As of November 2026, password guidance from NIST has changed. It says services should not force complexity rules or regular password changes. It also says a password should be changed if there is evidence it has been compromised. It also says a password used by itself should be at least 15 characters long, and a passphrase of four or more random words is one way to reach that. Guidance from the NCSC says the old advice to fill passwords with random symbols is not helpful, because people cannot remember so many complex passwords. Swapping letters for numbers, like o for 0, does not make a password much stronger because criminals know the trick.

As of November 2026, password guidance from NIST supports password managers and says sites should allow pasting passwords into the box. Password managers have been shown to help people choose stronger passwords, especially when they include a generator. A password manager is a program that makes, stores and fills in your passwords, so you only remember one strong one. Its autofill only fills a password on the matching website, which helps protect against phishing. Three random words joined together can make a password that is long enough and strong enough.

As of November 2026, passkeys let you sign in with your device's fingerprint, face check or passcode instead of a password, and guidance from the NCSC recommends them wherever offered. Two-step verification asks for a second proof that it is really you, such as a code sent to your phone, in addition to your password. It can stop a criminal who has your password from getting into your account. The second step can be a code sent by text, a code made by an authenticator app, or your fingerprint or face. Multifactor authentication uses something you know, something you have or something you are.

A criminal who gets into your email could read private information, send messages pretending to be you, and reset your other passwords. Your email password is especially important, because an email account can be used to reset the passwords of your other accounts. Start by turning on two-step verification for your email. If you gave your password to a scammer, change it on every account that uses the same password.

Software updates fix security weak spots, so install them when your device asks. Automatic updates install themselves, so you do not have to remember to do it. A software update patches security flaws, and attackers may target known flaws for months or even years after an update is available. Only download updates from trusted vendor sites, not from a link in an email, because fake update emails are a known trick. Old devices eventually stop getting security updates, and without them the device is less secure. It is best to install updates at home on a trusted connection rather than on public Wi-Fi.

A padlock or https at the start of a web address shows that a site's connection is secure. HTTPS encrypts the data passing between your browser and a website, so attackers on the network cannot read it. A VPN sends your web activity through a secure network that encrypts and protects your data. Public Wi-Fi is open to anyone, so be careful what you do on it. On public Wi-Fi, avoid using sensitive accounts like banking or making purchases. Fake Wi-Fi hotspots can copy the name of a real one, so ask the place for its exact Wi-Fi name.

Phishing is a form of social engineering: attackers use people's trust, rather than computer flaws, to get information. Attackers use news events and times of year, such as holidays or disasters, to make their messages look timely. Texting scams are called smishing and voice-call scams are called vishing, and both are kinds of phishing. Caller ID can be spoofed, so a call that seems to come from a trusted number may not. Poor spelling used to be a clue to a scam, but scams are getting smarter and some even fool experts. A real bank will never ask you to confirm your account details by email or a phone call it started. Even people you know can send a bad attachment, because viruses can spoof a sender's address.

Posted information can survive removal: saved or cached copies may still exist on other people's machines. As of November 2026, companies and schools sometimes look up applicants online, so what you post can matter later. Most people are judged on authenticity, not perfection. A self-audit means looking over your profiles from time to time and removing posts that no longer fit your values. Do not give an app more access than it needs. Before installing an app, read its privacy policy, and be wary if it is vague about who gets your data or asks for excessive permissions.

Deepfakes are fake images, videos and audio made with AI that can look and sound like a real person. If someone shares an embarrassing or inappropriate image claiming it is you, tell a trusted adult. It should be reported to the site. Text can be hard to read: something meant as a joke can look like an insult online. Do not post comments, videos or photos that might hurt or offend someone, and ask a trusted adult if you are unsure. If something online makes you feel sad, scared or confused, tell a trusted grown-up. Telling a grown-up about something that worried you online is the right thing to do, and you should not be in trouble for telling.

Words to know

• passkeys: fingerprint-style logins
• encrypts: scrambles data
• compromised: broken into
• vendor: seller