Most account takeovers do not involve clever hacking. They happen because someone reused a password that was leaked in an unrelated data breach, and attackers simply tried that password on other sites. Two inexpensive habits, using a password manager and turning on two-factor authentication, prevent the majority of these problems.
Why reusing passwords is risky
When a website is breached, the stolen email and password pairs are often traded and used in automated attacks on popular services. If you used the same password for a game account, an email account and a shopping site, a leak at the weakest one exposes the others. Your email account is especially important, because it is typically used to reset the passwords for everything else.
What a password manager does
A password manager is an app that creates, stores and fills in strong, unique passwords for every site. You remember one strong master password, and the manager handles the rest. Because it can generate long random passwords such as a mix of letters, numbers and symbols, you no longer have to invent or memorize them. Most managers work across your phone, tablet and computer and fill in logins automatically, which is often faster than typing.
Good options include dedicated products from established companies and the built-in managers in major browsers and operating systems. Look for strong encryption, a clear security track record, independent audits where available, and a way to recover your account. The master password is the key to everything, so make it a long passphrase of several unrelated words and do not use it anywhere else.
Getting started without being overwhelmed
You do not have to change every password in one afternoon. Begin with your most important accounts: your main email, banking, and any account that stores payment details. Change them to unique generated passwords. Then, over the next weeks, update other accounts as you log in to them. Many managers also have a security check that flags weak, reused or exposed passwords so you can prioritize.
What two-factor authentication adds
Two-factor authentication, sometimes called two-step verification, requires a second proof of identity besides your password. Even if someone learns your password, they cannot get in without the second factor. Common types include codes sent by text message, codes generated by an authenticator app, push approvals on your phone and physical security keys.
Of these, authenticator apps and security keys are stronger than text messages, since phone numbers can be hijacked through a scam known as SIM swapping. Text messages are still much better than nothing, so turn on whichever your service offers if a stronger option is not available. Prioritize email, banking, social media, cloud storage and gaming platforms where you have purchases or valuable items.
Save your recovery options
When you enable two-factor authentication, services usually provide backup codes. Store these somewhere safe, such as in your password manager or printed and kept in a secure place, because losing your phone without them can lock you out. Also keep your recovery email and phone number up to date.
Watch out for phishing
No tool helps if you type your password into a fake website. Be wary of links in unexpected emails and messages, and check the web address carefully before signing in. A password manager helps here too, because it will normally refuse to fill in a password on a site whose address does not match. Never share verification codes with anyone; a genuine company will not ask for them.
The short version
Use a password manager so every account has a unique strong password, protect it with a long master passphrase, enable two-factor authentication on your important accounts, and keep your backup codes safe. These steps take an hour or two in total and protect you from the most common kinds of account theft.