How to Keep Passwords Safe: 6 Habits
TLDR: Here is how to keep passwords safe: lock down your email, use a different password for every account, make typed passwords long, turn on two step sign in, go to sites yourself and check for leaks twice a year. Start with email. It resets every other account.
How to keep passwords safe comes down to six habits on your iPhone. Password safety feels hard. Pew Research found that 69% of Americans feel overwhelmed by the number of passwords they keep track of.
How Passwords Actually Get Stolen, and the Habit That Stops Each
Protecting your passwords starts with knowing how thieves steal them. In Verizon’s 2025 breach report, stolen or misused logins were the way in for 22% of breaches, more than any other route.
The risk also affects personal accounts. Pew Research Center found that 34% of Americans faced card fraud, account takeover, or a similar attempt in the past year.
Here are six simple ways hackers get passwords and how to stop them.
| How it gets stolen | What that looks like | The habit that stops it |
| A leaked password reused elsewhere | An old site is hacked. Thieves try the password on your email. | Habit 2 |
| A fake login page | A text links to a copy of your bank site. | Habit 5 |
| A short password guessed | Software tries common passwords until one works. | Habit 3 |
| A note or spreadsheet someone reads | A stranger opens your notebook or file. | Habit 2 |
| A phone with no passcode | Someone picks up your phone and opens your email. | Habits 1 and 3 |
| A caller asking for your code | A fake bank agent asks you to read out a code. | Habit 5 |
How to Keep Passwords Safe: 6 Habits, in Order
Here is how to keep passwords safe on iPhone, one habit at a time. The best way to keep passwords safe is to follow them in this order. These steps also show how to keep your password safe in daily use. Email comes first.
1. Lock down your email first
Set a new password on your email account. Then turn on the two-step sign-in. Email resets every other account. A thief who gets in can reach the rest.
On iPhone: Open Settings. Tap your name. Tap Sign-In and Security. Tap Change Password. For Gmail or Outlook, change it on the account page in Safari.
2. Use a different password for every account
Give every account its own password. A leaked password then opens one door. Reuse turns one leak into many hacked accounts. You can create unique passwords in seconds.
On iPhone: Open Settings. Tap General. Tap AutoFill and Passwords. Turn on AutoFill Passwords and Passkeys. At sign-up, tap Use Strong Password.
3. Make the ones you type long
Some passwords you must type by hand. Your phone passcode and your Apple Account are two. Make them 15 characters or more. Use three or four random words. NIST now requires websites to ask for at least 15 characters when a password is the only lock.
On iPhone: Open Settings. Tap Face ID and Passcode. Tap Change Passcode. Tap Passcode Options. Choose Custom Alphanumeric Code.
4. Turn on two-step sign-in, and use a passkey where a site offers one
Two step sign in adds another check after your password. So, a thief cannot get into your account with just your password. Use an authenticator app when available.
You can also use a passkey instead of a password. Passkeys are designed to protect you from fake websites, as Apple explains.
In 2021, attackers got into Colonial Pipeline through an old account that did not have two-step sign-in, according to the CEO’s Senate testimony.
On iPhone: Open Settings. Tap your name. Tap Sign-In and Security. Tap Two Factor Authentication. When a site offers a passkey, tap Create Passkey.
5. Go to the site yourself instead of tapping a login link
Never sign in from a link in a text or an email. Open Safari and type the site name. Learn the signs of a phishing attempt. Never read a verification code out to a caller. Your bank does not need it. Hang up. Call the number on your card.
On iPhone: Press and hold a link in a message. Read the real address in the preview. Do not tap it.
6. Check for leaked passwords twice a year
Leaks happen without warning. Set a reminder for spring and autumn. Your iPhone checks your saved passwords for you. You can also check if your email has been in a breach. Change every password it flags.
On iPhone: Open the Passwords app. Tap Security. Tap a flagged account. Tap Change Password on Website. Apple lists the steps.
The Best Way to Keep Track of Passwords
Keeping track of passwords can feel stressful. Pew found that 45% of Americans worry about password security. A password manager stores them safely and remembers them for you.
| Option | Where your passwords live | Cost | Who it suits |
| Apple Passwords | On your Apple devices, synced with iCloud | Free | People who use Apple devices only |
| A cloud manager | On the company’s servers | Free and paid plans vary by app | People with devices from many makers |
| A manager that keeps the vault on your phone | Encrypted on your iPhone | RelyPass is free. Cloud backup and sync is an optional paid extra. | iPhone and iPad owners |
| A paper list in a locked place | In your home | Free | A short backup for one person |
RelyPass is the third option. It stores the vault on your iPhone and encrypts it. A pass phrase that only you know protects it. Face ID opens it. It works on iPhone and iPad only. There is no recovery if you lose the pass phrase. Write it down. Keep it somewhere safe.
Read More: Learn how to store passwords safely, explore password manager apps for iPhone, and compare password managers side by side.
Keeping a Family’s Passwords Safe, Including a Parent With a Notebook
Start with the family member who may need the most help. For many families, that may be a parent who still keeps passwords in a notebook. Take it slowly and never make them feel rushed.
Move important accounts, such as email and banking, first. You can deal with other accounts later. Keep the notebook in a safe place while they learn the new system. Set up Face ID to make sign in easier, and leave simple instructions near the phone.
Set one family rule: never share a security code over the phone, even with someone claiming to be from a bank.
Make yourself their recovery contact. If they lose their phone or forget their password, you can give them a code to get back into their Apple Account. You need an Apple device of your own for this. On their iPhone: Open Settings. Tap their name. Tap Sign-In and Security. Tap Recovery Contacts. Tap Add Recovery Contact.
Choose a tool your parent can use without help. Apple Passwords lets family members share passwords for free. Apple explains how.
Three Things You Can Stop Doing
You can stop changing passwords every 90 days. NIST tells websites not to require regular changes. Change a password only when there is a sign it has leaked. Read more on changing your password every 90 days.
You can stop forcing symbols into short passwords. NIST tells websites not to demand symbol mixes. Length does the work.
You can stop using formulas such as Sunshine!FB. Thieves know these patterns. One leak exposes every account that follows the formula.
Keep Passwords Safe: The Short Version
This is how to keep passwords safe in six lines. Copy them into your notes. These password security tips are also good password hygiene.
- Lock down your email with a new password and two step sign in.
- Use a different password for every account.
- Type long passwords of 15 characters or more.
- Turn on two step sign in and use passkeys.
- Go to the site yourself. Never read a code to a caller.
- Check for leaked passwords twice a year.
FAQ
How often should you change your passwords?
Change a password if it has been leaked or stolen. You do not need to change strong passwords regularly. NIST no longer recommends forced password changes because they can lead to weaker passwords.
Is it safe to write passwords down?
Yes, if you keep them in a safe place. Writing passwords down is better than using the same password everywhere. However, a password manager is a safer long term option.
How can I check if my passwords have been compromised?
On iPhone, open the Passwords app and check the Security section. You can also check your email on Have I Been Pwned. Change any password that has been leaked.
Are password managers safe to use?
Yes. Password managers encrypt your saved passwords. You only need to remember one main password. Make it long and keep a backup in a safe place.
Start with your email today and work down the list. RelyPass keeps your passwords encrypted on your own iPhone and is free to use there, and its family plan gives up to 5 people a private vault each.
