We spend a lot of time thinking about first impressions — how we present ourselves at the podium, the opening line of a letter, the subject line of an email that needs to be opened. But there’s one small act of self-presentation most of us sleepwalk through: creating a password.

It takes maybe thirty seconds to type in something you’ll actually remember — your dog’s name, your street, a birth year with an exclamation point — and move on. That thirty seconds of convenience can cost months of recovery.

Here’s what’s worth understanding: most passwords aren’t guessed the way we imagine, with a hacker hunched over a keyboard trying your mother’s maiden name. They’re harvested. Data breaches expose billions of credentials, and automated tools run through those lists looking for reuse. If your LinkedIn password from 2018 is the same one protecting your organization’s financial system today, that breach — from a company you don’t even think about anymore — is the unlocked door.

What actually makes a password strong:

Length beats complexity. A 16-character phrase of random words (“coffee-bridge-tandem-frost”) is harder to crack than an 8-character string of symbols that’s impossible to remember. Length expands the search space exponentially; a special character doesn’t.

Uniqueness is non-negotiable. One password per account. Every shared or reused password is a liability that multiplies with every breach, every platform, every year.

A password manager solves the problem you think is unsolvable. “I can’t remember a different password for everything” is the real objection — and it’s reasonable. Password managers generate, store, and autofill strong credentials so you never have to remember them. You remember one strong master password; the tool handles everything else. This is not an advanced technical solution. It is a browser extension.

Multi-factor authentication is the backup. Even a compromised password can’t get through an account protected by MFA. It adds thirty seconds to your login and removes one of the most common attack vectors entirely.

The bigger issue in organizational settings — which is where most of us live — is that password hygiene is often treated as an IT problem rather than a leadership one. But when a staff member’s credentials are compromised, and the shared drive is exposed, or a client system is accessed using a recycled password, the conversation quickly stops being about technology.

Taking five minutes to set up a password manager and turn on MFA isn’t a technical task. It’s the same discipline we apply to everything else: do it right the first time so you don’t have to repair it later.