Am I Doing the Right Thing With My Passwords? A Quick Security Checklist

Executive Summary

Most of us know we should have “good passwords”. The problem is that what counts as good password security has changed quite a bit over the last few years.

Long, complicated passwords are no longer the whole story. Passkeys, Multi-Factor Authentication (MFA), unique passwords and password managers can all make a much bigger difference.

So, how does your password security stack up? Run through these six questions, give yourself a tick for every “yes”, and check your score at the end.

Introduction

Are your passwords actually secure?

It sounds like a simple question, but the advice many of us grew up with is now out of date. Adding a number to the end of a familiar word, changing your password every few months or replacing an “o” with a zero does not suddenly make an account secure.

Modern password security is much more about making life difficult for criminals without making life difficult for you.

Here is your 60-second security check.

Passkeys are increasingly replacing traditional passwords, and that is a good thing.

Instead of typing a password that could be guessed, stolen or entered into a fake login page, a passkey lets you sign in securely using a trusted device. You might confirm the login with your fingerprint, face recognition or device PIN.

Crucially, passkeys are designed to protect against phishing because the passkey is linked to the genuine website or service. You cannot accidentally type it into a convincing fake login page.

The UK National Cyber Security Centre (NCSC) now recommends passkeys as a preferred option where they are available, while Microsoft, Apple and Google all support passkey technology across their platforms.

Tick this if: You use passkeys or another secure passwordless sign-in method when a service offers it.

The simple rule: If a trusted service gives you the option to use a passkey instead of a password, it is usually worth taking advantage of it.

Want to know more? Read our Plain English Guide to Passkeys with Microsoft 365 or our guide to going passwordless with FIDO2 and YubiKeys.

If an account still uses a password, Multi-Factor Authentication should be one of your priorities.

MFA asks you to prove your identity in another way after entering your password. This could be through an authentication app, security key or another approved method.

Why does that matter? Because if a criminal manages to steal your password, that password alone may no longer be enough to get into the account.

For businesses, start with the accounts that could cause the most damage if they were compromised. Your business email and Microsoft 365 or Google Workspace accounts should be right at the top of the list. Then think about banking, finance systems, online shopping, social media and other important services.

Tick this if: MFA is enabled on all your important accounts.

The simple rule: If an important account supports MFA, turn it on.

Not sure how it works? Read our Plain English Guide to Multi-Factor Authentication.

This is one of the most important questions on the list.

You could create an incredibly strong password, but if you use that same password for ten different websites, you have created a serious weakness.

If one of those websites suffers a security breach and your login details are exposed, criminals can try the same email address and password on other services.

That means a problem with one relatively unimportant account could potentially give someone access to your email, shopping accounts or business systems.

Tick this if: Every account has its own unique password.

The simple rule: Never reuse the same password across different websites or services.

Changing one character does not really count either. BlueCoffee27 and BlueCoffee28 are not meaningfully unique passwords.

Remember when password advice involved lots of capital letters, numbers and special characters?

Things have moved on.

For passwords you genuinely need to remember, the NCSC recommends using three random words. The idea is to create something long enough to be strong, while still being reasonably easy to remember.

For example:

Better: RiverCoffeeBanana

Avoid: Password123

Avoid: Summer2026

Avoid: CompanyName1

The important word here is random. Avoid your company name, children’s names, favourite football team, date of birth, pet’s name or anything else somebody might reasonably associate with you.

For accounts where you do not need to remember the password yourself, a password manager can generate something long and completely random for you.

Tick this if: Your passwords are long, unique and difficult to predict.

The simple rule: Think length and uniqueness, rather than trying to make a familiar password look clever by adding a few numbers and symbols.

How many online accounts do you have?

Probably more than you think.

Expecting anyone to remember dozens, or even hundreds, of completely unique passwords simply is not realistic. That is why password managers are so useful.

A password manager securely stores your login details, creates strong passwords for new accounts and fills them in when you need them. Modern password managers can also help businesses manage passkeys, MFA information and secure credential sharing.

Most importantly, they remove the temptation to reuse the same memorable password everywhere.

Tick this if: You use a trusted password manager to create and store your passwords.

The simple rule: If you are trying to remember all your passwords yourself, there is a good chance you are reusing at least some of them.

We recently covered this in more detail in Password Managers in 2026: Why We Still Recommend 1Password for Business.

Good password security is not only about preventing problems. It is also about reacting quickly when something does not look right.

Perhaps you have entered your login details into a suspicious website. Maybe you receive a security alert you were not expecting. Or perhaps a service you use tells you it has suffered a breach.

Do not wait until you know for certain that somebody has your password.

If you suspect a password has been exposed:

1. Change the password immediately.
2. If you have reused that password anywhere else, change it on those accounts too.
3. Enable MFA if it is not already switched on.
4. Check the account for unfamiliar logins, messages, purchases or other unusual activity.
5. For a business account, tell your IT provider or internal IT team as soon as possible.

Tick this if: You know what action to take if you suspect one of your passwords has been compromised.

The simple rule: If you think a password might have been exposed, treat it as compromised and act quickly.

How Did You Score?

✅ 5 to 6 ticks: Looking good

You are following most modern password security best practice. Keep using passkeys where possible and make sure new accounts follow the same approach.

⚠️ 3 to 4 ticks: There is room to improve

You are doing some important things right, but there are still gaps that could leave accounts exposed. Look at the questions you could not tick and tackle those first.

❌ 0 to 2 ticks: Time for a security tidy-up

Your accounts are probably more exposed than they need to be.

Do not try to fix everything at once. A good place to start is enabling MFA on your most important accounts and setting up a password manager. You can then work through any reused passwords and replace them with unique ones.

Final Thoughts

Good password security does not mean remembering a 25-character jumble of letters, numbers and symbols for every website you use.

In fact, modern security is increasingly about having fewer passwords to remember at all.

Use passkeys when you can. Protect important accounts with MFA. Never reuse passwords. Make memorable passwords long and unpredictable, and let a password manager handle everything else.

Those relatively simple habits can make a significant difference to both personal and business security.

Want to Improve Password Security Across Your Business?

Managing password security for yourself is one thing. Making sure an entire team is following good practice is much harder.

Get Support can help you review how your organisation signs in to Microsoft 365 and other business services, introduce MFA and passwordless authentication, deploy password managers such as 1Password, and identify weak or outdated security practices.

Whether you want to improve one part of your security setup or take a wider look at how your business protects its accounts and data, get in touch with Get Support and we can help you work out the sensible next steps.

Should I change my passwords regularly?

Not simply because a certain number of days have passed. The NCSC has advised against forcing routine password expiry because it can encourage people to make predictable changes or choose weaker passwords. You should change a password when you know or suspect it has been compromised, or when there is another genuine security reason to do so.

Are passkeys better than passwords?

In most situations where they are properly supported, yes. Passkeys are designed to be resistant to phishing and remove the need to remember or type a traditional password. The NCSC recommends choosing passkeys where they are available.

Do I still need MFA if I use a password manager?

Yes. A password manager solves the problem of creating and storing unique passwords. MFA provides another layer of protection for accounts that still rely on those passwords. They solve different problems and work well together.

What is the most important password to protect?

For most people, email should be near the top of the list because it is often used to reset passwords for other services. For a business, Microsoft 365 or Google Workspace accounts can also provide access to email, files and other important company information. Protect these accounts with the strongest sign-in options available.

Can Get Support help improve password security across our business?

Yes. We can review your current setup, help enable MFA, introduce passkeys and passwordless authentication where appropriate, deploy and configure a business password manager, and help your team understand how to use these tools properly.

Sources

This article is based on current guidance from the UK National Cyber Security Centre (NCSC) and current passkey information from Microsoft, Apple and Google, alongside Get Support’s existing guidance on MFA, passkeys and password management.