Good family password habits are few and simple. Use long, unique passwords or passphrases, keep them in a password manager, and turn on multifactor authentication, starting with email. CISA recommends at least 16 characters and a different password for every account.
What CISA recommends
CISA's guidance for individuals says to protect important accounts with passwords that are long, random and unique:
- Long: at least 16 characters.
- Random: a mix of letters, numbers and symbols, or a passphrase of four to seven unrelated words.
- Unique: one password per account, so one breach does not open the others.
- Stored in a manager: it generates, saves and fills passwords, and flags weak or reused ones. You remember one strong master password. CISA notes some managers are free, such as those built into browsers.
- Backed by MFA: especially for email, social media and financial accounts.
It also warns against birthdays, pet names and simple codes, which are easy to guess.
Why start with email
Email is the reset key for nearly everything else. If someone takes over a parent's inbox, they can reset the bank, the school portal and the child's gaming account. Secure that account first with a unique passphrase and MFA.
Adapting this for children
- Young children: the parent holds the passwords in the manager and logs in for them, or the family uses device unlock.
- Older children: let them make a passphrase of unrelated words that they can remember, and teach them never to reuse it. Pick a few words they will not find in a quote.
- Shared accounts: streaming and gaming logins are a common weak spot. Give each person their own where the service allows it.
- Default passwords: change them on routers and smart devices. See changing default passwords on smart devices.
Who should know the master password
Decide how a trusted adult could get in if you were unavailable. Many managers offer an emergency access feature, though availability varies, so check yours. Do not write the master password on a sticky note by the screen.
When something leaks
If a service reports a breach, change that password and any other account that shared it. The CISA page tells the story of a person who reused one password on her email and her bank, and lost access to both after a breach. See also do I need to rotate credentials after a breach.
Quick check
Is a passphrase better than a short complex password?
CISA recommends long passwords. A passphrase of four to seven unrelated words is one of the ways it describes to reach that length.
Is a browser's built-in password manager acceptable?
CISA notes that some password managers are free, such as those built into web browsers.
Sources
Last reviewed: 19 October 2026.
