Recommendations for the public
While the news is often filled with exotic attacks against high-value individuals and organizations, the truth is that for most people the basics are still the basics and should be the foundation of any security advice to the everyday person or small business.
Focus your attention on the devices and applications you use to access essential services such as email, financial accounts, cloud storage, and identity-related apps. Enable automatic updates wherever possible so these core tools receive the latest security fixes. And when a device or app is no longer supported with security updates, it’s worth considering an upgrade.
Prioritize protecting sensitive accounts with real value to malicious actors such as email, file storage, social media, and financial systems. When possible, consider “passkeys”, a newer sign-in technology built into everyday devices that replaces passwords with encryption that resists phishing scams — so even if attackers steal a password, they can’t log in. Use SMS one-time codes as a last resort if other methods are not available.
Passphrases for your important accounts should be “strong.” A “strong” password or passphrase is long (16+ characters), unique (never reused under any circumstances), and randomly generated (which humans are notoriously bad at doing). Uniqueness is critical: using the same password in more than one place dramatically increases your risk, because a breach at one site can compromise others instantly. A passphrase, such as a short sentence of 4–5 words (spaces are fine), is an easy way to get sufficient length. Of course, doing this for many accounts is difficult, which leads us to…
A password manager solves this by generating strong passwords, storing them in an encrypted vault, and filling them in for you when you need them. A password manager will only enter your passwords on legitimate sites, giving you extra protection against phishing. Password managers can also store passkeys alongside passwords. For the password manager, use a strong passphrase since it protects all the others, and enable MFA.
From the open letter. It also has recommendations for organizations and for software manufacturers.
People often use confusing language when talking about password strength.
Mostly, yes—but it’s important to think about your personal threat model—what information you have that others might want, who might try to get it, and how they might try.
These are trusted, consumer-friendly resources that help average people and small organizations take practical steps to secure their accounts and devices.