How to Protect Your Online Accounts: Passwords, 2FA and Passkeys

Most account takeovers start with a stolen or reused password. These four simple layers of protection stop the vast majority of attacks.

Email, banking, social media, shopping, health portals — most of our lives now sit behind online accounts. Criminals know it, and they constantly try stolen passwords from data breaches against popular sites. The good news is that a few simple habits block the overwhelming majority of these attacks. U.S. cybersecurity officials at CISA recommend four basics: strong passwords, a password manager, multi-factor authentication and keeping software updated.

1. Use a unique, strong password for every account

The biggest risk isn't a weak password — it's a reused one. When any website is breached, attackers try the leaked email and password combinations on banks, email providers and shopping sites. If you reuse passwords, one breach can unlock many of your accounts.

A strong password is:

• Long — at least 16 characters is a good target.
• Random — not based on names, birthdays, pets or sports teams.
• Unique — used for only one account.

A "passphrase" of four or five random unrelated words, such as copper-lantern-orbit-mango, is long, strong and easier to type than random characters.

2. Let a password manager do the remembering

No one can memorize dozens of unique passwords. A password manager creates strong passwords for you, stores them in an encrypted vault and fills them in automatically. You only need to remember one strong master password.

Options include the managers built into Apple devices (Passwords app and iCloud Keychain), Google Chrome and Android (Google Password Manager), and Microsoft Edge, as well as standalone apps such as 1Password, Bitwarden and others. Pick one, protect it with a strong master password and multi-factor authentication, and gradually replace your reused passwords, starting with your email and bank accounts.

3. Turn on multi-factor authentication (MFA)

Multi-factor authentication — also called two-factor authentication or 2FA — adds a second step when you sign in, so a stolen password alone isn't enough. Not all methods are equally strong. From strongest to weakest:

1. Passkeys or hardware security keys. These are resistant to phishing because they only work on the real website.
2. Authenticator apps such as Google Authenticator, Microsoft Authenticator or the code generator in your password manager. They create a new six-digit code every 30 seconds.
3. Push notifications asking you to approve a sign-in. Never approve a request you didn't start — attackers sometimes send many requests hoping you'll tap "Approve" to make them stop.
4. Text message (SMS) codes. Weaker than the options above, because of risks like SIM-swapping, but still far better than no MFA at all.

Look for MFA in each account's Security or Sign-in settings. When you turn it on, save the backup codes somewhere safe, such as your password manager, so you're not locked out if you lose your phone.

4. Switch to passkeys where you can

Passkeys are a newer way to sign in without a password at all. Instead of typing something that can be stolen or phished, you confirm your sign-in with your phone or computer's fingerprint, face recognition or screen lock PIN. Behind the scenes, your device uses cryptography to prove who you are, and the secret never leaves your device.

Passkeys are supported by Google, Apple, Microsoft, Amazon, PayPal and a growing list of other services. They sync across your devices through your password manager or your phone's ecosystem. When a site offers to create a passkey, it's usually worth saying yes.

5. Keep everything updated

Software updates fix security holes that attackers actively exploit. Turn on automatic updates for your phone, computer, browser and apps — and your Wi-Fi router.

Spotting phishing

Even strong security can be undone if you type your password into a fake site. Be suspicious of messages that create urgency ("your account will be closed today"), ask you to sign in via a link, or come from addresses that don't quite match the real company. Instead of clicking, go to the website or app directly. For more, see our guide on spotting fake news and misinformation online.

Check whether you've been in a breach

Many password managers will alert you if a saved password appears in a known data breach or is reused. If one does, change it right away — and turn on MFA for that account.