Strengthen your sign-in

Start where a stolen password would hurt most

Your email account often receives password-reset messages for banking, shopping and cloud services. That makes it a sensible starting point, although a work or financial account may deserve equal attention. Open the service through a trusted bookmark or by entering its known address. Use its security settings rather than following a message that claims your account needs urgent protection.

Before making changes, check that the recovery email and phone number still belong to you. Review recent sign-ins and connected devices. An unfamiliar location is not proof of compromise because mobile networks and virtual private networks can affect location estimates. An unknown device or change you did not authorize deserves closer investigation through the provider’s official support guidance.

Replace reuse with a manageable system

A unique password limits the damage when another service exposes its sign-in database. Changing a few letters in the same base password is not meaningful separation. A reputable password manager can generate and store different passwords, reducing the need to remember them all. Choose a manager that supports your devices, publishes clear security information and explains export and recovery options.

Protect the manager with a long, unique master passphrase and supported multifactor authentication. Understand whether forgetting that passphrase could permanently block access. If you must create a memorable password, use several unrelated words and avoid quotations, personal facts or predictable substitutions. Follow the service’s length requirements. Do not change a strong, unique password merely to satisfy a personal calendar; change it when it may be exposed, reused or otherwise unsafe.

Choose the strongest practical method

Passkeys use cryptographic credentials associated with a service. Properly implemented passkey sign-in helps resist phishing because it is bound to the legitimate service rather than relying on a code you can type into an imitation site. Some passkeys sync through an account ecosystem; others remain on a particular device or security key. Check which model you are using before assuming a replacement phone will restore access.

When a service sends approval prompts, read the details rather than automatically accepting. Reject prompts you did not initiate. Repeated prompts can be an attempt to wear down your attention. Number matching helps reduce accidental approval, but it does not excuse approving an unexpected request.

Keep recovery separate from convenience

Save the provider’s backup codes in an access-controlled location that does not depend entirely on the phone being protected. A securely stored paper copy may work for some people; an encrypted backup may suit others. Consider who could physically or digitally reach either option. Never send a code to someone claiming to be support, and never store it in this website’s message tool.

Register a second security key if supported and practical. Test that the new sign-in method works before removing an older device. Do not deliberately lock yourself out to test recovery. Instead, review documented recovery steps and verify that the listed destinations are current. A family member can know where instructions are stored without being given unrestricted access to every account.

Finish with a short review

Remove obsolete app passwords, unused connected applications and devices you no longer control. Sign out unfamiliar sessions when the provider offers that function. Changing a password does not always invalidate every session or application token, so check those controls separately. Update your devices and browser as well: a stronger login cannot prevent malware from reading information after you have signed in.

For independent background, consult CISA’s password guidance, the FIDO Alliance’s passkey explanation and NIST’s digital identity guidance. Provider interfaces change, so use their current instructions for the exact setup sequence.