Passwords and authentication

Creating a password

When you log into an account, you may need to enter your user ID or email address first. Then your password. This acts like a digital lock – making sure only you can get in. Other people may know your email address. But your password should only be known by you. Typically, you will be asked to create a password as part of your online account setup. To keep your details safe, it needs to be strong.

How to create a strong password

So, how do you create a password that other people can't easily guess? Passwords that use whole words, like your pet's name or your favourite sports team are easy to guess. Especially if they use details that other people could find out. Try to think of something that has no link to you. Avoid common options like ‘password’ or ‘1234’, too. All these tips will help deter other people guessing your password themselves.

Cyber criminals also use ‘password cracking’ software. This can quickly test lots of passwords to find a match. So when you think of a strong password, you need to pick one that will slow or stop this from working, too.

All this to consider, and you'll also need to remember what the password is. So how do you do this? The National Cyber Security Centre (NCSC) recommend you start with three random words. Then join them together and mix in other characters.

The 'three-random word' way to create a strong password:

Changing your passwords

You can change your password at any time. Regularly changing them can help keep your accounts safe. If you think someone has guessed or used one of your passwords, you should change it straight away.

Storing your password

Here are some ideas for you to think about:

• If you need to write your passwords down, keep them in a safe place, away from all your devices.
• Your web browser may ask if you want to store your password with them. If no one else uses that device, this is a safe option. Only use this option if you don't share your device with others.
• Alternatively, you may want to use a password manager.

Password Managers

The NCSC also recommends using a password manager. These tools can create your passwords and store them safely. So, you just need to remember one strong password – the one for your password manager.

How a password manager works

Some password managers reduce the risks by using something called multi-factor authentication (MFA). This makes it easier for you and harder for others to access the tool.

We'll talk more about MFA in the next chapter.

Credential managers

When you use apps like Google’s Password Manager and Apple’s Passwords, you may see that they can store more than just passwords. For instance, they might store the username for the website you have a password for. This means they can auto-fill both username and password for you. You can use them to store Wi-Fi passwords and other login details, too.

We usually call these tools ‘password managers’, but because they can store other authentication information, they’re also known as credential managers.

What is authentication?

In the last chapter, we looked at passwords. This is one way to log into systems or devices. But there are other ways to do this. Maybe you use your fingerprint or your face. You might use a PIN, a pattern or a passcode. 

Websites and other software use authentication to check your identity. It's how you prove who you are, to gain access to devices, sites and apps. There are many different types, and sometimes we use more than one to give an extra layer of safety.

Passwords are a common type of authentication.

Let's look at some other types:

Multi-factor authentication (MFA)

Also known as 2-factor authentication or 2-step verification (2SV), this means using more than one security ‘factor’. For instance, you may set up your device to unlock from your face scan. But what if it's dark and your phone camera can't see your face clearly? You may need to use your passcode or pattern as an alternative way to unlock it. That's the second 'factor'.

Let's look at another example. You're shopping online and have reached the checkout page. You choose your payment method and give your card details. Then a screen pops up to say your bank wants to check it's really you. They may send you a text code or ask if you want to use the app to confirm. Either way, this is the second 'factor' – the extra layer of security.

Some of the authentication methods you've seen in this lesson are all about giving you this extra protection. Like text codes from your bank or authenticator apps. Others work on their own, but sometimes with other methods too. It's good to have backup options, especially if it saves you from creating and managing more passwords.

Where do we commonly see MFA?

There are benefits to using MFA, but it's good to know what to expect when you use it, too.

Passkeys

Imagine being able to access any of the websites, apps or systems you use, quickly and securely. Without passwords. That’s where passkeys come in.

Research by the FIDO Alliance (PDF, 1.5Mb) shows that using passkeys is:

What are passkeys?

More and more websites and apps are using passkeys as an alternative to passwords. Instead of using something you remember, it uses your device plus whatever you already use to unlock that device. So that might be your face, fingerprint, a PIN, pattern or passcode.

They’re created and safely stored on your device by the built-in credential manager – like Apple Passwords, Google Password Manager, Samsung Pass or Windows Hello.

Some credential managers also ‘sync’ the passkeys across all the devices you use for that account. That means the passkey is securely copied to all these devices.

How to use a passkey

Not all sites and apps let you use passkeys.

For those that do, here’s how to use them:

Once it’s set up, you can use the ‘sign in with passkey’ option whenever you use that website or app. Just confirm it’s you using your unlock method and you’re in.

Want to learn more?

Related learning links