What you need
- List of important accounts
- Password manager you trust
- Access to recovery email and phone
- A few uninterrupted minutes
Every step
- 1
Start with your primary email
Secure the email account used to reset other passwords. Review its recovery options, active sessions, forwarding rules, and recent security activity.
- 2
Set a unique password
Use a reputable password manager to create and store a long, random password you do not reuse elsewhere.
- 3
Turn on multi-factor authentication
Enable multi-factor authentication in the account’s security settings. Prefer an authenticator app or security key when supported and practical.
- 4
Review recovery methods
Confirm recovery email addresses and phone numbers are current and controlled by you. Save backup codes in a secure place separate from the account.
- 5
Secure financial and work accounts
Repeat the process for banking, payment, shopping, social, and work accounts, starting with accounts that can reset other accounts.
- 6
Remove old access
Sign out devices you no longer use, revoke unfamiliar sessions and app permissions, and remove recovery methods you do not recognize.
- 7
Check for reuse
Use the password manager’s security check to find reused or weak passwords and replace them on the original sites.
- 8
Make it ongoing
Update recovery details when they change. Treat unexpected login links and urgent password requests as suspicious and visit the service directly.
Important warnings
- Never share one-time codes with a caller or message sender.
- A password manager cannot protect you if its master password or recovery account is compromised.
Finished when
Important accounts have unique passwords, multi-factor authentication where available, verified recovery methods, and no unknown active sessions.