Account Protection: Password Managers, Security Keys & Best Practices
Your password isn't the wall keeping attackers out anymore, it's often the weakest point. Here's how to actually lock your accounts down.
Why Passwords Alone Aren't Enough
Most people manage passwords the same way: reuse a familiar one, tweak it slightly for "different" accounts, and hope for the best. That approach hasn't held up against how accounts actually get compromised today.
Password reuse
The average person reuses the same handful of passwords across dozens of accounts. If one site gets breached, attackers try that same password everywhere else, a technique called credential stuffing.
Weak, guessable passwords
"Password123" or a pet's name isn't a real barrier. Automated tools can test billions of common passwords and variations in minutes.
Data breaches happen constantly
Even careful companies get breached. You can't control that, but you can control whether one breached password gives an attacker access to your entire digital life.
Phishing steals passwords directly
As covered on our "Recognize Phishing" page, a convincing fake login page can capture your password the moment you type it in, no "hacking" required.
Password Managers: Your First Upgrade
A password manager is an encrypted vault that generates, stores, and autofills strong, unique passwords for every account you have. You only need to remember one master password; it handles the rest.
A unique password for every account
The password manager generates and remembers long, random passwords for each site, so one breach doesn't put every other account at risk.
Autofill that checks the real address
Unlike your memory, a password manager only fills in your credentials on the actual saved domain, so it won't autofill on a convincing fake login page.
One strong master password to remember
Instead of memorizing dozens of passwords, you remember one strong passphrase that unlocks an encrypted vault.
Secure sharing and storage
Most password managers also let you securely store and share things like Wi-Fi passwords, software licenses, or notes, and safely share specific items with family members.
Keeper Password Manager
Keeper is a solid choice for most people: strong encryption, an easy-to-use autofill experience across desktop and mobile, secure file storage, and support for hardware security keys as a second factor on your vault itself. It's a practical, no-fuss way to get every account onto a unique password without a steep learning curve.
Check Out Keeper →Bitwarden
A strong free/open-source option if you want to start at no cost.
1Password
Polished, family-friendly sharing features, subscription-based.
Multi-Factor Authentication (MFA): Your Second Layer
MFA means proving it's you with something beyond just a password, so a stolen password alone isn't enough to get in. Not all MFA is equally strong:
SMS codes
Better than nothing, but the weakest option. Phone numbers can be hijacked through SIM-swapping, and codes can be phished on a fake login page.
Authenticator apps
Apps like "2FA Authenticator (2FAS)" or "Microsoft Authenticator" generate time-based codes on your device. No SMS network involved, which removes the SIM-swap risk, though a convincing fake site can still trick you into typing the code in.
Hardware security keys
A physical device that proves it's really you, and confirms you're on the real website, not a look-alike. This is the strongest option available, and the only one that's resistant to phishing by design.
YubiKey (Yubico)
A small physical key that plugs into USB-C/USB-A or taps via NFC. It supports the FIDO2/WebAuthn standard, which cryptographically verifies you're on the real website. In English this means a fake login page simply won't work, even if it fools you visually. Widely supported by Google, Microsoft, major password managers (including Keeper), and most banks and social platforms.
Check Out YubiKey →Google Titan Key
Similar FIDO2 support, a solid alternative if you're deep in the Google ecosystem.
How to Set It Up
You don't need to overhaul everything in one sitting. Work through this in order:
Choose and set up your password manager
Install it on your phone and computer, and add its browser extension to securely save, generate, and autofill your passwords across your devices.
Start from the ground up
Secure your email account first, as it often provides access to password resets for other accounts, including banking and financial services. Use your password manager to generate and save a strong, unique password for each account. Work through the rest at your own pace—there’s no need to do it all in one sitting.
Enable MFA, prioritizing the same accounts
Your email account, banking, and your password manager itself should all have MFA enabled. Only use an authenticator app when the application or service does not support security keys or passkeys.
Protect your accounts with security keys wherever supported
Most major services (Google, Microsoft, banks, and many others) support hardware security keys. Register it as your primary method. Do yourself a favor, and do not set an authenticator app, let alone SMS, and email as recovery methods as these are not phishing-resistant.
Set up a backup
Get at least a second security key and register it as a backup, in case you lose the first one. Store your password manager's emergency recovery code somewhere safe and offline, like a locked physical vault, not a photo on your phone.
Good Online Hygiene: The Ongoing Habits
Tools do most of the heavy lifting, but a few habits keep everything working the way it should:
- Never reuse a password across more than one account, your password manager should be doing this work for you automatically.
- Use a long passphrase for your master password, something like four random words strung together is both stronger and easier to remember than a short, complex string.
- Enable MFA on every account that offers it, not just the important ones. Attackers often use a minor account as a stepping stone to a more valuable one.
- Review your account's active sessions and connected apps every few months, and revoke anything you don't recognize or no longer use.
- This may sound counterintuitive, but don’t set a recovery email or phone number on any account, and please dismiss those prompts. They exist for convenience, not security, since SMS and email recovery are common account-takeover paths. To avoid being locked out of your accounts, register at least two security keys or passkeys instead, or use an authenticator app if the service doesn’t support security keys yet. Be sure to back up your authenticator codes somewhere safe in case your phone is lost or stolen.
- Change the password immediately if a service notifies you of a breach, don't wait. Check if your email address is in a data breach here: 👉 Have I been Pwned?. Change the passwords for any services where your email has been found, and remember to use a unique password for each service.
- Be cautious with security questions, real answers to "mother's maiden name" are often publicly discoverable. This is a flawed design , and you should consider treating them like another password and storing a made-up answer in your password manager.
- Avoid saving passwords in your browser, even if it is a computer you own or control. When you click "Save" in a browser, your passwords are stored locally on your device, in other words a single point of failure is created (All eggs in one basket). If an attacker gains unauthorized access to your device or your browing profile, they instantly gain access to these critical files and your credentials.
Next: Learn to Spot the Scams Trying to Get Around All This
Strong accounts still need a sharp eye. See how phishing works and how to recognize it.
Some links on this page are affiliate links, including for Keeper and YubiKey. We only recommend tools we'd suggest to a friend or family member.