Shift · Guides

Password hygiene that actually sticks

Updated 2026-08-06 · ~7 min read

People do not fail password security because they missed a special character. They fail because they reuse one clever password everywhere, store secrets in screenshots, or change nothing after a breach notification. Hygiene is a system, not a crossword puzzle.

Rules that earn their keep

1. Unique per site — a breach at a throwaway forum should not open your bank.
2. Long beats clever — a 20-character random secret or a 5-word passphrase usually beats P@ssw0rd!.
3. Manager first — browsers and dedicated managers exist so you do not memorize 200 strings.
4. 2FA everywhere that matters — app-based or hardware keys beat SMS when you can choose.

Generating secrets with PassShift

PassShift creates cryptographically strong passwords in your browser. Nothing is uploaded. Dial length up for high-value accounts; use a passphrase style when a human may need to type it on a TV or a friend’s laptop.

What not to do

• Do not email yourself passwords.
• Do not reuse the PassShift output as a master password template across sites without a manager.
• Do not store the only copy of a recovery code in the same inbox as the account.

Related tools

HashShift for verifying file checksums you downloaded, UuidShift for random IDs in apps, QRShift for sharing Wi-Fi join payloads carefully (treat QR content like a secret).