Strengthening Your Online Security

A friend of mine got hacked, and I helped them recover their account. Another had $30,000 wired out of their bank account without their permission. Those experiences made online security feel very personal.

Here are my notes on making your accounts harder to break into: use a different strong passphrase for every account, let a password manager handle the remembering, and turn on stronger sign-in protection. Where a service offers passkeys, consider using one. None of this guarantees that nothing will go wrong, but it gives you fewer weak spots to worry about.

Start with your email account. It is often where password-reset links for your other accounts arrive.

Check Whether Your Email Has Appeared in a Breach

You can check your email address at Have I Been Pwned. It lists known breaches that included that address and the kinds of information exposed. A clear result does not prove that an account is safe; it only means the address was not found in the breaches that service knows about.

If a password was exposed, change it on the affected account and anywhere else you reused it. Attackers try stolen logins on other sites, which is why sharing one password between accounts can turn one breach into several. Some password managers also flag reused or exposed passwords.

Use Strong, Unique Passphrases

A passphrase is a password made from several words. It can be easier to remember without being easy to guess, provided the words are chosen randomly.

• Make it long. Aim for at least 16 characters, and use more when the service allows it. A password manager can generate a longer password or a passphrase from randomly selected, unrelated words.
• Make it unpredictable. Avoid quotations, song lyrics, personal details and familiar sentences. Adding a capital letter or an exclamation mark does not rescue a predictable phrase. Do not copy a published example as your password.
• Make it unique. Every account needs its own password or passphrase. Changing just a number at the end is not enough.

CISA’s strong-password guidance emphasizes length, randomness and uniqueness. NIST’s current authentication guidelines require services following them to use a minimum of 15 characters for a password used on its own. They also reject mandatory character-mixing rules and routine password expiry without evidence of compromise. For your own accounts, a long, random, unique password is a better starting point than trying to make a short one look complicated.

Let a Password Manager Do the Remembering

You should not have to remember a different long password for every website. A password manager generates and stores them, then fills them in when you need them.

Apple’s Passwords app is one option if it fits the devices you use. Bitwarden is another option across devices. Choose a maintained manager that works with your phone, computer and browser, and learn how its recovery process works. Open-source code can be inspected, but that alone is not a guarantee of security.

Protect the manager itself with a strong, unique master passphrase where one is used, and enable its strongest available sign-in protection. Keep recovery information somewhere secure that you can reach without opening the vault. Start by replacing reused passwords on email, banking and other important accounts; you can work through the rest over time.

Choose Stronger Two-Factor Authentication

Two-factor authentication, or 2FA, asks for two different kinds of proof. These are something you know, such as a password; something you have, such as a security key or a phone holding an authenticator secret; and something you are, such as a fingerprint. A fingerprint is a biometric factor, not something you have. Two passwords do not make two factors.

Which 2FA Method Should You Use?

• FIDO security keys and passkeys: These can provide phishing-resistant sign-in because they check the website’s identity. Choose the FIDO/WebAuthn option when a service offers it; a hardware key used only to generate a one-time code does not provide the same protection.
• Authenticator app codes: These work without receiving a text message and avoid phone-number takeover risks. They can still be stolen by a fake login page, so enter them only on the service you intended to use.
• Push approvals: Approve only sign-ins you started. Number matching helps reduce accidental approvals, but it does not provide the same phishing resistance as FIDO sign-in.
• SMS codes: Use a stronger option when available. Text codes can be vulnerable to SIM swaps and interception, but they are generally better than leaving a password-only account without 2FA when SMS is the only option.

Start with email, your password manager and financial accounts, then add protection elsewhere. CISA explains how to turn on MFA, and 2FA Directory can help you find setup information for individual services.

Save a Way Back In

Save recovery codes securely before you need them. For important accounts, register a spare security key or another supported recovery method. Keep a way back in that does not depend entirely on the phone or account you might lose. Never give a login code or approve a sign-in because an unexpected caller asks you to.

Understand What Passkeys Change

A passkey lets you sign in without typing a shared password. Your device or password manager holds a private cryptographic key, while the service keeps the corresponding public key. You usually unlock the passkey with your device PIN, fingerprint or face. Your biometric information stays on your device.

Passkeys are tied to the service they were created for. A lookalike phishing website cannot use that passkey to sign in to the real site. A stolen database of public keys also does not give an attacker the private keys needed to log in. The FIDO Alliance’s guide to passkeys explains how this works.

Some passkeys sync through a provider; others stay on a particular device or hardware key. Before switching, check how you would sign in from another device or recover access if you lost this one. Protect the account that syncs your passkeys, too.

A passkey unlocked with a PIN or biometric can combine possession and user verification in one sign-in. It does not necessarily need a separate text code afterward. Follow the service’s setup instructions, and review any password or recovery methods that remain available. Passkeys reduce phishing risk; they do not protect an already stolen session or fix an infected device.

Your Five-Minute Security Checklist

Take five minutes to check your main email account. If a setup takes longer, finish that step before moving on.

1. Open security settings directly. Use the service’s app or type its address yourself. Check that the recovery email and phone number are yours.
2. Check the password. If it is weak or reused, replace it with a long, unique password generated by your password manager.
3. Strengthen sign-in. Add a passkey or FIDO security key if supported. Otherwise, enable an authenticator app, or the strongest available 2FA method.
4. Save recovery access. Store backup codes securely and check how you would get back in without your usual phone.
5. Review active sessions. Sign out devices you do not recognize. If you find suspicious activity, follow the service’s account-recovery instructions and review recent account changes.

A Few More Things Worth Doing

• Turn on automatic updates for your operating system, browser and apps. Restart when an update needs it.
• Ask your mobile carrier about a port-out PIN or number lock to help protect your phone number.
• If you are in the United States, read about freezing your credit and getting an IRS Identity Protection PIN. These address identity misuse beyond account sign-ins.
• Review account security settings and alerts. Keep passwords, recovery codes and private account records out of AI chats.

I know this can be complicated to set up. You do not have to fix every account in one sitting. Start with email, save your recovery information, and work outward. A little time spent now is easier than trying to get an account back later.