To keep your accounts safe, use a long, unique password for every important account (a passphrase of four or more random words works well), turn on two-factor authentication (2FA) for email, banking and social media, and never share OTPs. A password manager app is the most convenient option. If you prefer paper, a written password logbook kept at home is safe from online hackers, provided you store it privately and never write your UPI PIN, ATM PIN, card CVV or OTPs in it.
Rule 1: Long and unique beats complicated
- Use a passphrase: four or more unrelated words, such as mango-bicycle-river-lantern, is long, hard to guess and easy to remember. (Don't use this example.)
- One account, one password. Reusing a password means one leaked website can unlock your email and everything else.
- Avoid personal details: names, birthdays, phone numbers and "Password@123" are the first things attackers try.
Rule 2: Turn on two-factor authentication
2FA asks for a second proof, such as a code from an authenticator app or a text message, when you log in on a new device. Even if someone gets your password, they can't get in without the second step. Turn it on first for your email (it can reset everything else), then banking, UPI apps and social media.
Rule 3: Protect your email account
Your email is the "master key": password resets for almost every other account go there. Give it your strongest, unique passphrase, turn on 2FA, and keep its recovery phone number up to date.
Rule 4: Never share OTPs, PINs or CVVs
Banks, UPI apps and government services will never ask for your OTP, UPI PIN or card CVV on a call, SMS or WhatsApp. Anyone asking is attempting fraud. In India, report cyber fraud at the national helpline 1930 or at cybercrime.gov.in.
Using a password logbook safely
A written logbook can't be hacked online, which is why many people, especially older family members, prefer one. The trade-off is physical: anyone who finds it can read it. To use one safely:
| Do | Don't |
|---|---|
| Keep it at home in a private, secure place | Carry it in your bag or leave it on your desk at work |
| Write hints only you understand, rather than full passwords, where you can | Take photos of pages or store them in your phone's gallery or chats |
| Note the date you last changed each password | Write your UPI PIN, ATM PIN, card CVV or OTPs, ever |
| Record recovery emails and phone numbers | Label the book "Passwords" on the outside if it will be visible |
A logbook also helps families: in an emergency, a trusted person can find the accounts that need attention.
When to change a password
You don't need to change strong, unique passwords on a schedule. Change one straight away if a service tells you it was breached, if you notice a login you don't recognise, or if you ever shared or reused it.
Printable logbook
The Password Logbook is a 30-page A4 organiser: an important-accounts page (email, Wi-Fi and router, devices), one page for each letter A–Z with room for three websites each (site, username, password or hint, notes and "changed on" date), and a notes page. It includes the security tips above. ₹149.
Frequently asked questions
Is it safe to write passwords in a notebook?
It can be, if the notebook stays at home in a private place. It cannot be hacked online, but anyone who finds it can read it, so write hints where possible and never write UPI PINs, ATM PINs, CVVs or OTPs.
What makes a strong password?
Length and uniqueness. A passphrase of four or more unrelated words, used for only one account, is stronger and easier to remember than a short password with symbols.
What is two-factor authentication?
A second login step, such as a code from an authenticator app or SMS, needed when you sign in on a new device. It stops someone who has only your password from getting in.
Should I change my passwords regularly?
Not on a schedule if they are strong and unique. Change a password immediately after a breach, a suspicious login, or if you shared or reused it.
Where do I report online fraud in India?
Call the national cyber crime helpline 1930 or report it at cybercrime.gov.in, and contact your bank immediately if money is involved.
General online-safety guidance. For a specific security incident, contact your bank or the cyber crime helpline 1930.