Digital security
Passwords & Account Access: The Complete Starting Guide
Some links on this site may earn us a commission, at no cost to you. It never decides what we recommend. How we make money.
Almost everything in your digital life sits behind a login. The core of staying secure is simple: a password manager, a second factor on everything that offers one, and backups of your recovery info kept somewhere safe and offline.
Do those three first. The rest is about closing the gaps around them, mainly the email accounts and security questions that can get someone back into your accounts without a password.
The foundation
Use a password manager
1Password is the pick here. It combines your master password with a secret key, so a stolen master password alone isn’t enough, and everything is encrypted on your device before it syncs.
Our pick
The best mix of security and ease for most households, with family sharing and an emergency recovery kit built in.
Downside: Subscription only, with no free tier. If cost is the issue, Bitwarden has a free plan that covers the basics.
Whichever one you pick, save the recovery methods somewhere secure and offline, like a safe. If you lose access to the manager and have no recovery info, you can lose access to everything in it.
A dedicated manager is the more secure choice for most people. Protecting your vault is its only job, so it’s built around strong encryption, recovery and safe sharing, and it works across browsers and devices. Your browser’s built in autofill is far better than reusing passwords, but it’s often protected by little more than your device or browser sign-in. Anyone who gets into a signed in browser can reach everything saved in it.
What good looks like: client side encryption, a second secret beyond the master password, and recovery options you can store offline.
Make every password random, unique and long
Every site gets its own random password. Let the manager generate them, and use as many characters as the site will accept. You never have to remember them, so there’s no reason to make them short.
What good looks like: a built in generator, and the habit of using it for every new account.
Turn on MFA and back it up
Use MFA on every account that allows it. Prefer authenticator app codes over SMS or email, and use a hardware security key on your email, password manager and financial accounts.
Back up every MFA seed when you set it up, and keep those backups offline: a safe at home, plus a second copy at a trusted friend’s or family member’s house. Treat them like cash, and never leave a copy as a file, screenshot or email. Our guide to setting up MFA and backing it up covers each option, passkeys included, and how to store the backups.
What good looks like: an authenticator app that lets you back up your seeds, and two security keys for the accounts that matter most.
Protect the way back in
Use a dedicated email for sensitive accounts
A lot of the time, an account can be recovered or have its password reset if someone has the email account you signed up with. That makes your email the key to everything that relies on it.
For extra sensitive accounts like your bank, use a dedicated email address that you don’t use for anything else. That cuts the chance it gets phished or breached, which would otherwise open up every account tied to it.
What good looks like: an address used only for your most sensitive accounts, with a strong unique password and MFA.
Don’t use real answers for security questions
Don’t answer security questions with real personal information, since much of it can be found or guessed. Treat each answer like a password instead: make it random and save it in your password manager.
What good looks like: random answers stored in the manager, not true ones.
Spot trouble and tidy up
Watch for phishing
Never type a password into a site you reached from an email or text. Go to the site yourself or use a bookmark. Your password manager helps here, since it usually won’t fill a password on a lookalike address. If it doesn’t offer to fill, stop and check the address.
Signs to watch for: a manager that won’t offer to fill, and a browser bar address that’s slightly off.
Check for breaches
Check whether your email addresses show up in known breaches, for example with Have I Been Pwned, or use the breach alerts built into many password managers. If one does, change that password and turn on MFA.
What good looks like: alerts that tell you which account was affected so you can change it fast.
Delete accounts you don’t use
Every old account is a login that can be breached. Close the ones you no longer use. Your password manager’s list is a good place to find them.
Signs to watch for: old accounts in your manager you haven’t opened in years.
Plan for emergencies
If something happened to you, could someone you trust get into what they need? Check whether your manager offers an emergency access feature. At a minimum, tell a trusted person where your recovery info is kept.
What good looks like: a plan for getting trusted family into your accounts, written down and kept offline.