Passwords and passkeys: securing your accounts
Reusing the same password on several sites remains one of the most frequent causes of account hacking. Three tools solve most of the problem: a password manager, two-factor authentication and passkeys.
Kayzen Security editorial team4 min read
What makes a good password
Length matters more than apparent complexity. A passphrase made of several unrelated words is both long and memorable. The CNIL publishes a detailed recommendation on passwords (délibération n° 2022-100 of 21 July 2022), adapted according to whether they are used alone or with a second factor.
- Unique for each account.
- Long: a passphrase or a randomly generated sequence.
- Never based on personal information (first names, dates, your pet's name).
- Changed without delay in the event of a known leak or any doubt.
The password manager
A password manager stores your credentials in an encrypted vault, protected by a single master password. It generates random passwords, fills them in automatically and only offers them on the right site, which also limits the risk of phishing.
Choose a recognised tool, protect the master password carefully and turn on two-factor authentication on the vault itself. In a company, a team password manager makes it possible to share access without sending it by email.
Two-factor authentication
- Authenticator app or physical security key: the safest options.
- Code by SMS: better than nothing, but more exposed (SIM swapping, real-time phishing).
- Never give a code you have received to someone who asks for it, even if they claim to be your bank or technical support.
- Keep backup codes in a safe place, away from your main device.
Passkeys: the logical next step
A passkey is based on standards from the FIDO Alliance and the W3C. Your device creates a key pair unique to each site: the private key is never sent to the site and stays on your device or in your password manager, which syncs it in encrypted form; you unlock it with your fingerprint, your face or your PIN.
Because the key is tied to the real domain name, a fake site cannot use it: it is strong protection against phishing. Turn them on when a service offers them, while keeping a recovery method.
In the workplace
- Require two-factor authentication on email, remote access and administration tools.
- Provide a team password manager rather than shared spreadsheets.
- Quickly deactivate the accounts of people who leave.
- Use different local administrator passwords on each computer.
Official sources
- CNIL (new tab) — Mots de passe : une nouvelle recommandation pour maîtriser sa sécurité
- FIDO Alliance (new tab) — Passkeys (clés d'accès)
- Cybermalveillance.gouv.fr (new tab) — Assistance et prévention en sécurité numérique (fiches réflexes, prestataires ExpertCyber)
The resources cited are published by their authors in their original language. Kayzen is not affiliated with any of these organisations.
This guide is general and for information only. It does not replace legal advice or the help of an IT security professional.