Protect your accounts with a unique password for every site (a password manager makes this easy), long passphrases for the passwords you must remember, two-factor authentication on email, banking and social media, and passkeys where available. Never share codes sent to your phone, and keep recovery options up to date.
Why passwords get stolen
Most account takeovers do not involve clever hacking. They happen because people reuse passwords that leaked from another site, choose easy passwords, or are tricked into typing them on fake pages.
Rule 1: Unique passwords everywhere
If one site leaks your password and you reused it, attackers try it everywhere else. A password manager creates and stores strong, unique passwords for every account, so you only remember one master password.
Rule 2: Use passphrases
For passwords you must remember, such as your password manager or device, use a long passphrase of several random words. Length matters more than complexity.
Rule 3: Turn on two-factor authentication (2FA)
2FA adds a second step after your password, so a stolen password alone is not enough.
| Method | Security | Notes |
|---|---|---|
| Passkeys / security keys | Strongest | Resistant to phishing |
| Authenticator app codes | Strong | Recommended for most people |
| Push approval | Good | Never approve requests you did not start |
| SMS codes | Better than nothing | Vulnerable to SIM-swap fraud |
Enable 2FA first on email (it controls password resets), banking, social media and cloud storage.
Rule 4: Never share codes
Banks, platforms and support staff will not ask for your one-time codes. Anyone who asks is likely a scammer. This includes messages appearing to come from friends whose accounts have been taken over.
Passkeys
Passkeys let you sign in with your device's fingerprint, face or PIN instead of a password. They are designed to resist phishing. Use them where offered.
Recovery
Keep recovery email and phone numbers current, store backup codes safely, and know how to recover your accounts before you need to.
For children's accounts
Set up accounts together, use parental controls and family password managers, and teach children never to share passwords with friends. See our online safety guide for families.
Frequently asked questions
Are password managers safe?
Reputable password managers use strong encryption and are much safer than reusing passwords. Protect yours with a strong passphrase and 2FA.
How often should I change passwords?
Change them when there is a reason, such as a breach. Frequent forced changes often lead to weaker passwords.
What if my WhatsApp is hijacked?
Re-register your number, enable two-step verification with a PIN, warn contacts not to send money or codes, and report the issue to WhatsApp.
