Password Security Checklist

🔑 Personal Password Practices

Password Creation & Strength

• Use passwords with 15+ characters for accounts without multi-factor authentication Critical
  NIST SP 800-63-4 requires a minimum of 15 characters for single-factor authentication. For accounts with MFA enabled, the minimum is 8 characters, but longer is always better for security.
• Use unique passwords for every account Critical
  Never reuse passwords. A breach on one site shouldn't compromise all your accounts.
• Use randomly generated passwords or passphrases High
  Human-created passwords are predictable. Use a password generator for truly random credentials.
• Avoid personal information in passwords High
  Don't use names, birthdays, addresses, or other easily discoverable personal details.
• Avoid common words and patterns Medium
  Dictionary words and keyboard patterns (qwerty, 123456) are easily cracked by automated tools.

Password Management

• Use a reputable password manager Critical
  Password managers securely store unique passwords for all accounts, eliminating the need to remember hundreds of credentials.
• Enable encryption in your password manager Critical
  Ensure your password vault uses strong encryption (AES-256) and a strong master password.
• Never write passwords on paper or in plain text files High
  Physical and digital plain-text records are security vulnerabilities. Use encrypted storage only.
• Never share passwords via email, text, or messaging apps High
  These channels are not secure. Use password manager sharing features if you must share credentials.
• Create a strong master password for your password manager Critical
  Your master password should be a long, memorable passphrase that you'll never forget. Learn how to create strong passwords.

🛡️ Account Security & Authentication

Multi-Factor Authentication (MFA)

• Enable multi-factor authentication on all accounts that support it Critical
  MFA adds a critical second layer of security beyond passwords. Prioritize email, banking, and social media accounts.
• Use authenticator apps instead of SMS when possible High
  Apps like Google Authenticator or Authy are more secure than SMS codes. SMS is vulnerable to SIM swapping, phishing, and interception attacks. In December 2024, the FBI and CISA advised against using SMS for MFA due to security risks.
• Consider hardware security keys for critical accounts Medium
  Physical keys (YubiKey, Titan) provide the highest level of MFA security, especially for high-value accounts.
• Save MFA backup codes in a secure location High
  Store backup codes in your password manager or encrypted storage to avoid account lockout.

Account Monitoring & Maintenance

• Regularly review account activity and login history High
  Check for unfamiliar logins, devices, or locations. Most services show recent activity in security settings.
• Delete or deactivate unused accounts Medium
  Old accounts you no longer use are security liabilities. Close them to reduce your attack surface.
• Change passwords immediately if you suspect compromise Critical
  If you receive breach notifications or notice suspicious activity, change passwords and enable MFA immediately.
• Sign up for data breach notification services Medium
  Services like Have I Been Pwned alert you when your credentials appear in data breaches.

💼 Organizational Password Policies

Policy Development

• Establish a written password security policy aligned with NIST SP 800-63-4 Critical
  Document minimum requirements: 15-character minimum for single-factor authentication (8-character minimum with MFA), MFA requirements, password manager usage, and breach response procedures.
• Mandate password manager use for all employees Critical
  Provide and require enterprise password managers. This ensures strong, unique passwords without memory burden.
• Require MFA for all business systems Critical
  Enforce MFA on email, VPN, cloud services, admin accounts, and all business applications.
• Eliminate forced periodic password changes High
  NIST no longer recommends routine password rotation unless compromise is suspected. It leads to weaker passwords.
• Block commonly used and compromised passwords High
  Implement password blacklists that prevent users from choosing commonly breached or weak passwords.

Training & Enforcement

• Conduct regular password security training High
  Educate employees on password best practices, phishing awareness, and the importance of unique credentials. Review our password security guide.
• Test employees with simulated phishing attacks Medium
  Regular phishing simulations identify vulnerabilities and reinforce training.
• Monitor and enforce password policy compliance High
  Regularly audit password practices, MFA adoption rates, and policy violations.
• Establish incident response procedures for password breaches High
  Define clear steps for responding to compromised credentials: notification, password resets, investigation, and remediation.

🌐 Device & Network Security

• Keep all devices and software updated Critical
  Install security patches promptly. Outdated software contains vulnerabilities that attackers exploit.
• Install and maintain antivirus/anti-malware software High
  Malware can steal passwords through keyloggers and other techniques. Keep protection current.
• Avoid accessing sensitive accounts on public WiFi High
  Public networks can be monitored. Use VPN if you must access accounts on untrusted networks.
• Only enter passwords on HTTPS websites Critical
  Look for the lock icon in your browser. Never submit credentials over unencrypted HTTP connections.
• Lock devices with strong passwords/biometrics High
  Device access controls protect your password manager and stored credentials. Enable auto-lock after short idle periods.
• Enable full-disk encryption on all devices High
  Encryption protects data if devices are lost or stolen. Use BitLocker (Windows), FileVault (Mac), or native Android/iOS encryption.

⚠️ Advanced Security Practices

• Use separate email addresses for different account types Medium
  Consider using different emails for banking, social media, and shopping to compartmentalize potential breaches.
• Enable login notifications for critical accounts High
  Get alerts when someone signs into your email, banking, or cloud storage from new devices or locations.
• Review and revoke unnecessary third-party app access Medium
  Periodically audit apps with access to your Google, Facebook, and other accounts. Remove unused integrations.
• Test your password strength regularly Medium
  Use our password strength checker to verify your credentials are strong enough.
• Create a password recovery plan Medium
  Document how to recover access if you forget your master password. Store emergency access codes securely offline.