Password best practices for creating, storing and sharing account passwords

Learn how to create, manage and share passwords securely and what passkeys are

Tips for creating a strong password:

Do
- Make it long: 12 characters or more. Longer passwords are harder to crack.
- Use a mix of characters: Combine uppercase and lowercase letters, numbers, and special characters (e.g., @, #, $, %).
- Use passphrases: For a memorable password string 3 or more words together.
- Use a password generator: Dashlane | 1Password
- Enable multi-factor / two-factor authentication: MFA / 2FA
- Use passkeys and biometrics: Fingerprints and face ID.
- Change your password: If you think or it has been compromised.
Don't
- Include guessable information: eg. names, birthdays, favourite sports team, information on your social media or common passwords - see list >.
- Write it down: Use a password manager, eg. Dashlane or in internet browser.
- Reuse passwords: If one account is compromised then others will be too.
- Share your password with anybody else unless it's a shared account.

It is best practice to create separate logins for each user and you do not share your passwords.

If you can only have a limited number of accounts for a service...

Email: Use a shared diocesan email address that every person you're sharing with has access to. That way you can all sign in and account details won't need to be changed if somebody leaves or moves roles.
- If you need a shared email address setup please raise a support ticket with details on its alias and who needs access.
Username: If required, use a generic username such as a department or the organisation's name.
Password: Use a unique password and store the password in your password manager.
MFA: Either choose a shared email address or phone number you all have access to and/or add to everybody's authenticator app during setup.
- See: Can I use multiple devices for authenticator app MFA/2FA codes when signing into a website or cloud service? >
Storing: Save in a password manager such as Dashlane, Edge or Chrome. Autofill can then be used be enabled to help speed up logging in across multiple devices.
Sharing:
1. For Dashlane, save to a team's or multi-team's collection or create your own collection and share with users or groups. See:
  Dashlane: Sharing passwords with your colleagues and team >
2. Share sensitive data using PrivNote. See:
  How can I securely share information like a password with somebody else? >

Passkeys are a new method to move away from using passwords and are supported by Dashlane.

Note: Sharing passkeys will be supported in the future.

For more information on passkeys see Dashlane Support: Passkeys >