Passwords, passkeys and 2FA explained without the jargon

Passwords, passkeys, 2FA: the terms get muddled, but the actions are simple. Here’s what each one means and exactly what to do this week.

Account security is one of those topics that’s genuinely important and genuinely confusing, mostly because of the jargon. Passwords, passkeys, two-factor this, authenticator that. The concepts are actually simple once you strip the terminology out. Here’s what each one means and, more usefully, what you should actually do this week.

Passwords: the old lock, still worth doing well

A password is the basic key to an account. The problems with passwords are well known: people pick weak ones, and they reuse the same one everywhere. That second habit is the dangerous one. When one website gets breached, and websites get breached all the time, criminals take the leaked passwords and try them on your email, your bank and everything else. If you’ve reused a password, one breach becomes many.

Two rules fix almost all of this. Every password should be long and unique. Length beats complexity; three or four random words strung together is both stronger and easier to remember than something like P@ssw0rd. And every account needs its own, so a leak in one place stays in that place.

Password managers: how you actually manage all that

Nobody can remember dozens of long, unique passwords, and you’re not meant to. A password manager does it for you. It’s a secure app that generates and stores a different strong password for every account, and fills them in when you need them. You remember one master password; it remembers the rest.

This is the single most useful change most people can make. It’s more secure and, once set up, actually more convenient than what you’re doing now. There are good free and low-cost options. This is the thing to sort first.

2FA: a second lock on the door

Two-factor authentication (2FA), sometimes called two-step verification, means logging in needs two things: your password and one more proof it’s really you. Usually that second thing is a code from an app on your phone, or a prompt you approve.

The point is simple but powerful. Even if someone steals your password, they still can’t get in without your phone. It stops the large majority of account break-ins. A quick note: codes sent by text message are better than nothing, but an authenticator app is more secure, because text messages can be intercepted. Turn 2FA on for your email first, because your email is the master key that can reset everything else.

Passkeys: where things are heading

Passkeys are the newer option, and they’re genuinely a step forward. Instead of a password, a passkey uses your phone or computer, unlocked by your fingerprint, face or PIN, to prove it’s you. There’s no password to steal, guess or leak, and there’s nothing to type into a fake login page, so passkeys shrug off most phishing.

More and more services now offer them, and they’re worth using where you can. You don’t have to switch everything over at once; just start turning them on as you notice the option, particularly on important accounts.

What to actually do this week

Forget the theory and do these, roughly in this order:

• Set up a password manager and let it start generating strong, unique passwords.
• Turn on 2FA for your email first, then banking, then anything with customer or payment data.
• Use an authenticator app rather than text-message codes where you can.
• Switch on passkeys wherever they’re offered, especially for important accounts.
• Change any password you know you’ve reused, starting with the important accounts.

That’s an afternoon’s work at most, and it puts you ahead of the vast majority of small businesses. It’s genuinely the best hour or two you can spend on security.

If you’d like a hand getting this set up across your team, or you’re not sure where to start, SeddCo can walk you through it in plain English. Give us a ring on 01746 325326.