DarkDeckBETA
Accounts and passwords
Most break-ins are not clever. They are a reused password or a stolen code. Fix those and you are ahead of most people.
- Your email account is the master key to everything else. Protect it first.
- One unique password per account, kept in a password manager.
- Turn on two-step sign-in with an authenticator app, a security key or a passkey, not text messages if you have the choice.
1. Start with your email
If someone controls your email, they can reset the password on almost everything else. So the email account gets the strongest protection you have: a long unique password, two-step sign-in, and a recovery option that you control.
2. Use a password manager
A password manager remembers a different long random password for every site, so you only remember one strong passphrase. Your phone or browser may already have a decent one built in. Pick one you trust, protect it with a strong passphrase and two-step sign-in, and let it generate passwords for you.
- Never reuse a password. When one site leaks, criminals try that same password everywhere.
- A long passphrase of four or more random words beats a short password full of symbols.
- Do not write passwords in notes, chats or emails to yourself.
3. Turn on two-step sign-in
Two-step sign-in means a stolen password is not enough. From strongest to weakest:
- Passkeys or a hardware security key. These cannot be tricked into working on a fake site.
- An authenticator app that gives a six-digit code.
- Text message codes. Better than nothing, but can be intercepted or hijacked. Use them only if nothing else is offered.
Save the recovery codes the site gives you somewhere safe and offline, such as printed and kept at home. Without them, losing your phone can lock you out for good.
4. Never share a code
A sign-in code is for you only. No genuine company, bank, platform or friend will ever ask you to read one out. If someone asks, it is a scam, even if they sound kind and professional.
5. Check whether you have been caught in a leak
You can check an email address for known leaks at haveibeenpwned.com. If it appears, change that password everywhere you used it.
6. Little habits that help
- Sign out on shared or borrowed devices, and never tick "remember me" there.
- Review which apps and sites have access to your accounts, and remove ones you do not use.
- Lock your phone and computer with a PIN or password. Use a long one, not 1234.
General guidance, kept up to date as best we can. It is not legal or professional advice.