Prefer long passphrases or random passwords stored in a reputable password manager. Unique passwords per site limit blast radius when one vendor leaks data.

Multi-factor authentication (MFA) remains essential even with strong passwords.