Account security is often presented as a list of technical measures. In practice, it is closer to a small set of habits that, once adopted, protect everything connected to your digital identity. This article focuses on those habits, with the reasoning behind each so you can decide where to start.

Start With Passwords

Passwords remain the primary defence for most accounts, and they are also where most users have the weakest habits. Three principles matter more than the rest.

Use a unique password for every important account

Password reuse turns any single data breach into a multi-account problem. When one service is compromised, attackers immediately try the same credentials on banking, email, social media, and gaming platforms. A unique password means a breach on one site has no impact on any other.

Length beats complexity

A long passphrase — four or five unrelated words — is generally stronger than a short string of random characters, and much easier to remember. If you use a shorter password, mix character types. If you use a longer passphrase, the character variety matters less.

Change passwords when there is a reason

Routine rotation is no longer recommended by most security guidance, because it pushes users toward predictable patterns. Change a password when there is a specific reason: a suspected breach, a shared device, or a compromise somewhere else that used the same password.

Use a Password Manager

A password manager solves the practical problem that makes unique passwords hard: remembering dozens of them. The manager stores credentials encrypted behind one master password, and generates strong passwords on demand. You remember one thing instead of many.

When choosing one, prefer a well-known manager with a documented security model. Browsers are fine for convenience on a device you control, but a dedicated manager makes cross-device use and backups easier. Whichever you choose, secure the master password carefully and enable any two-step option the manager offers for itself.

Enable Two-Step Verification Where Offered

Two-step verification adds a second requirement beyond the password, usually a one-time code delivered by SMS, an authenticator app, or a hardware key. The value is that a stolen password alone becomes insufficient.

Prefer an authenticator app or a hardware key over SMS where both are available; SMS can be intercepted in some circumstances. Store the recovery codes the platform provides somewhere safe and separate from the device.

Spot Phishing Before It Works

Phishing is the practice of tricking users into revealing credentials by impersonating a legitimate service. It is the most common attack against individual users, and it relies on distraction and urgency rather than technical sophistication.

Warning signs are consistent: an unexpected message, a request to "verify" or "confirm" something urgently, a link to a page that asks for your password, and a domain that is close to but not identical to the real one. When in doubt, do not click. Reach the platform through a bookmark you made earlier and check whether any actual issue exists.

Keep the Device Healthy

Strong credentials are undermined by an infected device. A small amount of routine maintenance keeps this risk low.

  • Update the operating system. Updates fix security issues that attackers actively exploit.
  • Update the browser. Outdated browsers are a common source of compromise.
  • Avoid unofficial downloads. Third-party app mirrors and "modded" builds are a persistent source of malware.
  • Be selective with extensions. Extensions have broad access to your browsing. Install only ones you need, from sources you trust.
  • Review installed apps periodically. Remove anything you do not recognise or no longer use.

Public Wi-Fi and Shared Devices

Networks you do not control carry some inherent risk. Where sensitive actions are involved, prefer a network you trust. If public Wi-Fi is unavoidable, prefer networks with a password and consider a reputable VPN for the sensitive parts.

On shared devices, log out when you are finished, even if the site offers to remember you. On your own devices, staying logged in is a reasonable convenience; on anyone else's, it is a risk.

Plan for Recovery Before You Need It

Recovery is the part of account security people neglect until they need it. The time to set it up is now, while everything works.

  • Confirm the recovery email or mobile number associated with the account is current.
  • Understand how the platform handles a forgotten password.
  • Store that information somewhere you can access without relying on the account itself.
  • Keep any backup codes somewhere other than the device you normally use.

If You Suspect Compromise

  1. Change the password from a device you control.
  2. Log out of all sessions if the platform supports it.
  3. Review recent activity for anything unfamiliar.
  4. Enable two-step verification if it is not already on.
  5. Change the same password on any other account where it was used.
  6. Check for linked devices, email addresses, or payment methods you do not recognise.

The account security guide covers each of these areas in more depth, and the help page has a compromise-response sequence if you are working through this in real time.