common choices, which makes them poor foundations for account security. Adding “123”, a year or an exclamation mark does little if the underlying phrase is obvious.

Every website sets its own password rules, so check the required length and permitted characters. If a service allows a long passphrase, use that space. A password that is easy for you to remember but difficult for software to predict is usually more useful than a complicated-looking option that you must write down beside the computer.

Keep every important password unique

Password reuse creates a chain reaction. If a retailer, forum or app suffers a data breach, criminals may test the exposed email address and password combination on other services. This automated practice, known as credential stuffing, can affect accounts that were never breached themselves.

A unique password means that one compromised service does not automatically unlock your email, bank or workplace account. It is particularly important to avoid reusing the password for your main email address. That inbox often controls account recovery, so it should have a password used nowhere else.

Some people create variations by adding a different number or website name to a familiar password. These patterns are easy for guessing software to identify. “BasePassword-Bank” and “BasePassword-Shop” may feel different, but they still reveal a common structure. Genuine uniqueness requires a separate, unpredictable password or passphrase for each important login.

Use a password manager carefully

A password manager stores encrypted login details and can generate a different random password for each account. This removes the burden of memorising dozens of complex credentials. It also makes it easier to avoid familiar patterns and to identify accounts where a password has been reused.

The manager’s master password becomes especially important. Make it long, memorable and exclusive to that service. Protect the manager with multi-factor authentication where available, and learn its account-recovery process before you need it. A reputable provider should explain how encryption, synchronisation and recovery work in plain language.

Use the manager’s built-in generator for accounts that support random passwords. Store secure notes for recovery codes, but avoid saving sensitive information in an unprotected document or browser note. On a shared computer, confirm that the password manager locks automatically and that other users cannot access your profile.

Add multi-factor authentication

A password is stronger when it is combined with another form of proof. Multi-factor authentication may use an authentication app, a security key, a biometric check or a one-time code. If a password is exposed, the second factor can still block an intruder.

Authentication apps and physical security keys are generally preferable to text messages when the service supports them, because mobile numbers can be targeted through SIM-swap scams. SMS verification remains useful where other methods are unavailable, but it should not be treated as invulnerable. Save backup codes in a secure location and do not store them beside the password they protect.

Be alert to unexpected approval requests. A criminal who already knows your password may repeatedly prompt your phone, hoping you will approve a login just to stop the notifications. Reject unfamiliar requests and change the password through the official app or website. Never provide a one-time code to someone who contacts you claiming to be from a bank, delivery company or government service.

Protect recovery details and personal records

Account recovery can be as important as the password itself. Use a separate recovery email address where appropriate, keep phone and contact details current, and review which devices or sessions remain signed in. Remove old phones, tablets and browser sessions after selling or replacing them.

Australian organisations covered by the Privacy Act 1988 and the Notifiable Data Breaches scheme have obligations relating to personal information and serious data breaches, but individuals still need to act when a service reports an incident. Read official breach notices carefully, change the affected password immediately and change it anywhere else it was reused. Be cautious of follow-up scams that imitate the affected company.

Financial accounts deserve extra attention because account compromise and identity theft can create practical problems beyond a stolen login. If you are checking what information lenders may see, an explanation of credit report calculation can provide useful context while you review the personal data connected to financial services. Protect reports, application records and identity documents as carefully as passwords.

Build secure habits for everyday use

Good password choices can be undermined by unsafe routines. Avoid entering credentials on public computers, and take care when using shared Wi-Fi in cafés, airports or hotels in Brisbane, Adelaide or elsewhere. A secure website address and a familiar app are safer starting points than links in unexpected emails or text messages.

Check the spelling of a website before signing in. Scammers often register addresses that resemble banks, retailers, delivery services and government platforms. Australian users should be especially wary of messages pretending to be from myGov, Australia Post, the Australian Taxation Office or a local bank. Open the official app or type the known address instead of following an urgent link.

Review account activity from time to time. Look for unfamiliar devices, locations, forwarding rules and connected applications. Change a password promptly when you suspect exposure, receive a breach notification or notice an unexpected login. Password security works best as a routine: long passphrases, unique credentials, multi-factor authentication and careful recovery settings together create several barriers between personal information and an attacker.