How to Protect Your Online Accounts: Passwords, Passkeys and 2FA

Your email account is the master key to most of your online life. Whoever controls it can reset passwords for your bank, your shopping accounts and your social media. That is why account security is less about any single setting and more about a few habits that work together.

This guide follows the advice of three US government sources: CISA’s Secure Our World program, NIST’s digital identity guidelines and the FTC’s consumer advice. The steps apply wherever you live.

Start with your most important accounts

You do not need to fix everything in one evening. Prioritize the accounts that would hurt most if someone else got in:

1. Your main email account (it controls password resets)
2. Banking, payment and investment apps
3. Your password manager, once you have one
4. Phone carrier and cloud storage accounts
5. Social media and any account you use for work or business

If you run a website or online store, add your domain registrar, hosting and payment processor to that top tier. Our guide to building a website as a beginner explains why those logins matter.

Passwords: long, unique and stored in a manager

CISA’s password guidance recommends passwords of at least 16 characters, either random or a passphrase of four to seven unrelated words, and a different password for every account. Reuse is the real danger: when one site is breached, criminals try the same email and password on other services.

NIST’s SP 800-63B, which sets rules for how systems should handle passwords, has moved away from older habits. It tells services not to force mixtures of character types and not to require periodic password changes unless there is evidence of compromise. In other words, length and uniqueness matter more than swapping a letter for a symbol every 90 days.

Use a password manager

Nobody can remember dozens of long, unique passwords. A password manager generates them, stores them in an encrypted vault and fills them in for you, so you only remember one strong master passphrase. CISA describes it as one of the easiest ways to protect your accounts. Options include managers built into your browser or phone and standalone apps; pick one that works across all the devices you use.

A good password manager also protects you from fake sites, because it will not autofill your password on a lookalike domain. If it does not offer to fill, stop and check the address.

Passkeys: the password replacement

A passkey is a sign-in credential based on FIDO standards, as the FIDO Alliance explains. It is stored on your phone, computer, password manager or a hardware security key, and you unlock it the same way you unlock your device: with a fingerprint, face scan or PIN. There is no password to type, guess or reuse.

The big advantage is phishing resistance. NIST explains that methods like WebAuthn, the technology behind passkeys, tie the sign-in to the real website’s domain, so a fake site cannot capture something reusable. Codes you type by hand, by contrast, can be relayed by a convincing fake page.

Where a service offers passkeys, usually under security or sign-in settings, add one. Keep your existing password in your manager as a fallback until you are confident the passkey works on every device you use.

Multifactor authentication: choose the strongest option offered

Multifactor authentication (MFA), also called two-factor authentication or two-step verification, asks for a second proof after your password. The FTC calls it the best way to protect your accounts, and notes it is usually turned off by default, so you have to enable it yourself.

CISA’s MFA page recommends turning on MFA for every account that offers it. Use the strongest method each account supports, and never approve a prompt you did not trigger.

Tip: Nobody legitimate will ask you to read out or forward a verification code. If someone calls or texts asking for one, it is a scam, even if they claim to be your bank or a well-known company.

Recognize phishing before you click

Phishing is a message designed to trick you into handing over a password, code or payment details. The FTC’s phishing guide and CISA’s phishing page list common warning signs:

• Claims of suspicious activity, a login attempt or a problem with your account
• Urgent pressure to act now, often with a threat attached
• Requests to confirm personal or financial information
• An invoice you do not recognize or a link to make a payment
• Offers of refunds, prizes or free coupons
• Sender addresses or links that are slightly off, such as a misspelled brand name

Polished writing is no longer a sign of safety, since AI can produce flawless scam messages. If a message worries you, do not use its links or phone numbers. Go to the company’s site or app directly. Our guide to AI tools for productivity covers why you should also keep passwords and codes out of AI chats.

Save your recovery codes now

When you turn on MFA, many services show a set of one-time recovery codes. These get you back in if you lose your phone or security key. Without them, account recovery can take days or fail entirely.

• Save recovery codes in your password manager or print them and store them somewhere secure.
• Register a second factor where possible, such as a backup security key or a second device.
• Keep your recovery email and phone number up to date.
• Before replacing a phone, move your authenticator app and passkeys to the new device.

What to do after a breach

If a service tells you your data was exposed, or you suspect someone got into an account, work through this list:

1. Change the password on the affected account and anywhere you reused it.
2. Sign out of all sessions and review connected apps and devices in security settings.
3. Check account settings for changes an attacker might have made, like email forwarding rules or a new recovery number.
4. Turn on MFA if it was not already on, or upgrade to a stronger method.
5. Watch your financial accounts for charges you do not recognize.
6. Consider a credit freeze. In the US, the FTC’s identity theft guidance explains that a freeze with each of the three credit bureaus is free and blocks new credit accounts in your name. If your identity was misused, report it at IdentityTheft.gov for a personal recovery plan.

Keep everything updated

The last of CISA’s four basics is updating software. Updates fix security flaws that criminals exploit, so turn on automatic updates for your phone, computer, browser and apps. At iDevsa.com we treat this as part of the same routine: unique passwords, passkeys where possible, strong MFA, saved recovery codes and updated devices. Set them up once and most attacks have far less to work with. For more free security and productivity tools, see our useful online resources guide.