Set up two-factor authentication and a password manager
Most hacked accounts are not “hacked” at all. The password was reused from another site that leaked, or guessed, or typed into a fake page. Two habits fix most of this.
1. Use a different password for every account
If one site leaks your password and you used it everywhere, every account is exposed. Nobody can remember dozens of strong passwords, so use a password manager: an app that creates and remembers them for you, protected by one strong master password.
- Pick a reputable manager from a company you trust, and check reviews from independent sources.
- Make the master password a long phrase of several unrelated words that you have never used anywhere else. Length matters more than clever symbols. This matches current guidance from NIST, the US standards body.
- Start with the accounts that matter most: email, then banking and e-wallets, then social media.
2. Turn on two-factor authentication (2FA)
2FA asks for a second proof when you log in, so a stolen password alone is not enough. From strongest to weakest:
- Passkeys or a security key where the service supports them.
- An authenticator app that shows a changing code on your phone.
- SMS codes. Better than nothing, but SIM-swap and phishing attacks can get around them.
Turn it on for your email first. Your email can reset every other account, so protecting it protects everything.
Check whether a password has leaked
Have I Been Pwned lets you test a password against known breaches without revealing it. If one of yours appears, change it everywhere you used it. Never type a password you still use into a site you do not trust.
Keep these rules
- Never share an OTP or PIN, even with someone who sounds official (why).
- Save your recovery codes somewhere safe and offline.
- Log in only through the official app or a website address you typed yourself (how to spot phishing).
Last reviewed 17 Oct 2026.