A password manager is not optional

Every time someone tells me they remember all their passwords, I know there is a problem. It usually means the same password, or a small variation of it, is reused across dozens of sites.

The problem does not start with you. It starts when one of those sites gets breached. Once your password is out there, someone will try it against every other service they can think of. It is called credential stuffing, and it is why most personal account breaches do not start with anything clever. They start with reused passwords.

A password manager solves this without asking you to remember anything. A long random password per service, and one strong password that unlocks the rest. Add two factor authentication wherever you can, and you have a reasonable baseline without spending much thought on it.

This is not expert advice trying to impress you. It is the simplest action I know of with the highest return.