Necessary knowledge: You do not need to memorise dozens of complicated passwords. You need a system that prevents one stolen password from unlocking several accounts.
1. Stop reusing passwords
Password reuse turns a breach at one service into a key for other services. Every important account should have a unique credential. The practical way to achieve that is a reputable password manager that can generate and store long random passwords.
2. Protect the password manager
Choose a strong master passphrase that you do not reuse elsewhere and enable multifactor authentication on the password-manager account. Keep its recovery information somewhere you can reach if your phone is lost, but not somewhere an intruder gains automatically with the same device.
3. Secure email first
Your main email account is often the recovery route for everything else. Give it a unique password and the strongest multifactor method it supports. Then protect financial, government, work, cloud-storage and social accounts.
4. Prefer stronger MFA
Any additional factor is generally better than password-only access, but methods differ. Security keys and passkeys are designed to resist phishing more effectively than codes that can be copied into a fake site. Authenticator apps are usually preferable to relying only on SMS when stronger methods are available.
5. Understand passkeys
A passkey uses public-key cryptography. The service stores a public key, while the private credential remains associated with your device or credential provider. You normally unlock it with the device PIN, fingerprint or face recognition. A passkey does not mean your biometric data is sent to every website; the local device uses it to authorise use of the credential.
6. Plan for failure
Store recovery codes securely, register more than one trusted authentication method where appropriate, and keep device recovery keys. Test that you understand the recovery process before an emergency. Never give a one-time code to someone who contacts you unexpectedly.
A sensible upgrade order
- Main email account.
- Password manager.
- Banking and payment services.
- Government and work accounts.
- Cloud storage and social media.
- Everything else as you next sign in.
The goal is not perfect security in one evening. It is to remove the dangerous single points of failure first and steadily replace reused passwords with unique credentials or passkeys.