Zanda Account Security: Passwords, Password Managers, 2FA

This article covers key habits that keep your Zanda account secure: using a unique password, using a password manager, and turning on two-factor authentication (2FA). A weak or reused password puts your account at risk. A password manager makes strong, unique passwords realistic: it remembers and types a different one for every account, so you get more security and less hassle rather than a trade-off between them. The article also introduces passkeys, a quicker and more secure way to log in that is coming to Zanda. These practices apply to every account you have online, not just Zanda: your email, your bank, and your other software.

Use a unique password

Use a different password for every account, and make each one long and complex: a mix of uppercase and lowercase letters, numbers, and special characters. A long, random password is far harder to guess or crack than a short, familiar one.

Zanda stores your password as a one-way hash: even if someone were to gain unauthorized access to our systems, they could not recover your actual password from it, and neither can anyone at Zanda. Not every service takes the same approach, and that is why reusing a password is risky. If another service you use stores passwords less carefully and is breached, your password can leak in a readable form. Attackers then try that same email address and password on other accounts, a technique called credential stuffing. One breach anywhere can lead to a compromised account everywhere you used that password, Zanda included.

A unique password for every account closes that door. The easiest way to keep a different, long, complex password for every account is to let a password manager generate and remember it for you.

The same principle applies to team accounts: each team member should have their own Zanda login rather than sharing one user account among several staff. Separate logins cost nothing extra: a Zanda subscription is priced by active practitioner profile, not by user login, so adding an account for each person doesn’t add to your subscription. A shared login means a shared password, which spreads the risk of exposure across everyone who uses it and removes any way to tell which team member took a given action. It also works against two-factor authentication: the verification code or authenticator app usually belongs to one person’s device. Everyone else sharing that login either can’t complete 2FA themselves or has to go through that one person, undercutting much of what 2FA is meant to protect. Set up a separate user account for each person in User Management instead.

Use two-factor authentication

Two-factor authentication (2FA) adds a second check beyond your password: a code from an authenticator app on your own device. Logging in then takes something you know (your password) and something you have (your device).

Here’s why that matters. Say an attacker tricks you into entering your password on a fake page made to look like the Zanda login screen, a phishing attack. Without 2FA, they now have everything they need to log in as you. With 2FA turned on, your password alone is not enough: they also need the code from your authenticator app, which stays with you. Your account stays protected even after your password is exposed.

See Activating Two-Factor Authentication for how to turn it on for your Zanda account.

Use a password manager

A password manager generates a long, random, unique password for every account, stores it in an encrypted vault, and fills it in for you when you log in. You only need to remember one master password. That is what makes a unique password for every account realistic, where remembering dozens of strong passwords by hand is not.

A password manager also makes 2FA far more convenient. Many password managers can generate the time-based codes (TOTP) that 2FA needs, right alongside your password. Instead of typing a code from a separate authenticator app, you let the password manager generate it and fill it in for you.

Look for a password manager that works across every device you use (phone and computer) and every browser. When it does, that convenience, strong passwords and automatic 2FA codes alike, follows you everywhere, not only on the device where you set it up.

Support for TOTP generation varies by provider and by plan, and it changes often, so check the current details before you choose. Moving your vault to a different password manager later is a hassle, so choose one that supports 2FA code generation and autofill from the start. As of this writing:

• Apple Passwords (built into iPhone, iPad, and Mac): free, generates 2FA codes, and syncs across your Apple devices. It autofills in Safari natively; on a Mac running macOS Sonoma (released September 2023) or later, it also autofills in Chrome (and other Chromium browsers) once you install the free “iCloud Passwords” extension from the Chrome Web Store, and in Firefox with the “iCloud Passwords” add-on for Firefox. Earlier macOS versions support Safari only. On a Windows computer, install the free iCloud for Windows app to use the same passwords and 2FA codes in Chrome, Edge, and Firefox. Apple Passwords fits best when your phone is an iPhone; with an Android phone, choose one of the cross-platform options below.
• Bitwarden: works across every major platform and browser. 2FA code generation inside the vault is a paid-plan feature; the free plan does not include it. Bitwarden also offers a separate, free authenticator app (Bitwarden Authenticator) for iPhone and Android that generates codes for any account that supports them, independent of the vault.
• 1Password: works across every major platform and browser, generates 2FA codes. No permanent free tier; a paid subscription is required after a trial.
• LastPass: 2FA codes inside the password vault come with the Teams and Business plans only, not the Free, Premium, or Families plans. LastPass also offers a separate, free authenticator app (LastPass Authenticator) that generates codes for any account that supports them, independent of the vault. The Free plan works on one type of device, either computers or mobile devices, so using it on both needs a paid plan.
• Chrome’s Google Password Manager: free, but does not generate 2FA codes. You would need a separate authenticator app (such as Google Authenticator) alongside it.
• Microsoft Edge’s password manager (the built-in option on a Windows computer): free and syncs through your Microsoft account to Edge on your other devices, but does not generate 2FA codes. You would need a separate authenticator app (such as Microsoft Authenticator) alongside it. Microsoft Authenticator stopped saving and filling passwords in 2025, so it covers the codes only.

Choose a strong, memorable master password

The master password unlocks the vault, so it is the one password your password manager can’t generate or remember for you. It needs to be both secure and something you will actually remember. Never write it down.

A reliable way to build one: combine a few random, unrelated words, swap a few letters for similar-looking numbers or symbols (for example, “a” to ”@” or “e” to “3”), and add a bit of punctuation. The result is long and hard to guess, and memorable because it’s built from words rather than random characters.

Log in faster and more securely with passkeys

Passkeys are coming to Zanda, and they make logging in both quicker and more secure. A passkey lets you log in with the fingerprint, face, or PIN you already use to unlock your device. There is no password to type, and no 2FA code to fetch from another device.

A passkey counts as two-factor authentication on its own. It combines something you have (the passkey, held on your device or in your password manager) with something you are or know (your fingerprint, face, or PIN). One quick step gives you the protection of a password and a code together, so the more secure way to log in is also the more convenient one.

Passkeys bring several benefits over a password:

• No more codes. A passkey already covers both factors, so there is no 6-digit code to look up on your phone and type in before it expires.
• Nothing to remember or type. You approve the login with your fingerprint, face, or PIN, and you’re in.
• Protection against phishing. A passkey works only on the genuine website it was created for. On a fake page made to look like a login screen, like the one described under Use two-factor authentication above, there is nothing for you to type in and nothing for an attacker to capture.
• Nothing reusable to steal. The website holds only a public key, which is no use for logging in, and the private half of your passkey stays with you. If that website is ever breached, attackers get nothing they can try on your other accounts.
• Unique by design. Every passkey is created for a single account, so each of your accounts is protected separately without any effort from you.

Keep your passkeys in your password manager

Save your passkeys in your password manager and they are ready on every device you use. The password manager encrypts each passkey in your vault and syncs it to your other devices, so the same passkey logs you in on your phone, your computer, and every browser where your password manager is installed. When you move to a new device, sign in to your password manager and your passkeys are there with your passwords.

A passkey is saved wherever you create it, and one saved only to a single phone or computer works only on that device. Choosing your password manager each time you create a passkey is what makes it available everywhere.

Each password manager listed above can save passkeys. How widely passkeys sync varies by provider, by device, and by plan, and it changes often, so check the current details for the devices and browsers you use. Keep all your passkeys in one password manager, so you always know where to find them.

Secure the devices you log in from

A strong password, 2FA, and passkeys protect your login, and the computer and phone you log in from need protecting too. Your device’s screen lock is also what protects the passkeys and passwords saved on it. See Securing the Devices You Use to Access Zanda for how to set up screen locks, antivirus, disk encryption, and remote locking for a lost device.

If you think a password has been compromised

1. Reset your password immediately, and log out of all active sessions using the logout button.
2. Generate the new password with a password manager. Use a password you have never used anywhere else, at least 12 random characters long, more if the service allows it.
3. In Zanda, check your Log File (Tools > Log File) for any activity you do not recognize. You can filter it by user, date, page, and IP address.
4. If anything looks unfamiliar, contact us right away.