Your Password Is a House of Cards: Build It With 3 Random Words

Here's a number that should make you sit up: Microsoft reports that enabling MFA can block over 99.9 percent of account compromise attacks (Microsoft Security Blog). But here's the catch: MFA only works if you actually turn it on, and the password it protects still matters. If your password is weak or reused, you're still one credential-stuffing attack away from disaster. The truth is, most people are terrible at passwords, and it's not their fault. We've been taught to create complex, hard-to-remember strings of characters that we then reuse across every site. That's a house of cards, and it collapses the moment one site gets breached.

This guide is for anyone who's ever stared at a "password must contain at least one uppercase letter, one number, and one symbol" prompt and felt their soul leave their body. It's for the person who has 200 accounts and uses the same password for all of them because they can't remember 200 different ones. I'm going to give you a blunt, practical system for fixing your password security once and for all. No jargon, no fluff, just steps you can take today.

Who This Is For (and What's at Stake)

If you're reading this, you probably have at least one email account, a bank account, and a social media profile. That's enough to make you a target. The FBI's IC3 received 859,532 complaints in 2024 with reported losses of about $16.6 billion, a 33% increase over 2023 (FBI IC3). That's not just corporations getting hit; individuals are losing money every day. And here's the kicker: Verizon's 2024 Data Breach Investigations Report found that more than two-thirds (68%) of data breaches involve a non-malicious human element, including people falling for phishing (Verizon 2024 DBIR). In other words, most breaches start with a human mistake, not a sophisticated hack.

So, who is this for? It's for you, the person who thinks "it won't happen to me." It's for the small business owner who thinks they're too small to be a target. CISA says no business is too small to be a target (CISA Secure Your Business). And it's for anyone who's ever used "password123" or their pet's name. Stop it. Right now.

Step 1: Ditch the Complexity Myth

First, unlearn everything you've been told about passwords. The old advice was to use a mix of uppercase, lowercase, numbers, and symbols, and to change it every 90 days. That's garbage. NIST SP 800-63B, the federal guideline, explicitly forbids forced complexity rules and mandatory periodic password changes (NIST). Why? Because they drive people to choose predictable patterns like "Password1!" and then reuse them. Instead, NIST recommends passwords of at least 15 characters when used as the only authentication factor, and it allows up to 64 characters, including spaces and Unicode (NIST). The key is length, not complexity.

The UK's NCSC agrees. They recommend building passwords from three random, unrelated words, like "applenemobiro" (NCSC). Three random words are long enough to be strong, yet easy to remember. And you don't have to worry about symbols. In fact, letter-to-symbol swaps like changing 'o' to '0' add little strength (NCSC). So stop with the "P@ssw0rd!" nonsense. Start thinking in phrases.

Step 2: Use a Password Manager, Not Your Memory

Here's the blunt truth: you cannot remember a unique, strong password for every account. So don't try. Use a password manager. CISA recommends using a password manager to generate and store unique, random passwords for every account, eliminating password reuse (CISA Secure Our World). A password manager is a secure vault that stores all your credentials, so you only need to remember one master password. It can also generate random passwords for you, so you don't have to think of them.

“But what if my password manager gets hacked?” I hear you ask. That's a legitimate concern, but the alternative is worse. Password reuse is what enables credential-stuffing attacks, where attackers take a password leaked from one site and try it on your bank account (Microsoft). A password manager at least ensures that if one site gets breached, your other accounts are safe.

If you're not ready for a password manager, the NCSC says writing a password down is acceptable if you keep it somewhere safe (NCSC). That's better than reusing the same password or using something guessable. But honestly, a password manager is the way to go. I recommend starting with a reputable one like Bitwarden, 1Password, or KeePass. Do your research, but don't overthink it.

Step 3: Create Your Master Passphrase

Your master password is the key to your entire digital life. It should be long, unique, and memorable. Here's how to create it: pick three or four random, unrelated words. CISA recommends passphrases made of 4-7 unrelated words (CISA Use Strong Passwords). For example: "blue" + "truck" + "sunset" + "guitar" = "bluetrucksunsetguitar". That's 22 characters, easy to remember, and practically uncrackable. Avoid using information that's publicly available, like your birthday, sports teams, or pet names (NCSC). Those are the first things an attacker will try.

Now, here's the critical part: do not use this passphrase anywhere else. It's your master password. It unlocks your password manager, which holds all your other passwords. If you use it for your email too, you've defeated the purpose.

Step 4: Enable MFA Everywhere, Prefer Phishing-Resistant

Now that you have a strong password strategy, it's time to add a second layer. Enable MFA on every account that supports it. Microsoft's statistic is the most compelling reason: MFA can block over 99.9 percent of account compromise attacks (Microsoft). That's not a typo. It's a game-changer.

But not all MFA is created equal. CISA ranks phishing-resistant MFA, such as hardware security keys (FIDO2) or passkeys, as the gold standard (CISA Implementing Phishing-Resistant MFA). SMS codes can be vulnerable to SIM swapping, and app-based codes can be phished. So when you have the option, choose a security key or passkey. If that's not available, use an authenticator app that generates a one-time code, or a push notification with number matching. Avoid SMS as a last resort.

Step 5: Check for Breaches and Rotate Compromised Passwords

Even with a strong password and MFA, your credentials might already be out there. That's why you need to check. Have I Been Pwned is a free service that lets you enter your email address and see if it's appeared in a known data breach (Have I Been Pwned). If it has, you need to change that password immediately, especially if you reused it anywhere. CISA recommends checking for breached credentials using tools like this and rotating any compromised passwords (CISA).

Here's a quick tip: when you check, don't just check your email. Also check any usernames you use. And if you find a breach, don't panic. Just change the password for that account, and if you reused it elsewhere, change those too. This is a good habit to get into: check your email monthly.

What Can Go Wrong: The Credential-Stuffing Cascade

Let me paint a worst-case scenario. You use the same password for your email, your bank, and your favorite online store. That store gets breached, and your email and password are leaked. An attacker scrapes that data and runs it against your bank account. Within hours, they've drained your savings. This is called credential stuffing, and it's a major attack vector. Microsoft notes that password reuse enables credential-stuffing attacks, where common or previously breached passwords are tried against corporate accounts (Microsoft). But it's not just corporate accounts; it's your personal accounts too.

That's why the password manager and unique passwords are non-negotiable. If you use a unique password for each account, a breach at one site is contained. The damage is limited to that one site, and you can change that password quickly.

What I'd Actually Do

If you take nothing else from this article, here's my concrete recommendation: get a password manager today. Set up a master passphrase of three or four random words (at least 16 characters, as CISA suggests). Then, go through your most important accounts—email, banking, social media—and change each one to a unique, randomly generated password from your password manager. Enable MFA on every account that supports it, preferring security keys or authenticator apps over SMS. Finally, set a reminder to check Have I Been Pwned once a month. That's it. That's the whole system. It's not glamorous, but it will protect you from 99.9% of attacks.

Remember, the threat is real. The FBI received over 859,000 complaints in 2024 (FBI IC3). Don't be a statistic. Start today.

Sources

• CISA (Secure Our World) - https://www.cisa.gov/secure-our-world
• NIST SP 800-63B - https://pages.nist.gov/800-63-4/sp800-63b.html
• NCSC (Three Random Words) - https://www.ncsc.gov.uk/collection/top-tips-for-staying-secure-online/three-random-words
• FBI IC3 (2024 Internet Crime Report) - https://www.ic3.gov/Media/PDF/AnnualReport/2024_IC3Report.pdf
• Microsoft Security Blog (MFA) - https://www.microsoft.com/en-us/security/blog/2019/08/20/one-simple-action-you-can-take-to-prevent-99-9-percent-of-account-attacks/
• Have I Been Pwned - https://haveibeenpwned.com/About