Prefer a unique passphrase or pass manager–generated secret.
Email-based reset still works if you lose access.