Everything You Need to Know to Keep Your Passwords Secure | McAfee Blog

When it comes to passwords, most of us would love nothing more than to set it and forget it. But that’s exactly what hackers are hoping for — in fact, it makes their job a lot easier. This means the best line of defense is frequent password changes.   

But how often should you create new passwords? Cybersecurity experts recommend changing your password every three months. There may even be situations where you should change your password immediately, especially if a cybercriminal has access to your account.   

This article explores those exact situations and covers some of the best password practices you can use to help safeguard these important combinations of letters and numbers.   

Change your password immediately if: 

1. Your account was hacked: If you think someone has hacked your account, it’s important to act fast and change your password. Did everyone in your address book get a strange email that looks like it’s from you? Change your email password. Are your Facebook friends getting a new friend request from you? Something’s not right, so you’ll want to change your password. This can help limit the amount of time a cybercriminal has access to your account.  
2. You are part of a data breach: If there’s a password breach at work or within a company you do business with, you’ll want to change the password for any affected accounts. If you use that password for any other websites, you’ll definitely want to change your password to those accounts. If hackers get access to your password, they may try it on multiple websites to see what else they can steal.  
3. You used an unsecured network: As much as possible, try to avoid logging into your secure accounts on public Wi-Fi, such as at a library or cafe. Generally, an unsecured network means your online activity is public. If you need to use an unsecured network, change your password once you’re on a secure network.  It can also be a good idea to look into a smart VPN like McAfee Secure VPN, which automatically turns on to protect your personal data and credit card information even if you need to use public Wi-Fi.   
4. You discover malware: Your personal information could be at risk if malware infects your computer. If you have high-quality antivirus software (like what’s included in McAfee+) and it detects malware, you’ll want to change your passwords from another device.   
5. You remove people from the account: If you no longer have contact with someone, there’s no need for them to remain on your Netflix or Amazon account. There’s also no need for an ex to share a bank account or have mobile app access. Create new passwords when you’re no longer sharing an account with someone.  
6. You no longer use certain accounts: You may have an account you haven’t used in a year, such as from an online retailer. Change old passwords for seldom-used accounts and close the account if you don’t intend to use it again. 

How to create a strong password 

A good password can make it more difficult for hackers to access your accounts. But what exactly makes a strong password? Here are a few criteria. 

• It’s used only for one account. While it can be easy to use similar passwords for multiple accounts, hackers might be able to get into your other online accounts if they access just one.   

• It’s at least 12 characters long. To make it easy to remember, use a lyric from a song or poem (for example, “andtherocketsredglare”). Or make an abbreviation from the words in a sentence (changing “the quick brown fox jumped over the lazy dog in the backyard” to “tqbfjotlditb,” for instance).   

• It’s a complex password. Include at least one capital letter, one number, and one symbol. A computer can guess a password with eight letters immediately. But a 12-character password with at least one uppercase and one lowercase letter, number, and a special character would take 34,000 years to crack. Some sites allow users to create a passphrase. That’s a string of words that can be up to 100 characters long.  

• It’s hard to guess. Don’t use information that people who know you or look at your social media can guess. Avoid personal information like your nickname or initials, birthday, address or street name, or a child or pet’s name.  

• It doesn’t use common words like “password” or “qwerty.” You’d be surprised how many people use “password123” or “123456” as a password. A cybercriminal would not.  

What are the most common ways passwords get hacked?

A cybercriminal may use a variety of strategies to access your passwords. Here are some of their most common tactics.  

• Guesswork: This is why password security requires unique passwords that don’t include personal information.  

• Buying passwords on the dark web: Search engines don’t index the dark web. A lot of dark web activity isn’t traceable, including the sale of passwords.   

• Phishing: This is when a hacker sends an email that appears to be from a trusted source to trick the recipient into typing in their password.  

• Malware: Cybercriminals may infect a device with malicious software that allows them to access personal data, including passwords.  

• Shoulder surfing: This could happen in a coffee shop or office if you leave sticky notes showing your passwords on your desk or laptop. 

• Spidering: These are bots that search the web looking for personal data.  

• Brute force attack: A bot systematically tries thousands of passwords hoping to find the correct one.  

How can you keep your online passwords secure? 

When it comes to keeping your data secure, password complexity is just the beginning. Here are a few key steps for keeping your passwords safe.  

1. Do a password audit: Review the passwords for all of your accounts. Make sure you’re not using any for multiple websites. See if your passwords are guessable. Do they include personal information like birthdays or addresses? If you find passwords that are weak or repeated, change those first.  
2. Use multi-factor authentication: Set up multi-factor authentication for important accounts, such as with financial institutions. Logging into a website with two-factor authentication requires you to enter a code sent by text or email in addition to a username and password. Some accounts require multi-factor authentication with biometric factors for added security, such as a thumbprint or face scan. Using multi-factor authentication with long, complicated passwords can make an account more secure.  
3. Use a password manager: A password manager can help prevent unauthorized access to your online accounts by protecting your passwords with strong encryption. It also comes with a password generator to help you create complex passwords while storing them safely.  
4. Add an extra layer of security: McAfee+ can help you defend your personal data. If you are hacked or the victim of a data breach, McAfee+ can help with 24/7 identity monitoring and alerts, plus up to $2 million in identity theft coverage, for greater peace of mind. AI-powered security on unlimited devices also provides real-time protection against viruses, hackers, and risky links. 

With McAfee, you can continue enjoying the internet the way it was intended — free from hackers.