← Back to blog

Guides

10 password habits to adopt this weekend

Published 23 July 2026 · 6 min read · by the Celestial Team

You don't need to overhaul your entire digital life to be dramatically safer. These ten habits take an afternoon and close the doors attackers use most often.

1. Use a unique password for every account

Reuse is the single biggest risk. When one site is breached, attackers try those credentials everywhere else — a technique called credential stuffing. A password manager makes uniqueness effortless.

2. Make them long, not clever

Length beats complexity. A 20-character random password is astronomically harder to crack than "P@ssw0rd!". Let a generator do the work — try ours on the Features page.

3. Turn on two-factor authentication everywhere

2FA stops most account takeovers even if your password leaks. Prefer app-based codes or hardware keys over SMS, which can be intercepted.

4. Adopt passkeys where you can

Passkeys are phishing-resistant and can't be reused across sites. More services support them every month. See our passkeys explainer.

5. Audit your reused and weak passwords

Celestial Watchtower scores every credential and flags duplicates, weak entries and known breaches. Fixing the red items first gives you the biggest security gain per minute.

6. Change default passwords on devices

Routers, cameras and smart-home gear often ship with well-known defaults. Change them immediately — botnets scan for these around the clock.

7. Beware of look-alike login pages

Always check the domain before you type. A password manager helps here too: if it doesn't offer to autofill, the site may not be the one you think it is.

8. Keep recovery options current

Outdated recovery emails and phone numbers are a common way accounts get lost — or hijacked. Review them once a year.

9. Store secrets, not just passwords

Recovery codes, software licences, Wi-Fi passwords and passport scans all belong in an encrypted vault — not a notes app or an email to yourself.

10. Plan for the worst

Set up a recovery key and emergency access so a lost password or an emergency never means losing everything. It takes five minutes and buys enormous peace of mind.