Keeping an online account secure does not require advanced cybersecurity knowledge. A few habits—using unique passwords, turning on strong forms of two-factor authentication (2FA), protecting recovery methods, and keeping devices updated—can substantially improve everyday security.
This US guide explains account security basics for email, social media, banking, shopping, cloud storage, work, and other online accounts. It also covers what to do if you suspect someone has accessed an account. The goal is practical prevention and recovery, not a guarantee that an account can never be compromised.
Menu names and security features can change over time, so use the search function in your device or account settings when the exact wording differs from the examples below.
Quick takeaways
- Give every important account a unique password. A password manager can make this practical.
- Use long passwords or automatically generated passwords rather than relying on clever substitutions such as
P@ssw0rd. - Enable two-factor authentication whenever it is available; an authenticator app, security key, or passkey is generally preferable to SMS when supported.
- Consider passkeys, which can provide strong protection against phishing when implemented correctly.
- Secure your email first because it is often the recovery path for many other accounts.
- Keep recovery email addresses and phone numbers current, and securely store backup or recovery codes.
- Never give an unexpected caller or message sender your password, 2FA code, or recovery code.
- If you suspect account takeover, use the provider’s official recovery process, review active sessions, and protect connected accounts.
What Does Account Security Actually Mean?
Account security is the collection of safeguards that helps ensure that you—and people or services you have deliberately authorized—can access an online account while unauthorized people cannot.
There are several pieces to this. Your password or passkey helps prove your identity. Two-factor authentication adds another check. Recovery options provide a way back in if you lose access. Security notifications can alert you to important changes. The security of your email account and devices matters, too, because they can be used to reset other accounts.
No individual safeguard is perfect. Good security works in layers.
For example, suppose someone learns the password to an online account. If that account also requires a second factor that the other person does not possess, the password alone may not be enough to sign in. If the password is also unique, exposure of that password does not directly expose accounts where you use different credentials.
That is why the most useful account security basics work together.
1. Start With Strong, Unique Passwords
A strong password should be difficult for someone else to guess and resistant to automated guessing. Just as important, it should not be reused across different services.
Why unique passwords matter
Password reuse creates a chain reaction. Imagine that you use the same password for an email account, a shopping website, and a streaming service. If credentials from one service are exposed, criminals may try the same username and password on unrelated sites. This practice is commonly called credential stuffing.
A unique password for each account limits that problem. A password disclosed from one service does not automatically provide the password to another.
Prioritize uniqueness especially for:
- Your primary email account
- Financial accounts
- Apple, Google, or Microsoft accounts tied to your devices
- Cloud storage
- Social media accounts
- Mobile carrier accounts
- Work or school accounts
- Tax, government, and healthcare portals
Strong password tips
NIST’s current digital identity guidance emphasizes password length and recommends allowing long passwords rather than imposing arbitrary complexity rules. For consumers, the simplest approach is usually to let a reputable password manager generate and store long, random, unique passwords.
Where you need to create something memorable, length is valuable. A long passphrase made from several unrelated words can be easier to remember than a short password containing predictable substitutions.
Avoid passwords based on information another person could easily know or discover, such as your name, birthday, address, favorite team, pet’s name, or combinations like Summer2026!.
Also avoid small variations on one password. Changing Example1! to Example2! on another website is not meaningful password separation.
How long should a password be?
Specific service requirements vary. As a practical rule, use long passwords and take advantage of the full length a service permits. NIST’s current guidance requires verifiers using passwords as a single authentication factor to require a minimum of 15 characters, while passwords used as part of multifactor authentication may have a shorter minimum.
You do not need to count characters manually when using a password manager. Have it generate a long random password that meets the website’s requirements.
2. Use a Password Manager
Remembering dozens of genuinely unique passwords is unrealistic for many people. A password manager solves much of that problem.
Password managers store credentials in an encrypted vault and can generate random passwords for new accounts. Modern browsers and major operating systems also provide built-in password-management capabilities.
A password manager can help you:
- Create unique passwords without memorizing each one.
- Recognize the correct website before filling credentials.
- Identify reused or weak passwords using built-in security checks.
- Sync passwords across your authorized devices, depending on the product.
- Reduce the temptation to use one favorite password everywhere.
Protect the password manager itself carefully. If it uses a master password, choose a strong, unique one and do not reuse it anywhere else. Enable multifactor authentication for the password-manager account when offered, and understand its recovery process before you need it.
Are browser password managers safe?
For typical consumers, using the reputable password manager built into a modern browser or operating system is generally preferable to reusing passwords or keeping weak passwords just because they are easy to remember.
Dedicated password managers may offer additional sharing, administration, or cross-platform features. The right option depends on which devices you use and your needs. Whatever you choose, keep the software and devices receiving your passwords updated.
3. Enable Two-Factor Authentication
Two-factor authentication requires another authentication method in addition to—or in some modern designs instead of—a password. You may also see the terms 2FA, two-step verification, multifactor authentication, or MFA.
Common methods include authenticator apps, physical security keys, device prompts, and one-time codes sent by text message.
How common authentication methods compare
| Method | How it works | Practical guidance |
|---|---|---|
| Password only | You enter a password | Better when long and unique, but add 2FA when available |
| SMS/text code | A code is sent to your phone number | Better than password-only protection in many situations, but has limitations |
| Authenticator app | An app generates a temporary code | Generally stronger than SMS against several common threats |
| Push approval | A trusted app/device asks you to approve access | Convenient; only approve sign-ins you initiated |
| Security key | A physical device authenticates you to the legitimate service | Strong option with phishing-resistant implementations |
| Passkey | Uses cryptographic credentials tied to a device/account | Strong and generally phishing-resistant |
| Recovery code | A pre-generated emergency code restores access | Store securely; do not use as your everyday login method |
Which 2FA method should you choose?
When a service provides several choices, CISA encourages phishing-resistant MFA, such as FIDO/WebAuthn-based security keys, where available.
Passkeys can also provide phishing-resistant authentication. They use public-key cryptography rather than sending a reusable password to a website.
Authenticator apps are another useful choice. SMS 2FA still provides an additional layer over a password alone, but text messages rely partly on the security of your phone number and carrier account. When stronger options are available and practical for you, consider using them.
The important point is that 2FA reduces risk; it does not eliminate it. Scammers may try to convince people to disclose one-time codes or approve unexpected login requests.
Step by step: enable two-factor authentication
The precise menus differ by provider, but the general process is:
- Sign in by navigating directly to the service’s official website or opening its official app.
- Open Account, Profile, or Settings.
- Find Security, Sign-in, Login Security, Two-Step Verification, 2FA, or MFA.
- Review the authentication methods the provider supports.
- Choose a strong option you can reliably use. Prefer a passkey or phishing-resistant security key when appropriate and supported; an authenticator app is also a useful option.
- Follow the provider’s setup instructions and verify the new method.
- If backup codes are provided, save them somewhere secure.
- Add a second backup method if the provider permits it.
- Review the recovery phone number and email address.
- Sign out and confirm that you understand how to sign in again before changing additional settings.
Do not send backup or one-time authentication codes to another person. A legitimate code may grant access even if it expires quickly.
4. Understand Passkeys
Passkeys are increasingly available from major operating systems, browsers, and online services.
A passkey replaces a traditional shared secret with cryptographic credentials. The private portion remains protected by your device or credential provider, while the service receives information it can use to verify authentication.
In normal use, you might unlock a passkey using your device PIN, fingerprint, or facial recognition. That biometric data is generally used locally to unlock the credential rather than being sent to the website as a password.
Why passkeys can improve security
A major advantage is phishing resistance. Passkeys are designed to work with the service for which they were created. That makes them much harder to trick a person into entering on an imitation sign-in page.
They also eliminate password reuse for accounts where a passkey replaces the password.
Passkeys do require some planning. Understand how your passkeys synchronize or transfer among your devices, what happens when you replace a phone or computer, and what recovery options the account offers.
5. Protect Your Email Account First
For many people, email is effectively the master recovery account for their digital life.
Think about what happens when you click “Forgot password” on a website: the service often sends a reset link to your email address. Someone controlling your email may therefore be able to request resets for other accounts.
Your primary email deserves especially strong safeguards:
- Use a unique password or passkey.
- Enable the strongest practical MFA option available.
- Verify your recovery email and phone information.
- Store backup codes safely.
- Review signed-in devices and sessions periodically.
- Review unexpected security notifications promptly.
- Check that account recovery methods belong to you.
Some email providers also let you review forwarding rules and connected third-party applications. If you suspect unauthorized access, checking those settings can be worthwhile because an unfamiliar rule or connection may continue providing access to account information.
6. Build an Account Recovery Plan Before You Need It
Recovery settings are easy to ignore while everything works. They become critical after a phone is lost, a device fails, or an account password is forgotten.
A basic account recovery checklist looks like this:
| Recovery item | What to check | Good practice |
|---|---|---|
| Recovery email | Can you still access it? | Keep it secured and current |
| Recovery phone | Is the number still yours? | Update it when your number changes |
| Backup codes | Do you have current codes? | Store them somewhere private and secure |
| Trusted devices | Do you recognize them? | Remove devices you no longer own |
| 2FA backup | Is there another approved method? | Configure one where the service supports it |
| Passkeys/security keys | Can you recover after losing a device? | Understand provider recovery before relying on one device |
| Account details | Could you find the official recovery page? | Know where to get legitimate support |
Avoid storing the only copy of an essential recovery code inside an account that the code is supposed to recover.
For example, if a code is needed to recover your email account, keeping your only copy in that same email inbox may not help when you are locked out.
7. Security Questions Best Practices
Some older accounts and financial services still use security questions, although modern authentication increasingly relies on stronger methods.
Traditional questions such as “What is your mother’s maiden name?” can be weak because answers may be publicly available, discoverable, or known to acquaintances. The FTC has warned consumers about the security risks of information shared publicly and the importance of protecting personal information used for authentication.
Where a provider requires security questions, follow these security questions best practices:
- Pick questions whose answers are not readily discoverable.
- Avoid information you routinely post publicly.
- Treat the answers like passwords and keep them private.
- If the service allows answers that do not have to be literally true, a password manager can store unique, random answers. Be consistent about capitalization and spelling because recovery systems may require the exact stored response.
- Do not rely on security questions as your only protection when stronger authentication is available.
Never provide security-question answers in response to an unexpected email, text, or phone call.
8. Secure the Devices You Use to Access Accounts
Strong credentials are only part of account security. Phones and computers hold active sessions, email, saved passwords, passkeys, and other sensitive information.
Use a screen lock on your phone, tablet, and computer. Install operating-system, browser, and important app security updates rather than postponing them indefinitely. Automatic updates are useful for most consumers.
iPhone and iPad
Apple periodically changes menu layouts. In Settings, search for terms such as “Passwords,” “Passcode,” or your Apple Account security settings.
Check that your device has a strong passcode, review devices associated with your account, and use Apple’s available account security and recovery features. Apple also provides Security Check for reviewing certain sharing and access settings.
Android
Settings differ among Android phone manufacturers. Use Settings search for “Passwords,” “Security,” “Passkeys,” “Screen lock,” or “Google Account.”
Google’s Security Checkup can help review signed-in devices, authentication options, and other important account settings.
Windows
Search Windows Settings for “Sign-in options,” “Windows Hello,” “Accounts,” and “Windows Update.” Configure an appropriate device sign-in method and keep Windows and applications updated.
If you use a Microsoft account, review its online security settings as well as local PC settings.
macOS
Search System Settings for “Passwords,” “Touch ID & Password,” “Login Password,” or your Apple Account. Review associated devices and recovery options, and install macOS security updates.
Device menu names can differ by operating-system release. When in doubt, use the operating system’s built-in Settings search or the vendor’s official support documentation.
9. Learn to Recognize Unexpected Login Requests
Many account attacks rely on persuasion rather than technical sophistication.
Be cautious when an unexpected email, text, direct message, popup, or phone call tells you that you must immediately “verify” an account. A message may also claim that a purchase occurred or that an account will be closed unless you act.
Do not rely on links or phone numbers inside a suspicious message to verify the claim. Instead, open the service’s official app, use a saved bookmark, or type a known official address yourself.
If a legitimate security notification is waiting, you can usually see it from the account or application.
Never share authentication codes casually
A one-time code can be as sensitive as a password while it remains valid.
If you receive an authentication code you did not request, do not give it to anyone who contacts you asking for it. An unexpected code does not necessarily prove someone has accessed the account; for example, another user could have entered the wrong phone number. It does justify checking the account through official channels if you are concerned.
Similarly, never approve a login prompt you did not initiate.
10. Protect Your Phone Number and Mobile Account
Phone numbers are often used for password resets and SMS authentication, making your carrier account part of your security setup.
Major US carriers offer security controls that may include account PINs, number-transfer protections, or additional authentication. Names and availability vary, so review the security section of your carrier’s official website or app.
Use a unique carrier-account password and protect the carrier account with available authentication features.
If your phone unexpectedly loses cellular service, there are many possible explanations, including ordinary network or device problems. If the loss of service is unexplained and accompanies unexpected account changes, contact your carrier through an official channel to check your account status.
11. How to Help Prevent Account Takeover
“Account takeover” generally means an unauthorized person gains control of or meaningful access to an account.
There is no single setting that can prevent every incident, but layered controls can significantly reduce your exposure.
A practical order of operations is:
- Secure your primary email.
- Replace reused passwords with unique ones, starting with your highest-value accounts.
- Enable 2FA or passkeys.
- Secure your password manager.
- Update recovery information.
- Protect your mobile carrier account.
- Remove unknown or obsolete devices and connected applications.
- Turn on useful account security notifications.
- Keep devices and browsers updated.
- Be cautious with unexpected requests for credentials or authentication codes.
You do not have to overhaul every low-priority account in one afternoon. Start with the accounts that can recover, access, or pay for other services.
12. What to Do If You Suspect an Account Was Accessed
Signs may include an unfamiliar sign-in notification, password or recovery details changing without your action, messages you did not send, purchases you do not recognize, or devices you do not recognize in an account’s security history.
A single notification is not always proof of compromise. Verify through the provider’s official app or website.
Defensive account recovery steps
If you still have access:
- Open the provider’s official app or website directly, preferably from a device you trust.
- Review security notifications and recent activity where available.
- Change the account password if appropriate, making the new password unique.
- Enable or reconfigure 2FA using the provider’s official controls.
- Review recovery email addresses and phone numbers.
- Review signed-in devices or sessions, removing unfamiliar access where the service allows.
- Review passkeys, security keys, connected apps, and other authentication methods.
- For email accounts, review forwarding and filtering settings for changes you did not make.
- Secure your primary email account and any other account where the same password was reused.
- Follow the provider’s official recovery or compromised-account guidance for additional steps.
If you cannot sign in, use the provider’s official account-recovery page. Avoid people or websites claiming they can “hack back” into an account or bypass the provider’s recovery system.
If money or payment details are involved, contact the relevant bank, credit union, card issuer, or payment provider using a trusted number or its official application.
13. Common Mistakes to Avoid
Common problems are often easier to fix than people expect. Avoid using the same password for multiple important accounts, keeping an old recovery phone number after changing numbers, or storing the only copy of recovery information inside the account it is meant to recover.
Do not approve unexpected push notifications just to make them disappear. Do not read a one-time code to someone who unexpectedly calls or messages you, even if the person claims to represent a familiar company.
Avoid changing passwords constantly without a reason if that practice leads to predictable variations. Current NIST guidance does not recommend requiring periodic password changes unless there is evidence that a password has been compromised. Unique, sufficiently long passwords combined with appropriate MFA are more useful than repeatedly changing Example1! to Example2!.
Also be cautious about assuming that a padlock icon or HTTPS alone means a website is trustworthy. HTTPS protects the connection to a site; deceptive sites can use HTTPS too. Password managers and passkeys can provide additional protection because they are associated with specific sites.
Finally, do not neglect recovery. A highly secure account that you cannot recover after losing a device can create its own problems.
14. Make Account Security Easier to Maintain
Security measures are most effective when they are sustainable.
Choose a password manager you are comfortable using on your regular devices. Save recovery information securely as soon as you enable 2FA. Review account-security settings after changing a phone number or primary email address.
It is also useful to review critical accounts periodically, especially your email, financial, device-platform, and mobile carrier accounts. You do not need to obsessively inspect every login. The objective is simply to notice outdated recovery information or devices you no longer use.
For families, consider recovery planning as well. Depending on your circumstances, make sure trusted family members know how to find essential information in an emergency without broadly sharing everyday passwords.
FAQ
Is a long password better than a complicated password?
Length is an important part of password strength. A long, unique password generated by a password manager is generally a strong choice. Predictable complexity tricks—such as replacing an “a” with @—do not turn a common password into a strong one.
More important, do not reuse the password on another account.
Should I change all my passwords every few months?
Routine password changes are generally unnecessary without evidence of compromise. NIST advises against requiring arbitrary periodic password changes.
Change a password when you have reason to believe it was compromised, when a provider instructs you to after a relevant security event, or when you discover that you reused it elsewhere.
Should I enable two-factor authentication even if I have a strong password?
Yes, particularly for important accounts. A second authentication factor can help protect an account if a password becomes known to someone else. When available, consider phishing-resistant methods such as passkeys or FIDO-based security keys.
Is SMS 2FA worth using?
SMS has weaknesses and is not usually the strongest available MFA method. However, for many consumer accounts, SMS-based verification can provide additional protection compared with relying on a password alone.
If a service supports a practical phishing-resistant method, consider that instead. Your available choices will vary by provider.
What is the difference between a password and a passkey?
A password is a secret you send to a service during authentication. A passkey uses public-key cryptography, with the private credential protected by your device or credential provider.
Passkeys can provide substantial resistance to phishing and eliminate the need to remember a password for accounts configured to use them.
What happens if I lose my phone with my authenticator app?
Recovery depends on the authenticator and account configuration. Some authenticator services support secure synchronization, while others rely on another device, account-recovery options, or backup codes.
Before losing access, save any provider-issued recovery codes securely and configure an appropriate backup authentication method when available.
Should I write down passwords or recovery codes?
A carefully protected physical copy can be preferable to losing the only recovery method or reusing a weak password. The appropriate storage choice depends on your circumstances.
Keep sensitive records somewhere private and secure rather than on a monitor, in an unprotected wallet, or in another place easily accessed by others. A password manager is generally a more convenient place for everyday passwords.
What should I do if I receive a 2FA code I did not request?
Do not share the code or approve a corresponding login request. Access the account independently through its official app or website and review relevant security activity.
An unsolicited code alone does not prove that your account was compromised. Someone may have entered information incorrectly, or an attempted login may have been blocked by the second factor.
Can security questions keep an account secure?
They are generally weaker than modern authentication methods because answers may be guessed, researched, or known by other people. When security questions are required, choose information that is not readily discoverable and store exact answers securely.
Use stronger 2FA or passkey options when the provider offers them.
How can I tell whether an account-security email is legitimate?
Instead of deciding based solely on how the email looks, verify the issue independently. Open the company’s official app or navigate to its known website without using the email’s link.
Remember that sender names, logos, urgency, and professional-looking formatting are not reliable proof that a message is genuine.
When to Get Extra Help
Contact the account provider through its official support or account-recovery channels if you cannot regain access, security details were changed without your permission, or unfamiliar activity continues after you secure the account.
Contact your bank, credit union, card issuer, or payment provider promptly through an official number or app if you notice financial transactions you do not recognize. If a mobile number or carrier account may have been changed without authorization, contact your mobile carrier using its verified support channel.
For identity theft in the United States, IdentityTheft.gov, operated by the Federal Trade Commission, provides official information and a personalized recovery process. This article provides general cybersecurity information rather than legal or financial advice.
If circumstances involve immediate danger or threats to personal safety, contact the appropriate local authorities or emergency services. Cases involving stalking, domestic abuse, or other sensitive safety issues may require a different approach to device and account changes; changing settings can sometimes alert another person who has access.
Conclusion: Your Account Security Checklist
Good account security basics are mostly about preventing one problem from spreading into another. You do not need perfect security; you need practical layers that make unauthorized access less likely and recovery more manageable.
Use this short checklist:
- Secure your primary email with a unique password or passkey and MFA.
- Replace reused passwords with unique credentials stored in a password manager.
- Enable two-factor authentication on important accounts.
- Prefer phishing-resistant authentication when it is available and practical.
- Keep recovery email addresses and phone numbers current.
- Securely store backup codes.
- Review devices and account activity when something seems unusual.
- Keep phones, computers, browsers, and important apps updated.
- Treat passwords, one-time codes, and recovery codes as sensitive information.