Step-by-step guides · security
How to store your passwords safely
Why reusing passwords is the mistake that opens the most accounts, and the simple system to stop doing it, starting with your email.
Text drafted with artificial intelligence. The topic, the angle and the final review are Ibrahin's. How AI is used here
What has happened
Every time a website suffers a breach, its passwords end up on lists that are tried automatically on other services: email, banks, shops. If you use the same password in several places, the weakest one failing is enough for them to get into the rest.
Why it matters to you
There is no such thing as a password “just for unimportant sites”: that shop you bought from once may have the same password as your email, and your email can reset almost every other account. Memorising twenty different passwords isn't realistic; that's why you need a system.
What you can do
1. Protect your main email first
- Change the password if you have used it anywhere else.
- Turn on two-step verification.
- Check the recovery phone numbers and emails.
- Sign out of sessions and devices you don't recognise.
- Look for forwarding rules you didn't create.
Always do it from the official website or app, never from a link that arrives in a message.
2. Use a password manager
It can be the one built into your phone or browser, or a separate app. What matters is that it creates a different password for each site, that you understand how to recover it if you lose your phone, and that you can export your data if you switch. You only have to learn one: the master password.
3. Create a long, unique master password
A phrase of several words you can remember works better than a short password full of symbols. Don't use it anywhere else, don't paste it into a chat, and keep a protected recovery copy away from your phone.
4. Change accounts in order, not all at once
- main email;
- bank and payments;
- Apple, Google or Microsoft;
- social media and messaging;
- shopping, work and storage;
- the rest.
For each one: a new password generated by the manager, two-step verification, and sign out of sessions you don't recognise.
5. Add a second barrier
Two-step verification stops anyone who already has your password. An authenticator app or a physical security key both work; and where the service allows it, passkeys replace the password altogether. Keep the recovery codes off your phone and never read a code out to anyone: real support never asks for it.
The recommendation
Today, just three accounts: email, bank, and the one that holds your photos or documents. New password in the manager, two-step verification, and check you know how to recover them. The rest, five at a time.
Sources
- Three random words — NCSC
- Setting up 2-Step Verification — NCSC
- Use passkeys to sign in on iPhone — Apple
Related
Review
Responsible for publication: Ibrahin. Date: 2026-09-02. Last checked: 2026-09-02.
Where to buy it
Paid links. They open an Amazon search using this guide's criteria. If you buy something after following one, Ibrahin earns a commission and you pay the same price.
As an Amazon Associate, I earn from qualifying purchases. It is optional: an authenticator app also works as the second step. Before buying, check that your services accept security keys, and register another sign-in method in case you lose it. No specific model is linked because none has been tested here.
How this recommendation was made
Amazon search checked on 9 October 2026: it shows FIDO2 keys from brands such as Yubico or Thetis. Prices change without notice: check before buying.
This guide contains paid Amazon links, marked as such. If you buy after following one, Ibrahin earns a commission and you pay the same price. No recommendation in this text depends on that commission.