How do I secure my online accounts?

Most account security advice is a long list of marginal improvements. In practice a small number of measures do nearly all the work, because the common attacks are credential stuffing (reused passwords from a breach elsewhere) and phishing. Unique passwords stop the first; two-factor authentication stops most of the second.

Step by step

1. Secure your primary email account before anything else.Whoever controls your email can reset the password on almost every other account you own. It's the highest-value target you have.
2. Install a password manager and let it generate unique passwords.The point isn't complexity, it's uniqueness — so one breached site can't unlock the rest. Any reputable manager is far better than reuse.
3. Turn on two-factor authentication everywhere it's offered.Start with email, banking, and anything with payment details stored.
4. Prefer an authenticator app or a hardware key over SMS codes.SMS can be intercepted through SIM-swap attacks. It's still much better than nothing, so use it where it's the only option.
5. Save the recovery codes somewhere safe and offline.Losing your second factor without recovery codes can lock you out permanently. Print them or store them in the password manager.
6. Check whether your details have appeared in known breaches.Have I Been Pwned lets you check an email address against known breaches. Change the password anywhere it appears.
7. Change reused passwords, starting with the most important accounts.You don't have to do all of them at once. Email, banking, and anything with card details first.
8. Review the apps and services connected to your main accounts.'Sign in with Google/Apple' grants ongoing access. Revoke anything you no longer use.
9. Be sceptical of urgency in any message asking you to log in.Urgency is the core phishing technique. Navigate to the site yourself rather than following a link in a message.

Tips

• A password manager's master password is the one you need to remember and make strong. Three or four random unrelated words is both strong and memorable.
• Passkeys are replacing passwords on major services and are genuinely more secure — they can't be phished or reused. Enable them where offered.
• Your bank will never ask you to move money to a 'safe account'. That specific request is always a scam.
• If an account is compromised, change the password, sign out all sessions, check the recovery email and phone number haven't been altered, and review connected apps.

Common mistakes

• Reusing passwords — One breach anywhere exposes every account using that password. This is the mechanism behind most account takeovers.
• Securing everything except email — Email resets everything else. It has to be first.
• Not saving recovery codes — A lost phone with authenticator app and no recovery codes can mean permanent lockout.
• Trusting links in urgent messages — That's precisely what phishing is. Go to the site directly instead.

Questions people ask