Passwords and MFA: the 2026 guide

In 2026, the vast majority of account breaches look nothing like a hacker film. No exotic exploit, no sophisticated virus: the attacker simply logs in with your password. They guessed it, bought it from a stolen database, or harvested it via a fake login page. The good news? A few well-chosen habits are enough to turn your accounts into virtually unassailable targets. This guide shows you which ones, and in what order to put them in place.

Why your passwords are the primary target

Historically, passwords have been an account's first line of defence. They have also become its weakest link. The figures speak for themselves: around 8 out of 10 data breaches involve a weak, reused or stolen password. Billions of credentials circulate freely on cybercrime forums, ready to be replayed across other services.

In practice, attackers combine several industrialised techniques:

• Brute-force and mutated dictionaries: programs test billions of combinations per second on GPU farms, applying smart rules (capital letter at the start, 2026! at the end, a replaced by @…).
• Credential stuffing: did your email and password leak on a small e-commerce website? The attacker automatically replays them against your inbox, your bank account and your Microsoft 365 area. If you reuse the same password everywhere, a single breach is enough to compromise everything.
• Next-generation phishing: scam emails are now generated by AI, free of spelling mistakes, sometimes mimicking the style of your school or company. The fake login page is a perfect clone of the real one.

Faced with this arsenal, two common myths must be discarded immediately: no, adding a ! at the end does not make a password strong, and no, changing it every 90 days does not improve your security. This forced expiry policy is even advised against by ANSSI and NIST, as it encourages predictable patterns (Pass2026a, then Pass2026b…). What truly matters is length and uniqueness.

The passphrase: long, simple to remember, impossible to crack

With modern computing power, length has become the ultimate metric. An 8-character password, even packed with symbols, falls in a few hours. In contrast, a 25-character phrase made up of simple words resists the same attacks for millions of years. That is the whole principle behind a passphrase: rather than memorising Xk7#qP2!, remember a complete sentence.

Three rules for creating a strong passphrase:

1. Aim for at least 20 characters. A phrase of 4 to 6 words reaches this easily: mon chat roux dort sur le clavier is already 33 characters long.
2. Choose words with no connection to you. Ban first names, dates of birth, the name of your company or your favourite band: these are the first clues targeted attacks test. Best approach: randomly chosen words with no logical link between them.
3. Keep the spaces. They count as special characters in almost all modern systems and make your phrase longer without slowing down your typing.

Simple rule of thumb: a short and "complicated" password like Jean2026! is weak. A long and "simple" phrase like le velo bleu traverse la lune en avril is excellent. Length beats complexity, every time.

In practice, you only need to memorise one or two passphrases: the one for your session and the one that unlocks your password manager. It handles everything else.

The password manager: a single secret to remember

The average internet user juggles between 50 and 100 accounts. Demanding a long, unique password for each one exceeds human memory, which is exactly why password managers exist. The principle: an encrypted vault (AES-256) that generates, stores and automatically fills in unique random passwords for every service. You only have to remember the master passphrase that unlocks the vault.

An often overlooked bonus: password managers are also a formidable anti-phishing tool. Autofill is linked to the exact domain name of the site. If you land on paypa1.com instead of paypal.com, the manager will not recognise the URL and will refuse to offer your credentials. This unusual silence should alert you immediately.

A few proven solutions depending on your profile:

• Bitwarden: open source, free for the essentials, self-hostable. The versatile choice par excellence, including for small teams.
• KeePassXC: 100% local and offline. Ideal if you want complete sovereignty over your vault, at the cost of manual synchronisation between devices.
• Proton Pass or 1Password: maximum convenience, disposable email aliases, secure sharing for families or teams.

What about your browser's built-in manager? It is better than nothing, but it is also the favourite target of info-stealing malware (infostealers), which can extract all passwords saved in Chrome or Edge in seconds. A dedicated vault, protected by a strong master passphrase, adds an extra layer of isolation.

MFA: the safety net that changes everything

Even an excellent password can be stolen via phishing or a server-side breach. This is where multi-factor authentication (MFA, sometimes called 2FA) comes in: to log in, you must prove your identity using at least two different types of factors:

• Something you know: a password, a PIN.
• Something you have: your smartphone, a physical security key.
• Something you are: your fingerprint, your face.

The impact is massive: enabling MFA blocks almost all automated account attacks. An attacker with your password hits a brick wall if they do not also have your second factor. But be aware: not all MFA methods are created equal.

SMS, TOTP app, passkeys: which should you choose?

SMS codes are the most widespread method... and the weakest. They are vulnerable to SIM swapping: the attacker convinces your mobile operator to transfer your number to their own SIM card and receives your codes instead. It is better than nothing, but best avoided whenever an alternative exists.

TOTP apps (Aegis, Google Authenticator, Microsoft Authenticator...) generate a 6-digit code refreshed every 30 seconds, directly on your phone without going through the mobile network. Far more robust than SMS, they can still be bypassed by real-time phishing kits (adversary-in-the-middle attacks): the fake page instantly relays your valid code to the genuine site and steals your session.

FIDO2 keys (YubiKey and equivalents) and passkeys (the software version built into your phone or computer) tackle this problem at the root: authentication relies on a cryptographic signature tied to the site's exact domain name. A clone page, even visually identical, simply cannot obtain a valid signature. This is what is known as phishing-resistant MFA, and it is the recommended standard in 2026.

The 5 mistakes that ruin everything

1. Reusing the same password everywhere. This is mistake number one: a leak on a secondary site becomes a master key to your inbox, which can then be used to reset all your other accounts.
2. Using variations of a base password. Soleil2025!, Soleil2026!... Cracking tools know these patterns by heart and test them first.
3. Neglecting security questions. Your mother's maiden name or your first school can be found in five minutes on social media. Use a random string stored in your password manager instead.
4. Ignoring recovery codes. When you activate MFA, every service provides backup codes. Without them, losing your phone means losing your accounts. Store them in your password manager or print them in a safe place.
5. Entering credentials after clicking a link. Email, SMS, private message: whatever the channel, never log in via a link you received. Use your bookmarks or type the address yourself.

Your 4-step action plan

No need to do everything in one weekend. Follow this order:

1. Install a password manager and create a master passphrase of at least 20 characters that you do not reuse anywhere else.
2. Secure your primary email first: it is the keystone used to reset all your other accounts. Unique generated password + passkey or FIDO2 key.
3. Enable MFA on your sensitive accounts: banking, social media, cloud storage, student or work area. Prioritise passkey > TOTP > SMS.
4. Gradually replace your old passwords with generated passwords, starting with those you know are reused. Check on a service like Have I Been Pwned to see if your address appears in known breaches.

With one evening for critical accounts, then a few minutes a week for the rest, you eliminate almost all hacking scenarios that target the general public. And if you want to go further (understanding attacks in depth, handling tools and building genuine cyber hygiene), this is what the BTS SIO 1 library, Digital Identity module covers.