I'd say getting in the habit of using password managers is by far the most important point. Once you are doing that, using long and unique passwords comes auto

I'd say getting in the habit of using password managers is by far the most important point. Once you are doing that, using long and unique passwords comes automatically. Using 2FA is good but I'd say it's not 'low-hanging fruit' Changing passwords regularly is also not low-hanging fruit. For many things it's not even necessary, for very important stuff you'd want to change password every 4-6 months, so for example someone wont have access to your email for 3 years straight. It will put a ceiling on the maximum continuous time someone could have had access to your account. 2FA helps with this as well. I'd focus on making people understand how easy these password managers are. Depending on the audience, you could focus on it being much better and easier, not necessarily "more secure", they probably care more about it being easy.