Using Passwords in 2026 Is a Massive Risk. Here's What Hackers Don't Want You Doing Instead

"You can use a passkey, you can use a password manager, you can use 'yourdog'sname2023,' whatever. It doesn't really matter because authentication has already happened by using that cookie," Hilligoss says. "Criminals are emulating an already authenticated session. So from the perspective of the website, it just sees that it's a valid cookie." Hilligoss says that once a website, such as your email service, validates the cookie, the criminal doesn't need to log in with your credentials or authenticate their identity. The cookie, which persists in a person's browser for seconds or years, allows criminals to access your accounts undetected and steal your data or money. The onus is on website owners to find a solution for cookie hijacking. Hilligoss tells me that the rest of us can protect ourselves from the cookie-hijacking threat by using passkeys or strong, unique passwords wherever possible. He adds that some websites allow users to choose when their session tokens expire. You know the data privacy pop-up screens? Don't immediately tap "Accept." Instead, navigate to the "Cookies" or "User Data" sections and choose the shortest available session duration. That way, your cookies will expire automatically or whenever you close your browser window. How to Manage Your Passkeys Across All Your Devices Speaking of password managers, many of the services I've reviewed for PCMag, such as Editors’ Choice award winners NordPass and Proton Pass , can store and generate passkeys for you. Android and iOS users can store passkeys using the built-in Apple Passwords app or Google Password Manager . Microsoft is doing its part to eliminate passwords by encouraging its customers to use passkeys and making all new accounts password-less by default. The company even removed the password management functions from Microsoft Authenticator , but preserved the passkey storage options. A password manager makes it easy to access both your old credentials and new passkeys when you log in. Check out this list of our top picks for password managers .

Hilligoss says that once a website, such as your email service, validates the cookie, the criminal doesn't need to log in with your credentials or authenticate their identity. The cookie, which persists in a person's browser for seconds or years, allows criminals to access your accounts undetected and steal your data or money. The onus is on website owners to find a solution for cookie hijacking. Hilligoss tells me that the rest of us can protect ourselves from the cookie-hijacking threat by using passkeys or strong, unique passwords wherever possible. He adds that some websites allow users to choose when their session tokens expire. You know the data privacy pop-up screens? Don't immediately tap "Accept." Instead, navigate to the "Cookies" or "User Data" sections and choose the shortest available session duration. That way, your cookies will expire automatically or whenever you close your browser window. How to Manage Your Passkeys Across All Your Devices Speaking of password managers, many of the services I've reviewed for PCMag, such as Editors’ Choice award winners NordPass and Proton Pass , can store and generate passkeys for you. Android and iOS users can store passkeys using the built-in Apple Passwords app or Google Password Manager . Microsoft is doing its part to eliminate passwords by encouraging its customers to use passkeys and making all new accounts password-less by default. The company even removed the password management functions from Microsoft Authenticator , but preserved the passkey storage options. A password manager makes it easy to access both your old credentials and new passkeys when you log in. Check out this list of our top picks for password managers .

The onus is on website owners to find a solution for cookie hijacking. Hilligoss tells me that the rest of us can protect ourselves from the cookie-hijacking threat by using passkeys or strong, unique passwords wherever possible. He adds that some websites allow users to choose when their session tokens expire. You know the data privacy pop-up screens? Don't immediately tap "Accept." Instead, navigate to the "Cookies" or "User Data" sections and choose the shortest available session duration. That way, your cookies will expire automatically or whenever you close your browser window. How to Manage Your Passkeys Across All Your Devices Speaking of password managers, many of the services I've reviewed for PCMag, such as Editors’ Choice award winners NordPass and Proton Pass , can store and generate passkeys for you. Android and iOS users can store passkeys using the built-in Apple Passwords app or Google Password Manager . Microsoft is doing its part to eliminate passwords by encouraging its customers to use passkeys and making all new accounts password-less by default. The company even removed the password management functions from Microsoft Authenticator , but preserved the passkey storage options. A password manager makes it easy to access both your old credentials and new passkeys when you log in. Check out this list of our top picks for password managers .

You know the data privacy pop-up screens? Don't immediately tap "Accept." Instead, navigate to the "Cookies" or "User Data" sections and choose the shortest available session duration. That way, your cookies will expire automatically or whenever you close your browser window. How to Manage Your Passkeys Across All Your Devices Speaking of password managers, many of the services I've reviewed for PCMag, such as Editors’ Choice award winners NordPass and Proton Pass , can store and generate passkeys for you. Android and iOS users can store passkeys using the built-in Apple Passwords app or Google Password Manager . Microsoft is doing its part to eliminate passwords by encouraging its customers to use passkeys and making all new accounts password-less by default. The company even removed the password management functions from Microsoft Authenticator , but preserved the passkey storage options. A password manager makes it easy to access both your old credentials and new passkeys when you log in. Check out this list of our top picks for password managers .

How to Manage Your Passkeys Across All Your Devices

Speaking of password managers, many of the services I've reviewed for PCMag, such as Editors’ Choice award winners NordPass and Proton Pass , can store and generate passkeys for you. Android and iOS users can store passkeys using the built-in Apple Passwords app or Google Password Manager . Microsoft is doing its part to eliminate passwords by encouraging its customers to use passkeys and making all new accounts password-less by default. The company even removed the password management functions from Microsoft Authenticator , but preserved the passkey storage options. A password manager makes it easy to access both your old credentials and new passkeys when you log in. Check out this list of our top picks for password managers .

Microsoft is doing its part to eliminate passwords by encouraging its customers to use passkeys and making all new accounts password-less by default. The company even removed the password management functions from Microsoft Authenticator , but preserved the passkey storage options. A password manager makes it easy to access both your old credentials and new passkeys when you log in. Check out this list of our top picks for password managers .

A password manager makes it easy to access both your old credentials and new passkeys when you log in. Check out this list of our top picks for password managers .