Passwords, Password Managers and MFA | Free Cybersecurity Course: Protect Your Data, Devices and Business

What you'll learn

How passwords actually get stolen, and why reusing them is the biggest risk of all.
What current NIST and CISA guidance says about password length, complexity and forced changes.
How to calculate password strength (entropy) and compare passphrases with random passwords.
How password managers work and how to set one up safely.
Which MFA methods resist phishing, including passkeys and security keys, and which are a last resort.

📥 Practice this lesson

The "Accounts and passwords" section of the checklist walks you through password manager setup, unique passwords and MFA on your critical accounts.

cybersecurity-checklist.xlsx · Personal Checklist sheet

A strong password is long, random and used for exactly one account, and the only practical way to have dozens of those is a password manager. Add multifactor authentication (MFA) on top and a stolen password stops being enough to break into your accounts. That's the whole lesson in two sentences. The rest explains why the old rules (eight characters, a symbol, change it every 90 days) were replaced, how to measure strength with a simple formula, and which MFA methods hold up against phishing.

15+characters: NIST's minimum for passwords used as the only login factor (SP 800-63B-4)

16+random characters per password, plus a password manager, is CISA's advice to the public

0forced password changes on a schedule: NIST says change only when there's evidence of compromise

Understand how passwords leak
Apply current guidance
Measure strength
Adopt a password manager
Turn on strong MFA

How passwords get stolen

Very few passwords are "hacked" by a genius guessing them one by one. They're stolen in bulk:

Data breaches: a website you used gets breached and its password database leaks. If passwords were stored poorly, criminals can recover many of them offline.
Credential stuffing: leaked email and password pairs are tried automatically on banks, email providers and shopping sites. Reuse turns one breach into many.
Phishing: you type the password into a fake login page (lesson 3).
Infostealer malware: it grabs passwords saved in the browser and active login sessions.
Guessing common choices: "Password1!", "Summer2026", a pet's name plus a birth year. Attackers try these first.

Notice the pattern: complexity rules don't help against most of these. "Tr0ub4dor&3" is just as stolen in a breach or a phishing page as "password." What helps is uniqueness (one breach can't spread), length and randomness (offline cracking takes too long) and MFA (the password alone isn't enough).

What current guidance says

NIST's Digital Identity Guidelines (SP 800-63B-4, published in 2025) are the U.S. reference for how organizations should handle passwords. The key points:

Old habit	Current NIST guidance	Why it changed
8-character minimum	At least 15 characters when the password is the only factor; at least 8 when it's used with MFA	Length is the biggest driver of strength
Must include uppercase, number and symbol	No composition rules may be imposed	Rules produced predictable patterns like "Password1!"
Change every 60–90 days	No periodic changes; change only if there's evidence of compromise	Forced changes led to tiny edits ("Password2!")
Block paste in password fields	Allow password managers, autofill and paste	Managers make long unique passwords practical
Short maximum length	Allow at least 64 characters	Long passphrases must fit
Anything goes if it meets the rules	Check new passwords against lists of common and breached passwords	Blocks the choices attackers try first

CISA's public advice (from its "Secure Our World" campaign) lines up: use at least 16 characters, make each password random and unique, and let a password manager create, store and fill them for you.

1. Your company still forces everyone to change passwords every 90 days. According to NIST SP 800-63B-4, when should a password be changed?

When there is evidence it may have been compromised
Every 30 days for administrators and every 90 days for everyone else
Never, under any circumstances

NIST says verifiers shall not require periodic changes, but must force a change when there's evidence of compromise (for example, the password shows up in a breach or someone typed it into a phishing page).

Measuring strength: password entropy

For a password that is randomly generated, strength can be measured in bits of entropy. Each bit doubles the number of possibilities an attacker must try:

Entropy (bits) = L × log2(N)
L = number of characters (or words)
N = size of the pool each one is randomly picked from

Some pool sizes you'll use: 26 lowercase letters (log2 = 4.70), 94 printable keyboard characters (6.55), and the 7,776-word list used for "diceware" passphrases, where you roll dice to pick words (12.92 per word). Examples:

8 random keyboard characters: 8 × 6.55 = 52.4 bits
6 random diceware words:      6 × 12.92 = 77.5 bits

To make bits feel real, imagine a criminal who stole a weakly protected password database and can test 10 billion guesses per second offline. On average they find a password after searching half the possibilities. These times are illustrative: real speeds depend heavily on how the site stored the passwords.

Randomly generated password	Entropy	Average time at 10 billion guesses/sec
4 diceware words	51.7 bits	About 2 days
8 keyboard characters	52.4 bits	About 3.5 days
12 lowercase letters	56.4 bits	About 55 days
5 diceware words	64.6 bits	About 45 years
6 diceware words	77.5 bits	About 350,000 years
16 keyboard characters	104.9 bits	Trillions of years

Entropy in bits (bar length proportional, 105 bits = full bar)

4 words51.7

8 characters52.4

12 lowercase56.4

5 words64.6

6 words77.5

16 characters104.9

The formula only works for random passwords

"Summer2026!" has 11 characters, but it isn't random: it follows a pattern attackers try early (season + year + symbol). Human-chosen passwords are far weaker than their length suggests. Let a password manager or dice do the choosing.

2. A password manager generates a password of 12 random lowercase letters. What is its entropy? (log2 of 26 ≈ 4.70)

31.2 bits
56.4 bits
312 bits

12 × 4.70 = 56.4 bits. That's better than 8 mixed characters (52.4 bits), which shows why length beats complexity. Raising it to 16 lowercase letters gives 75.2 bits.

Password managers: the habit that makes everything else possible

Nobody can memorize 80 unique, 16-character random passwords. A password manager is an encrypted vault that does it for you. You remember one strong master password (a long passphrase works well here); the manager generates, stores and fills everything else.

Generates

Creates a long random password for every new account in one click.

Setting to use: 16–20 characters, or 5–6 words if you ever have to type it.

Fills only on the real site

Autofill matches the website's actual domain, so it won't fill your bank password on a look-alike page.

Bonus: if autofill doesn't work where it normally would, treat it as a phishing warning.

Alerts you

Many managers flag reused, weak or breached passwords in a security report.

Use it: fix the flagged accounts, starting with the most important ones.

To set one up safely: choose a reputable manager (many are free or cost a few dollars a month, and families and small teams can share vaults securely), create a long master passphrase you've never used anywhere, turn on MFA for the manager itself and store the emergency recovery kit somewhere safe offline. Then migrate in priority order rather than all at once.

Which accounts come first? Email first, because it can reset everything else. Then banking and payment apps, your phone carrier account (to prevent SIM swaps), cloud storage, the password manager itself, work accounts and social media. Everything else can be updated the next time you log in.

Multifactor authentication: not all methods are equal

MFA asks for two or more different kinds of proof: something you know (a password or PIN), something you have (a phone or security key) and something you are (fingerprint or face). The FTC's Safeguards Rule, for example, requires MFA for anyone accessing customer information at covered financial businesses such as tax preparers. But MFA methods differ a lot in how well they resist phishing:

Passkeys and security keysFIDO2 / WebAuthn

Phishing resistance: ●●●●
Ease of use: ●●●●
Best for: Email, admin accounts, finance: anything critical.

Strongest

App push with number matchingType the number shown on screen

Phishing resistance: ●●●●
Ease of use: ●●●●
Best for: Work accounts where passkeys aren't available yet.

Good

Authenticator app codes6-digit codes that change every 30 seconds

Phishing resistance: ●●●●
Ease of use: ●●●●
Best for: Most personal accounts that don't offer passkeys.

Solid default

SMS or voice codesCode sent to your phone number

Phishing resistance: ●●●●
Ease of use: ●●●●
Best for: Only when nothing else is offered: still far better than no MFA.

Last resort

Why the difference? A code (SMS or app) can be typed into a fake site and relayed to the real one in real time, and SMS can be hijacked by a SIM swap. CISA calls SMS and voice MFA a last resort and recommends phishing-resistant MFA (FIDO/WebAuthn or PKI smart cards) wherever possible. If your organization uses push notifications, CISA recommends turning on number matching to stop "MFA fatigue," where attackers send prompt after prompt until someone taps Approve just to make it stop.

Passkeys deserve special mention. A passkey replaces the password with a cryptographic key stored on your device or in your password manager, unlocked with your fingerprint, face or PIN. It only works on the real website it was created for, so there's nothing to type into a fake page. If a service offers passkeys, turn them on.

Save your recovery codes

When you turn on MFA, most services give you one-time recovery codes. Store them in your password manager or print them and keep them with important papers. Losing your phone shouldn't lock you out of your own life.

3. Which MFA method best protects you if you accidentally enter your password on a convincing fake login page?

A code sent by text message
A 6-digit code from an authenticator app
A passkey or a FIDO2 security key

Passkeys and security keys check the website's real domain, so they won't authenticate to a look-alike site. Codes can be typed into the fake page and relayed to the real one.

Case: one Columbus teacher, three weeks

Marcus, high school teacher, 41Columbus, Ohio · 63 online accounts, 11 of them critical (a fictional example)

Marcus used three variations of one password everywhere. After a breach alert from a shopping site, he installed a password manager, fixed his 11 critical accounts in one evening and updated the rest whenever he logged in. Three weeks later, every account had a unique password.

Before

Unique passwords19 of 63

MFA on critical accounts2 of 11

After 3 weeks

Unique passwords63 of 63

MFA on critical accounts11 of 11

From 30% to 100% unique passwords, and MFA (passkeys on 4 accounts) on every critical account.

Common mistakes

Reusing one "really strong" password everywhere.

Strength doesn't matter if one breach exposes it. Every account gets its own.

Saving passwords in a spreadsheet or the notes app.

Use a password manager: it's encrypted and fills only on the real site.

Approving an MFA prompt you didn't start.

Deny it and change your password: someone already has it.

Skipping MFA on email because it's "annoying."

Email resets everything else. It deserves your strongest MFA.

4. You receive three MFA push notifications at 2 a.m. that you didn't trigger. What does it mean and what should you do?

Someone likely has your password: deny the prompts, change the password and report it if it's a work account
It's a glitch; approve one so they stop
Turn off MFA so it stops bothering you

Prompts only appear after the correct password is entered. This is "MFA fatigue": the attacker hopes you'll approve. Deny, change the password from a trusted device and report it.

Practice exercise

Jada, a nurse in Atlanta, is choosing a master password for her new password manager. Her options: (a) "Atlanta#2026Nurse" (her own idea), (b) 10 random characters from all 94 keyboard characters, (c) 6 diceware words chosen with real dice. Calculate the entropy of (b) and (c), explain why (a) can't be calculated the same way, and recommend one. Then list, in order, the first five accounts she should secure.

See solution

(b) 10 × 6.55 = 65.5 bits.
(c) 6 × 12.92 = 77.5 bits.
(a) isn't random: it's a city, a year and a job, all guessable from her social media. Its real strength is far below what 17 characters suggest.

Recommendation: (c). It's the strongest of the three, and words are much easier to type and remember for the one password she must memorize. She should never use it anywhere else.

First five accounts: 1) the password manager itself (MFA on), 2) primary email, 3) bank and credit cards, 4) phone carrier account (add a carrier PIN to block SIM swaps), 5) work and hospital portal accounts. Passkeys wherever offered, an authenticator app otherwise.

Summary

Most passwords are stolen in breaches or by phishing; reuse is what turns one leak into many compromised accounts.
NIST now favors length (15+ characters as a single factor), no composition rules and no forced periodic changes.
Entropy = L × log2(N) measures random passwords; human-made patterns are much weaker than they look.
A password manager makes unique, long passwords effortless and helps you spot fake sites.
Use passkeys or security keys where possible, app-based MFA otherwise, and SMS only as a last resort.

Next lesson: Wi-Fi and Home Network Security. You'll harden your router step by step, choose the right Wi-Fi encryption and put smart devices on their own network.