And don't actually store the password in a variable—again, this only works if you trust the user's computer isn't compromised (although that's all true for validating against a server too).

Of the stolen passwords, nearly 1.6 million come from websites. More than 318,000 come from Facebook, nearly 60,000 from Yahoo, more than 54,000 from Google and nearly 22,000 from Twitter.

Experts recommend password managers like LastPass as the easiest way to generate unique, strong security codes for every one of your online accounts---which sounds great, until that password ...