Password Habit Quiz

Habits, not a password

A strength checker can look at one password. It cannot see that the same password also opens your email, or that the backup codes for that email are sitting in the inbox. Those are habits. This quiz asks about the habits and then stops. It does not want the password, a username, or the name of a bank.

Reuse is the habit that turns one breach into many. Attackers try a leaked password on mail first, because mail can reset the other accounts. A different password on each account limits that. Length is the other half: a word plus the year is an early guess, and a capital letter with a symbol on the end does not change the pattern. Sixteen characters, or four unrelated words, is a practical target when something else remembers them.

The account that resets the others

The email that receives password resets is the floor under everything else. It needs its own password and a second step that does not arrive in that same inbox. An authenticator app, a passkey, or a hardware key still works when someone only has the password. A text message is better than nothing, and a SIM swap can redirect it. Backup codes are the spare key for a lost phone. They belong in a password manager or on paper, not in the camera roll and not in the inbox they protect.

Security questions are a second password that is often already public. A first pet or a street name can be guessed from records and family posts. Nonsense stored in the manager, or a second factor instead of the question, closes that door. Sharing a mail or bank password by text leaves a copy in a chat thread. A streaming login shared in a household is a smaller risk, as long as that password is not also the email password.

When a password should change

Change a password when there is a reason: a breach notice, another person learned it, or you typed it into a page you reached from a message. NIST 800-63B tells organizations not to require a change every 30, 60, or 90 days, because the usual result is a predictable edit, such as a new digit on the end. A breach you ignore leaves the stolen copy working. Change the named account, then change every other account that used the same password.

The plan on this page is general. It is not a promise that an account is safe, and a fake login page still beats a strong habit if the password gets typed there. Open the real service from a bookmark. The password strength checker can estimate one password on this device, and it never uploads it. The phishing inbox and link checker practice the message and the address. Choose Your Own Hack walks a scam as a story, and Tech Myth or Fact covers the claims people repeat about passwords, private browsing, and the padlock. The Digital Footprint Check is the wider privacy checklist: people-search sites, location, photos, and old accounts, still with nothing to type.