TL;DR Checklist
Quick Actions
- • Run the security audit workspace for your main email.
- • Generate a fresh passphrase with the passphrase tool.
- • Enable hardware key + TOTP on your primary email provider.
- • Schedule a quarterly security review reminder.
Step-by-step plan
~45 minutes to completeCentralize and generate
Install a trusted password manager, turn on biometric unlock, and import existing passwords from browsers. Replace weak or reused passwords with 16–24 character generator outputs.
- Use passphrases for long-lived accounts (bank, email) and random passwords elsewhere.
- Store Wi‑Fi and device unlock codes in a shared vault if applicable.
- Turn on clipboard clearing and auto-lock on short idle timers.
Enable multi-factor authentication
Start with email, banking, and cloud storage. Prefer hardware keys (FIDO2/WebAuthn) with TOTP fallbacks; avoid SMS when possible.
- Generate and store backup codes offline; add a secondary device.
- Document recovery paths for travel (eSIM, roaming, or backup phone).
- Test login on desktop and mobile to confirm MFA works before logging out.
Monitor and rotate
Subscribe to breach monitoring alerts and prioritize rotation by risk: email → finance → social → everything else.
- Use unique aliases for newsletters and promotions to contain exposure.
- Rotate secrets immediately after a confirmed breach or password reuse finding.
- Remove dormant accounts or downgrade permissions you no longer need.
Secure devices and browsers
Update OS, browsers, and extensions; enable disk encryption and screen lock with biometrics.
- Use separate browser profiles for work and personal to limit cookie bleed.
- Restrict auto-fill on sensitive sites; disable form capture in incognito.
- Review extension permissions quarterly; remove rarely used add-ons.
Password hygiene audit
Use this quick audit to prioritize fixes. Score yourself 0–3 for each row (0 = needs work, 3 = excellent). Anything under 12 overall: schedule a refresh this week.
| Area | What good looks like | Score (0-3) |
|---|---|---|
| Uniqueness | No reuse; random or passphrase for every site. | __ |
| MFA coverage | TOTP/hardware keys on all critical accounts. | __ |
| Breach response | HIBP monitoring and 24h rotation for exposures. | __ |
| Device hygiene | OS/browser updates automatic; disk encrypted. | __ |
| Backups & recovery | Backup codes offline; recovery contacts verified. | __ |
Tip: save this table as a PDF and revisit quarterly. Keep recovery info off-device to avoid loss during resets.
Threat cues to watch
- Unfamiliar MFA prompts: decline unexpected pushes; rotate passwords immediately.
- Login alerts at odd hours: verify IP/location, revoke sessions, rotate secrets.
- Password manager lockouts: confirm device integrity; enable offline vault access.
- Email forwarding rules: review filters/forwards after any breach.
If you suspect compromise
- Disconnect from public Wi‑Fi; move to a trusted network.
- Change the master password/passphrase first.
- Rotate email and bank credentials next, then everything else.
- Revoke active sessions and reset app passwords.
Frequently asked questions
Last updated: March 2025How long should a strong password be?
Use 16–24 characters for most sites. For high-value accounts, prefer a 4–6 word passphrase from a trusted generator with separators and mixed case.
Is it safe to store passwords in the cloud?
Use a zero-knowledge password manager that encrypts locally before sync. Enable offline vault access and multi-device sign-in approvals to reduce risk.
What should I do after a breach alert?
Change the exposed password immediately, enable MFA if not already, revoke active sessions, and review forwarding rules. If reused elsewhere, rotate those too.
Can I reuse passphrases?
No—reuse creates a single point of failure. Use unique passphrases per account; password managers remove the friction of remembering them.
Keep improving with our tools
Test your passwords, generate stronger ones, and audit your vault in minutes.