Free Tool
Password Security Checklist
Good password security is a dozen small habits, not one big decision. This checklist walks you through all twelve — unique passwords, a password manager, two-factor authentication, recovery codes, and the habits to drop — with your progress saved on your device so you can work through it over days, not in one sitting.
Local-only: your progress is saved in this browser, on this device. Nothing you tick is sent anywhere, and this page never asks for a password — real or test. Use the password strength checker on this site if you want to test a password.
What this tool does
Password advice is usually given as a list of rules, and lists are forgotten. What works better is a checklist you can work through, ticking each item as you do it, until the habits are in place. That is what this page is: twelve actions, in the order that matters, from the most important — giving every account its own password — to the habits most people forget — saving recovery codes, and writing down the master password somewhere safe.
The checklist is built around the current guidance from NIST, the US National Institute of Standards and Technology, whose password standard, SP 800-63B Revision 4, was finalised in July 2025. The standard requires a password used on its own to be at least 15 characters long, removes the old forced-complexity rules, and says services should not force periodic password changes. The checklist follows that guidance in plain English: length over complexity, uniqueness above all, and a password manager to make it practical.
Each item is a concrete action. Install a password manager. Change your email password first. Turn on two-factor authentication for your email and your bank. Change the passwords you reused. Write down your master password and your recovery codes and store them safely at home. The checklist saves your progress in your browser as you go, so you can do two items today and the rest next week, and it offers a printable version when you are done.
Try it
Work through the list in order. Your ticks are saved in this browser only — nothing is sent anywhere.
Progress: 0 of 12 done.
How it works
The order is the method. Email first, because access to your email lets an attacker reset almost everything else — it is the master key to your digital life, and it is where a unique password and two-factor authentication matter most. Banking second, for the same reason, and for the obvious one. Then the other important accounts, one by one, using the password manager to generate each password and fill it in for you. The work that looks impossible — changing dozens of passwords — becomes a series of small steps, each taking a minute.
Two-factor authentication is the second lock, and the checklist puts it next to the password it protects, because the two belong together. A password alone can be stolen in a breach or a phishing attempt; a password plus a second factor — a code from an app, or a security key — cannot be used by a thief who has only the password. The checklist asks for it on the vault first, because the vault holds all the other passwords, and then on email and banking, where the damage of a compromise is greatest.
The last items are the ones most people skip: writing the master password down on paper, saving recovery codes separately from the phone, and telling one trusted person where they are. Those are the habits that prevent the most common disaster in password security — not being hacked, but being locked out of your own accounts. A password manager is a single point of failure by design, and the paper backup is what makes that failure survivable.
Limitations
This checklist covers passwords. It does not cover phishing — a password manager will happily fill your password into a fake site if you navigate there — and it does not cover device security, backups, or the other habits on this site. A strong password is one habit among several, and a checklist that claims to make you safe on its own would be lying.
- The checklist never asks for a password. It asks you to change them, not to type them here. Use the password strength checker on this site if you want to test a password, and test one built like yours rather than your real one.
- Progress is saved in your browser's local storage, on this device only. It is not backed up, and it disappears if you clear your browser data.
- The checklist follows current NIST guidance (SP 800-63B Revision 4, July 2025) as summarised in the password guide on this site. If the guidance changes, the guide is where the update will appear first.
Examples
Example 1 — the afternoon plan. A realistic afternoon: install a password manager, turn on two-factor authentication for the vault, change your email password, turn on two-factor authentication for your email, and change your banking passwords. That is the first six items, and it is the part that matters most. The rest — the other accounts, the breach check, the paper backup — can follow over the next week.
Example 2 — the reused password. You have used one password on ten accounts for years. The checklist's answer is not to change all ten at once, which feels impossible, but to change one a day, starting with email, using the manager to generate each new one. In ten days the reuse is gone, and the habit of generating is in place.
Example 3 — the paper backup. Your phone is lost, and with it your authenticator app. Without recovery codes, you are locked out of your email. With them — saved on paper at home, separate from the phone — you are back in within an hour. That is the item most people skip, and the one that matters when things go wrong.
Frequently asked questions
How long should a password be in 2026?
Current NIST guidance (SP 800-63B Revision 4, July 2025) requires at least 15 characters for a password used on its own, and allows as few as 8 when the password is only one factor of multi-factor sign-in. Services must accept at least 64 characters.
Should I change my password every 90 days?
No. Current guidance says services should not require periodic changes. Change a password when there is a reason: a breach, a phishing attempt, a shared account, or evidence it was compromised.
What is the most important password habit?
Uniqueness. Give every account its own password, starting with your email — because access to your email lets an attacker reset almost everything else. A password manager makes this practical.
Is a password manager safe?
A reputable password manager encrypts your passwords in a vault locked by one master password, and generates long, unique passwords for every account. Turn on two-factor authentication for the vault, and store your master password and recovery codes safely on paper at home.
Why write the master password on paper?
Because losing it can mean losing the vault. A paper copy at home is the backup that survives a lost phone, a broken device, and a forgotten passphrase — and it cannot be hacked remotely.