How risky are your passwords? No typing them, ever.

Part of Phone Kit, a free appSave your details once and all 12 tools fill themselves in. Installs to your phone, works offline, nothing leaves your device.Open

Why the email account is the whole game

Every other account resets its password by emailing you. Whoever controls your email controls your bank, your Apple Account, your work login. That is why two of the six questions are about the email account specifically, and why 2FA on it is weighted more than anything else.

Reuse beats weakness

A strong password reused on five sites is one breach away from being a known password on all five. Attackers take leaked email and password pairs and try them everywhere ("credential stuffing"). A password manager makes reuse unnecessary; iPhones have a good free one built in under Settings, Passwords.

Age matters less than you were told

Forced 90-day rotation is out of NIST's guidance since 2017; it produced Password1, Password2. Change a password when it has been in a breach, when it is reused, or when it is weak. Otherwise a long, unique, 2FA-protected password can stay for years.

Text-message 2FA still counts

It is weaker than an authenticator app or passkey (SIM swaps are real), but it is dramatically better than nothing. Turn on whatever the site offers today, then upgrade to passkeys where they are available; Apple, Google, and most banks now support them.