The Household Security Plan
Rank every account in the house, make every password random, add a sign-in key a fake page cannot copy, and know the first hour after a breach
AntiVirusDon's free Password Strength Checker used to size a password by its character types and length alone. That is exact for a password a generator made and wrong for one a person made: it gave "Password123!" 78.7 bits, Strong, and 2 million years to crack. While writing this plan we checked our own tools and changed four of them. The strength checker now reads that password as 21.6 bits, cracked instantly; the generator makes every character equally likely; the phishing checker never calls a link safe and now catches look-alike letters, swapped characters and address tricks; and the hash tool labels MD5 and SHA-1 broken for security use. The Household Security Plan ranks every account in the house so the few that can reset the rest (email, the phone carrier, the password manager) are locked first, sets an 80-bit rule of thumb for every generated password (16 characters from all four sets gives 104.9 bits), ranks sign-in methods by whether a fake page can pass them on, and plans recovery codes and a seven-word passphrase. In the worked example (an example, not a promise), a household of three has 71 accounts, 8 of them master keys, and one reused password reaches 9 of one adult's 30 accounts; the plan fixes those in order. It adds automatic updates, three backup copies with one away and a tested restore, SHA-256 checksums, the rule of going to a site yourself rather than from a message, and the first hour, day and week after a breach. It is a household plan, not a product review, audit or legal advice, and it cannot promise you will never be hacked. It recommends no product, brand or service and teaches nothing offensive. For fraud, call your bank on the number on your card; in the US, report identity theft at IdentityTheft.gov, and credit freezes are free at the three bureaus. Included: 23 printable pages, seven steps, an account register, a household security card, a breach checklist, a password length reference table, a quickstart, and a personalised sheet worked on the settings you chose in our password generator (never a password).
Look inside
Two full pages from the plan, exactly as printed. Click either to read it at full size before you decide.
What is in it
- Email Is the Master Key: every account in the house ranked into master keys, money and everything else
- Random or It Does Not Count: generated passwords, an 80-bit target, and what made-up passwords are really worth
- Something a Fake Page Cannot Replay: passkeys, security keys, app codes and text messages, ranked
- Plan the Way Back In: recovery codes, recovery details and a seven-word passphrase for the manager
- Three Copies, One Away: automatic updates, backups with a tested restore, and SHA-256 checksums
- Go There Yourself: what a link checker can and cannot catch, and the household rule for messages
- Master Keys First, Then the Reuse: the first hour, day and week after a breach, and where to report it
- The account register, printable, one per person
- The household security card and the breach checklist, printable
- A password length reference table by character set, and a one-page quickstart
- ✓ 23 printable pages
- ✓ 10 sections, worksheets and templates
- ✓ A second PDF worked out from the numbers you enter
- ✓ No account needed, just an email address
- ✓ Instant download; link valid 7 days
Price includes any taxes. Sold by GrabURL, who handle checkout and support. The charge appears on your statement as GrabURL.
The plan picks up where the free Secure Password Generator leaves off. The generator makes one random password; the plan ranks every account in the house so the few that can reset the rest (email, phone carrier, password manager) are locked first, sets a length target for every password a manager stores, and shows with the Password Strength Checker why a password you made up is worth far less than its length suggests. It ranks two-step sign-in methods by whether a fake page can pass them on, plans recovery codes and a passphrase you can remember, and adds tested backups and SHA-256 checksums with the File Hash Generator. With the Phishing URL Checker it shows which address tricks can be caught and why a clean result never means safe, and it ends with the first hour, day and week after a breach. It recommends no product. For fraud, call your bank on the number on your card; in the US, report identity theft at IdentityTheft.gov. The worked figures are examples.