Why Your Password Manager Isn't Enough: The Privacy Tool Stack That Works

You've finally started using a password manager, and you feel good about it. But here's the question I hear from colleagues and clients every week: "I have a password manager and I use two-factor authentication — why do I still feel like I'm one click away from being hacked?"

The short answer: because a password manager alone is a strong lock on a weak door. The longer answer is what this article is about — the actual stack of privacy tools and habits that people who do this for a living rely on. Let's walk through it the way we'd walk a friend through it: step by step, with a realistic scenario.

Step One: Rethink the passwords themselves

Imagine you're a small business owner named Alex. You've got a password manager, you've generated unique passwords for every account, and you've enabled two-factor authentication on your email. Good start. But here's where most people stop — and it's a mistake.

Your password manager generates random strings like p&9xQ!2kLm$4, which are great. But those random strings are hard to type on a phone, and if you ever need to log in on a shared computer, you're stuck. More importantly, the federal government's own digital identity guidelines (NIST SP 800-63B) say that when a password is the only thing standing between an attacker and your account, it should be at least 15 characters long. But if you're using phishing-resistant MFA — which we'll get to in a second — you can get away with 8 characters. That's a clue: the real security isn't the password, it's the second factor.

So what do we recommend to Alex? Not longer random strings. Instead, we point to the UK's National Cyber Security Centre advice: pick three random, unrelated words — like apple, nemesis, biro — and combine them into a passphrase. It's long enough to resist cracking, and you can actually remember it, which means you're less likely to write it on a sticky note that ends up on your monitor. The NCSC is blunt about what not to use: birthdays, sports teams, pet names — all the stuff people can dig out of your social media. And swapping letters for symbols, like turning o into 0, adds almost nothing.

Our first concrete recommendation: in your password manager, generate a passphrase of four to seven unrelated words (CISA's own guidance suggests this range) for your most critical accounts — your primary email, your bank, your cloud storage. Those are the accounts that, if compromised, would let an attacker reset every other password you own.

Step Two: Turn on MFA — but make it phishing-resistant

Alex has already enabled two-factor authentication, so we're halfway there. But here's the uncomfortable truth that most people don't want to hear: not all MFA is created equal. The traditional SMS code — the one that pops up on your phone — is vulnerable to a trick called SIM swapping, where an attacker convinces your mobile carrier to port your number to a SIM card they control. That's a documented social engineering attack, not a hypothetical (CISA, Implementing Phishing-Resistant MFA).

And even app-based codes can be phished. A convincing fake login page can ask you for the six-digit code, and the attacker forwards it to the real site in real time. That's why CISA and the NSA have been pushing for years toward phishing-resistant MFA — meaning hardware security keys (FIDO2) or passkeys built into your phone or laptop. These use public-key cryptography, so there's no secret code to intercept. The website sends a challenge, your device signs it, and the attacker never sees a credential they can replay.

So here's our second recommendation, and it's the one I'd shout from the rooftops: if you haven't already, buy a hardware security key — a YubiKey or similar — and register it on your primary email, your password manager, and your cloud accounts. Microsoft's own research found that enabling MFA can block over 99.9% of account compromise attacks (Microsoft Security Blog, 2019), and that number holds up. But if you're still using SMS codes for your bank, that's a last resort, not a best practice. CISA's advice is clear: app-based one-time passwords or push notifications with number matching are better than SMS; phishing-resistant is the gold standard.

Step Three: Check for breaches — and act on what you find

Now Alex has strong passphrases and a hardware key. We're not done. The next step is to find out if your existing passwords have already been exposed in a breach. The free service Have I Been Pwned, run by Troy Hunt since 2013, lets you type in your email address and see a list of every known data breach that includes it. It was created after the Adobe breach, which was at the time the largest single breach of customer accounts, because the same accounts kept showing up in breach after breach — often with the same reused passwords.

We tell Alex: go to haveibeenpwned.com, check every email address you've ever used, and if any come back as pwned, change that password immediately — and not to a variant of the old one. Use your password manager to generate a fresh, unique passphrase. And if you find that you've reused a password across multiple sites, change all of them, because attackers will try those same credentials everywhere (Microsoft calls this credential stuffing).

The numbers here are sobering. In 2024, the FBI's Internet Crime Complaint Center (IC3) received 859,532 complaints with reported losses of $16.6 billion — up 33% from the year before. And the most-reported crime category was phishing and spoofing, with 193,407 complaints. So this isn't a theoretical exercise; it's the most common way people get compromised.

Step Four: Layer in the boring stuff that actually matters

Here's where we get to the part that most people skip because it's dull. A password manager and a security key are shiny tools. But the workhorses of your privacy stack are the unglamorous habits: updating software, backing up data, and not clicking links in urgent emails.

For Alex, that means turning on automatic updates for the operating system, the browser, and every app. CISA's guidance is blunt: install updates promptly, especially for web browsers and antivirus, and enable automatic updates so you don't have to remember. The reason is that attackers don't break in through your strong password; they break in through unpatched vulnerabilities. The NSA and CISA jointly published a list of the top ten most common network misconfigurations, and high on that list are poor patch management and default credentials. If you're still using the default admin password on your router or your smart home hub, you might as well leave the front door open.

And about that email that looks like it's from your bank with a link to "verify your account" — don't click it. The FBI's 2024 data shows that phishing is the entry point for a huge share of attacks, and Verizon's 2024 Data Breach Investigations Report found that 68% of breaches involve a human element, meaning someone fell for a phish or made a mistake. CISA's advice is simple: pause, hover over the link to see where it really goes, and if it's suspicious, contact the company directly using a number you look up yourself, not the one in the email.

One more layer that costs nothing: back up your data using the 3-2-1 rule — three copies, on two different media, one offsite. That's the single most effective defense against ransomware, which the FBI says is still the most pervasive threat to critical infrastructure. If you get hit, you can restore from backup instead of paying a ransom — and the FBI has helped victims avoid over $800 million in ransom payments since 2022 by providing decryption keys, but you don't want to rely on that.

The bottom line

So here's the stack we recommend to Alex, and to anyone who asks: a password manager storing long, random passphrases (at least 16 characters, ideally four to seven unrelated words); phishing-resistant MFA via a hardware key or passkey on every critical account; a regular check of Have I Been Pwned; automatic updates turned on everywhere; and a 3-2-1 backup. That's not a luxury setup — it's the minimum for someone who wants to sleep at night.

The single most important thing to remember: your password manager is a tool, not a strategy. The strategy is to assume the worst — that your password will be phished, that your phone number can be hijacked, that a vulnerability will be exploited. Build your defenses accordingly.

Sources

• CISA (Secure Our World) - https://www.cisa.gov/secure-our-world
• NIST SP 800-63B - https://pages.nist.gov/800-63-4/sp800-63b.html
• NCSC (Three Random Words) - https://www.ncsc.gov.uk/collection/top-tips-for-staying-secure-online/three-random-words
• Have I Been Pwned - https://haveibeenpwned.com/About
• Microsoft Security Blog - https://www.microsoft.com/en-us/security/blog/2019/08/20/one-simple-action-you-can-take-to-prevent-99-9-percent-of-account-attacks/
• FBI IC3 (2024 Internet Crime Report) - https://www.ic3.gov/Media/PDF/AnnualReport/2024_IC3Report.pdf