Passwords and security
Passwords and Biometrics
About 25 minutes, at your own pace
You are in a safe place. Nothing on this page can harm your device.
How to keep your accounts secure without memorizing dozens of passwords. We will cover Face ID, password managers, and what those security terms actually mean in plain language.
Helen's story
Helen, 69, had one password for everything: her late husband's name followed by their anniversary year. She used it for her email, her bank, her iPad, Amazon, Facebook, everything. "It's easy to remember," she told her daughter.
Then one day, Helen noticed strange purchases on her Amazon account, three expensive Bluetooth speakers she had never ordered. Someone had figured out her password (it turns out her husband's name and their anniversary were both on her Facebook profile) and used it to get into her Amazon account. Because Helen used the same password everywhere, the thief also tried it on her email, and got in.
Helen spent two stressful weeks changing passwords, calling her bank, and locking down her accounts. But the experience taught her something she now shares with every friend: "One password for everything is like one key for your house, your car, and your safety deposit box. If someone copies that key, they get into everything."
Today, Helen uses Face ID and a password manager. She says managing her passwords is now easier than it was before, and far, far safer.
If reading a page of security terms makes your head spin a little, that is perfectly normal. Passwords and security terms were invented by engineers for other engineers. They were never designed to be easy for regular people to understand or remember. The confusion you feel is a flaw in the system, not in you. We are about to make the whole thing much simpler.
Security terms in plain language
Before we go further, let us define some words you might hear. Think of this as your personal dictionary:
- Password: A secret word or phrase that proves you are who you say you are. Like a key to a lock.
- Biometrics: Using your body to prove your identity: your face, your fingerprint, or even your voice. "Bio" means life, and "metrics" means measurement. So biometrics means "measuring something about you."
- Face ID: Apple's system that uses the front camera on your iPad or iPhone to recognise your face. It is like a security guard who knows what you look like and opens the door when they see you.
- Touch ID: Apple's fingerprint reader, found on older iPads and iPhones. You press your finger on the Home button and it recognises your unique fingerprint.
- Face Unlock / Fingerprint Unlock: Android's version of the same idea. Many Android phones and tablets can recognise your face or your fingerprint to unlock your device and confirm your identity.
- Password Manager: A secure digital vault that remembers all your passwords for you. You only need to remember one master password. The vault remembers the rest.
- Two-Factor Authentication (also called 2FA or "two-step verification"): An extra security step when you log in. After typing your password, you also need a second proof, usually a code sent to your phone. It is like a door that needs both a key and a secret knock.
- Apple ID: Your personal account with Apple. It is the email address and password you use to download apps, use iCloud, and access Apple services. Think of it as your membership card for everything Apple.
- Google Account: Your personal account with Google. It is the email address (usually Gmail) and password you use to download apps from the Play Store, back up your data, and access Google services. Think of it as your membership card for everything on your Android device.
Those terms are not so scary when they are explained properly, are they? You are building your tech vocabulary, and most people never learn what these words actually mean. You are already ahead.
Biometrics: your face or fingerprint is your password
Modern devices can recognise you by your face or fingerprint. This is one of the most convenient and secure ways to protect your device.
How Face ID works: When you set up Face ID on a newer iPad or iPhone, your device takes a detailed map of your face using special sensors. It does not take a regular photograph. It creates a mathematical model of the shape of your face, stored only on your device (it is never sent to Apple or anyone else). When you pick up your device and look at the screen, it checks: "Is this the same face?" If yes, it unlocks.
Setting up Face ID on iPad or iPhone
Find the Settings app on your Home screen. It looks like grey mechanical gears. Tap it to open it.
Scroll down and tap "Face ID & Passcode".
Enter your current passcode (the number you type to unlock your device).
Tap "Set Up Face ID".
Hold your device at arm's length and position your face in the circle on the screen. Slowly move your head in a circle, as if you are tracing the outline of a large clock with your nose.
You will need to do this twice. Follow the on-screen instructions.
When it says "Face ID is now set up", you are done. Your face is now your password.
Face ID works with glasses on or off, and it adapts as your appearance changes gradually over time. It does not work with a face covering, so you may need your passcode when wearing a mask. Face ID will also not let someone unlock your device while you are sleeping. Your eyes need to be open and looking at the screen.
Most Android phones and tablets come with a fingerprint reader, and many newer models also offer face unlock. The fingerprint reader is usually found on the back of the device, on the side (built into the power button), or under the screen itself.
Setting up fingerprint unlock on Android
Open the Settings app (the gear icon on your Home screen or in the App Drawer).
Scroll down and tap "Security" or "Biometrics and Security" (the exact name varies slightly between Samsung, Google Pixel, and other brands).
Tap "Fingerprint" or "Fingerprints".
Enter your current PIN, pattern, or password. If you do not have one set up yet, the device will ask you to create one first.
Tap "Add fingerprint" and place your finger on the fingerprint sensor.
Gently tap and lift your finger on the sensor repeatedly. The screen shows how much of your fingerprint has been captured. Move your finger slightly each time to cover all the edges.
When the device says your fingerprint has been added, you are done. Your finger is now your password.
Android fingerprint unlock is very reliable and works even if your hands are slightly damp. Face unlock on Android is convenient, but on most devices it is slightly less secure than fingerprint. Some models can be unlocked with a good photograph. For best security, use fingerprint as your primary method and face unlock as a backup. You can have both set up at the same time.
Windows computers have a built-in sign-in system called Windows Hello. It lets you sign in with a PIN, your face (on computers with the right camera), or a fingerprint (on computers with a fingerprint reader). A Windows Hello PIN is especially useful. It is different from your Microsoft account password, and it only works on that specific computer.
Setting up a Windows Hello PIN
Click the Start button (Windows logo, bottom left) and then click the Settings gear icon.
Click "Accounts" from the list on the left side.
Click "Sign-in options".
Under "Windows Hello PIN", click "Add" or "Set up".
Confirm your Microsoft account password, then choose a PIN of at least 4 digits. Write it down and keep it in a safe place.
Once set up, you type this shorter PIN to sign in instead of your long password. Much easier to remember.
Your Windows Hello PIN is tied to your specific computer. It cannot be used anywhere else. This means even if someone finds your PIN written down, they cannot use it to access your account from another device. It is safe to write your PIN on paper and store it securely.
Creating strong passwords
For accounts where you still need a typed password, here is how to make a good one.
123456, password, your name, your pet's name, your birthday, your anniversary, your address, "qwerty", or any single word found in the dictionary.
Using the same password for multiple accounts is like using the same key for your house, your car, and your safety deposit box. If a thief copies that one key, they get into everything.
A strong password is like a strong lock: it has multiple parts that work together. The best way to create one is the passphrase method.
Instead of a single word, use a short phrase of random words. For example: Purple-Teacup-Bridge-44. This is much harder for a computer to guess than "MyName1954" but much easier for you to remember. You can picture a purple teacup sitting on a bridge with the number 44 on it. The sillier the image, the easier it is to remember. More examples: Garden-Rabbit-Snow-17 or Kitchen-River-Maple-82.
- Never use the same password twice. Each account should have its own unique password.
- Never share your passwords with anyone, not even someone who says they are from Apple or your bank.
- Make them long. A 16-character passphrase is far stronger than an 8-character password with random symbols.
You do not need to be a computer expert to have strong passwords. A silly phrase you can picture in your mind is all you need.
Write your master password on paper and keep it in a locked drawer or a safe, never on a sticky note attached to your device. A paper backup in a secure location is perfectly fine.
Password managers: your digital vault
"But how am I supposed to remember a different password for every account?" Great question. The answer is: you are not. A password manager does it for you. Your device already comes with one built in: iCloud Keychain on iPad and iPhone, Google Password Manager on Android, and a password manager inside Microsoft Edge on Windows. Here is what they do:
- When you create a new account on a website, your device offers to save the password for you.
- When you return to that website, your device fills in the password automatically. You do not need to type it.
- It can suggest strong passwords when you are creating a new account.
- It warns you if one of your saved passwords has been found in a data breach.
- All of this is protected by your Face ID, fingerprint, PIN, or passcode. No one else can see your passwords.
Making sure iCloud Keychain is turned on (iPad or iPhone)
Open Settings (the grey gears icon).
Tap your name at the very top of the Settings screen (it shows your name and "Apple ID, iCloud, Media & Purchases").
Tap "iCloud".
Tap "Passwords and Keychain".
Make sure the switch next to "Sync this iPad" (or "Sync this iPhone") is turned on (green). If it is already green, you are all set.
To view your saved passwords later: open Settings, scroll down and tap "Passwords", then confirm with Face ID or your passcode.
Making sure Google Password Manager is turned on (Android)
Open the Chrome app (the colourful circle icon).
Tap the three dots in the top-right corner of the screen.
Tap "Settings".
Tap "Password Manager" (or "Passwords" on some versions).
Make sure "Offer to save passwords" is turned on (the switch should be blue). If it is already on, you are all set.
To view your saved passwords later: open Settings, tap "Passwords and accounts" (or "Google" then "Password Manager"), and confirm with your fingerprint, face unlock, or PIN.
You can also visit passwords.google.com in any web browser to see all your Google-saved passwords. You will need to sign in with your Google account. This is handy if you want to review your passwords on a computer as well.
Turning on password saving in Microsoft Edge (Windows)
Open Microsoft Edge (the blue wave icon on your taskbar or Start menu).
Click the three dots (...) in the top-right corner of the browser.
Click "Settings".
On the left side, click "Passwords" (or search "Passwords" in the search bar at the top of Settings).
Make sure "Offer to save passwords" is turned on. If it is already on, you are all set.
To view a saved password later, return to Settings, click Passwords, and click the eye icon next to any entry (you may be asked to confirm with your Windows Hello PIN).
You now understand password managers, the single most powerful tool for keeping your accounts safe. You do not need to memorise dozens of passwords. The vault does it for you.
What about third-party password managers?
Your device's built-in password manager (iCloud Keychain, Google Password Manager, or Microsoft Edge) is free, already set up, and works perfectly for most people. However, some people prefer a separate app, especially if they use multiple types of devices (for example, an iPhone and a Windows computer). The three most trusted options:
- Bitwarden (free; paid plan about $10 per year): the best free option, open source and widely trusted. Moderate ease of use.
- 1Password (about $36 per year): the easiest to use, excellent for families, works on all devices.
- LastPass (free with limits, or about $36 per year): a long-standing service that had a security incident in 2022. Acceptable if you change your master password. Easy to use.
For most seniors: use your built-in password manager. It is free, already there, and works beautifully. If a family member suggests a third-party app and offers to help you set it up, Bitwarden (free) or 1Password (paid, easiest) are excellent choices. You do not need to rush into this. Start with what is already on your device.
Setting up 1Password, the easiest third-party option
Download the app. Open the App Store (iPhone or iPad) or the Google Play Store (Android) and search for "1Password". It is free to install, with a 14-day free trial.
Create your account. Open 1Password and tap "Create Account". Enter your email address, then open the confirmation email and tap the link to confirm.
Create your Master Password. Choose ONE strong password you will remember. Three or four random words strung together work well: "Sunset-Garden-Bicycle-Maple" is long and easy to picture, but very hard to guess.
Write your Master Password on paper. Write it clearly and keep it in a safe place at home: a drawer, a lockbox, or with your important documents. This is the one time paper is better than digital.
Add your first password. Open a website you use often. When you see the login page, 1Password will offer to save your username and password. Tap "Save Login".
Next time you log in, 1Password will offer to fill in your username and password automatically. Just tap "Fill". No typing needed.
Let it create new passwords. Next time you sign up for a new account, tap "Generate Password" in 1Password. It creates a strong random password and saves it. You never need to see or remember it.
Your Master Password is the key that unlocks every other password. Never save it digitally: not in a text file, not in an email draft, not in Notes on your phone. Write it on paper, store it at home, and do not share it with anyone except a trusted family member kept for emergencies. If you forget your Master Password, 1Password cannot recover it. That is what makes it secure. The paper backup is your lifeline. Keep it safe.
Two-factor authentication: the double lock
Imagine your front door had two locks: a regular lock and a deadbolt. Even if someone copied your key, they still could not get in without also having the deadbolt key. That is what two-factor authentication does for your online accounts. When you turn on two-factor authentication (let us call it "the double lock"), logging in works like this:
- You type your password as usual (the first lock).
- The website sends a short code (usually 6 numbers) to your phone or iPad (the second lock).
- You type that code into the website.
- Now the website knows it is really you, because even if someone stole your password, they would also need your phone to get the code.
Your Apple ID already uses two-factor authentication by default. When you sign in on a new device, Apple sends a code to your other devices. This is normal and it is protecting you.
The 3-second rule for codes
- Stop Did you request this code?
- Breathe If you did not try to log in, someone else might be trying.
- Verify Never share a verification code with anyone who calls or texts you. Change your password if you did not request it.
The four types of two-factor authentication
There are a few different ways to set up your "second lock". Here they are from easiest to most advanced. You only need to pick one:
- 1. Text message code (SMS), easiest for beginners. When you log in, the website sends a 6-digit code to your phone as a text message. You type the code to complete the login. Takes about 10 extra seconds. No special app required, just your mobile phone number.
- 2. Email code. Similar to SMS, but the code is sent to your email address instead of your phone. Good backup option if you prefer not to give out your phone number.
- 3. Authenticator app, more advanced. Apps like Google Authenticator or Microsoft Authenticator generate codes every 30 seconds, even without an internet connection. More secure than SMS because codes are not sent over the phone network. Requires one-time setup per account.
- 4. Face ID or fingerprint plus password. Using your face or fingerprint combined with your password. If you already use Face ID on your iPhone, you are doing this for your Apple account. Apple enables it by default.
Banking: most Canadian banks already require it; you may be using it without realising. Email (Gmail, Outlook): very important, because your email can be used to reset all your other passwords. Government services: CRA My Account, Service Canada. Facebook and Instagram: optional but recommended. Amazon: optional, especially important if you have a saved credit card. Start with your email and your bank. These two accounts are the most important to protect, and once they are secured, the rest follows naturally.
Turn on the double lock for your Gmail account
Open the Gmail app (red and white envelope icon) and make sure you are signed in. On a computer, go to myaccount.google.com in your browser instead.
Tap your profile photo (your initial or photo, top right corner), then tap Manage your Google Account.
Tap the Security tab.
Scroll down to How you sign in to Google and tap 2-Step Verification.
Tap Get started and follow the steps. Google will ask you to enter your phone number so it can send you a code by text message.
Enter the code Google sends you to confirm it works, then tap Turn on.
The next time you sign in to Gmail on a new device or after logging out, Google will send a 6-digit code to your phone. Just type in the code and you are in. On your own phone or iPad, you usually stay signed in and will not be asked for a code every time. Most services remember your own device for 30 days or longer.
Never give your 2FA code to anyone. A legitimate company will never call you and ask for your 6-digit code. If someone calls asking for your code, whether they say they are from Google, your bank, or the government, hang up immediately. That code is the key to your account, and giving it away hands them complete access.
Answering your questions about the double lock
- What if I lose my phone? When you set up 2FA, most services show you a set of backup codes: a list of one-time emergency codes. Print these or write them on paper and store them with your important documents. If you lose your phone, use a backup code to get in, then update your settings. You can also contact the company's customer support line. They have a process for verifying your identity and restoring access.
- Will I need a code every single time I log in? No. Most services remember your own device for 30 days or longer. You mainly get a code when you log in on a new device or after a long time away from the site.
- Is it really worth the extra step? Yes, absolutely. Two-factor authentication stops over 99% of automated account hacking attempts. That 10 extra seconds once a month is a small price for knowing your bank account, email, and photos are protected.
- Do I have to use it? Most websites make it optional, but some banks and government sites are starting to require it. Even where it is optional, enabling it for your bank and email is strongly recommended. Think of it like wearing a seatbelt: not every drive ends in an accident, but it is the right habit that protects you when it matters.
A real example: logging in to your bank with the double lock
Visit your bank's website (type the address yourself, never click a link in an email).
Enter your username and password as usual (the first lock).
The bank sends a 6-digit code to your phone by text message.
Open your text messages. The code arrives within seconds.
Type the 6-digit code into the bank website.
Tick "Remember this device for 30 days" if the option appears.
You are in, and your account is protected. That is the double lock in action: simple, fast, and enormously effective.
You now understand the three layers of security: a strong password, a password manager, and the double lock. You are more secure than most people online.
If you receive a verification code you did not request, do not panic, but do change the password for that account as soon as possible. It means someone is trying to log in as you.
Scams every Canadian should know
A scammer calls pretending to be your bank and says your card has been compromised. They offer to send a courier to pick it up. Your bank will NEVER send someone to collect your card. If this happens, hang up and call the number printed on the back of your card.
A caller pretends to be your phone company or the government and walks you through "fixing" your phone. Without realising it, you may activate call forwarding, sending all your calls to the scammer instead. If anyone asks you to dial *72 or *21 followed by a phone number, hang up immediately. These are call forwarding codes.
A smishing text looks like it is from your bank, Canada Post, or the Canada Revenue Agency. It asks you to click a link or call a number to "verify your account" or "claim a package". Real banks and government agencies do not send urgent links by text. If you receive an unexpected text asking you to act right away, do not tap the link. Call the organisation directly using the number on their official website or the back of your card.
A scammer enters your phone number on WhatsApp, which sends a 6-digit verification code to your phone as a text. The scammer then contacts you, often pretending to be a friend whose account was already stolen, and says: "I accidentally sent a code to your number, could you share it with me?" Do not share this code with anyone. WhatsApp will never ask you for a code through a message. Once a scammer has your code, they can take over your account.
A Facebook Messenger message claims to be from a grandchild, niece, or nephew in trouble, perhaps stranded in another city without their wallet. They ask for money by e-transfer or gift card. Scammers often use accounts they have already taken over to make the message look convincing. Before sending anything, phone the family member at their regular number. A real emergency call takes 30 seconds and costs nothing.
Source: Canadian Anti-Scam Coalition, standagainstscams.ca.
Quick check: test your knowledge
Tap the answer you think is correct. There is no score kept and nothing to sign in to.
1. Which is the strongest password?
2. What does a password manager do?
3. You receive a text message with a verification code that you did not request. What should you do?
Your progress
Tick each item as you feel confident with it. This is saved on this device only, with no account needed.
Send this lesson to someone
Helping a parent or friend? This page works on its own, with no account and nothing to install. Copy the link and text it to them.
Well done. Your accounts are now protected by strong, unique passwords, a password manager, and biometrics. That is a fortress of security, and you built it yourself.