Good password habits are one of the most effective ways to protect yourself and your organisation. This article explains how to make a strong passphrase you can remember, and how a password manager takes care of the rest.
Why passphrases beat passwords
Long passwords are much harder to guess or crack than short, complicated ones. A passphrase is a password made of several words, which makes it long without being hard to remember.
For example, a phrase made of four or more random, unrelated words is far stronger than something like P@ssw0rd1!, and easier to type.
The Australian Cyber Security Centre recommends passphrases. Its guidance is at cyber.gov.au.
Creating a good passphrase
- Use four or more random words. Random is the key: avoid song lyrics, quotes or well-known phrases.
- Make it long. Four random words will usually come to well over 15 characters, and longer is better.
- Avoid personal details such as names, birthdays, pets or your football team.
- Add a number or symbol if a system requires it, but length matters most.
- Never reuse it. Your work passphrase should be used only for your work account.
Reusing a password is the biggest risk. When one website is breached, attackers try the same email and password on Microsoft 365 and other services. A unique password for every account stops that.
Why use a password manager
Nobody can remember a unique password for every website. A password manager is an app that stores them securely for you, so you only need to remember one strong passphrase to unlock it.
A good password manager will:
- Generate long, random passwords for new accounts.
- Fill in your sign-in details on the right website, which also helps protect you from fake sign-in pages.
- Sync across your computer and phone.
- Warn you about reused or breached passwords.
If your organisation provides a password manager, use that one for work accounts. Ask your manager or log a ticket if you're not sure. Avoid saving work passwords in a personal password manager or in a document, spreadsheet or note.
Protecting your password manager
- Use a strong, unique passphrase as your master password, and never share it.
- Turn on multi-factor authentication for it.
- If you forget the master password, you may lose access to everything stored in it, so keep it memorable.
Your Microsoft 365 account is protected by MFA as well as your password. See set up Microsoft Authenticator.
Still stuck?
If you think a password has been exposed, change it straight away and call 1300 079 636 if it's your work account.