Passphrases, password managers and 2FA
8 min readReviewed October 2026 · Internet Safety Australia Editorial Team
In short
- One strong, unique passphrase per account — a password manager remembers them for you.
- Turn on two-factor authentication (2FA) everywhere, starting with email and banking.
- Authenticator app or security key beats SMS codes.
Most account hacks don’t involve genius criminals — they involve passwords leaked in a data breach being tried on other sites. If you reuse passwords, one breach opens everything. The fix takes 15 minutes and you only do it once.
Why passphrases beat passwords
Length is strength. “correct horse battery staple” (four random words) is both stronger and easier to remember than “P@ssw0rd!”. The Australian Cyber Security Centre recommends passphrases of at least 14 characters — four or more random words — that are unique to each account and unpredictable. Don’t use song lyrics, quotes or your dog’s name; attackers try those first.
Set up a password manager in 15 minutes
Pick one
Your phone already has one built in (iCloud Passwords / Google Password Manager), and reputable standalone options exist too. Built-in is fine for most people — the best manager is the one you’ll actually use.
Create one master passphrase
This is the only passphrase you memorise: four or five random words. Write it on paper and store it somewhere safe at home while you learn it, then destroy the paper.
Let it generate passwords
From now on, when you create or change a password, let the manager generate a random one. You’ll never need to see or type most of them.
Upgrade your critical accounts first
Email, banking, myGov, and your main social account. Ten minutes. Everything else can be upgraded gradually as you log in.
Two-factor authentication: your second lock
2FA (also called multi-factor authentication, MFA) means a password alone can’t open the account — a second proof is needed. Turn it on for email, banking, government, social and shopping accounts.
| 2FA method | Strength | Notes |
|---|---|---|
| Passkey / security key | Strongest | Phishing-resistant; supported by myGov, Google, Apple, Microsoft and major banks |
| Authenticator app | Strong | Free apps generate codes on your phone; works offline |
| SMS code | Basic | Better than nothing, but SIM-swap attacks can intercept it |
Passkeys are the future — and they’re easier
A passkey lets you log in with your fingerprint or face instead of a password, and it can’t be phished or leaked in a breach. Where a site offers passkeys (myGov, Google, Apple, PayPal and more), take them. Save backup codes somewhere safe when you set up any 2FA.
For seniors and anyone helping a parent
- A written list of passwords in a notebook at home is far better than one weak password reused everywhere. It’s not perfect, but it’s honest harm reduction — keep it away from the computer and never photograph it.
- Set up 2FA together, and record backup codes on paper in a safe place.
- Agree on a family code word for “it’s really me” phone calls — it defeats voice-cloning scams.
Common questions
Where to report this
Report to ReportCyber
Cybercrime: identity theft, online fraud, hacked accounts or devices, ransomware and online threats.
Go to ReportCyber (leaves our site — official service)Official sources for this guide
Reviewed October 2026 by Internet Safety Australia Editorial Team. Internet Safety Australia is independent and not a government website.