Stop Reusing Passwords: Simple Fixes for Better Security

Add a second verification step to your important accounts to prevent unauthorized access.

1. 1
   Check which accounts support 2FA — Go to security settings in your email, bank, social media, and shopping accounts. Look for 'two-factor authentication' or '2FA'.
2. 2
   Use an authenticator app — Download Google Authenticator or Authy. It's more secure than SMS codes, which can be intercepted.
3. 3
   Scan the QR codes — For each account, scan the QR code with your authenticator app. Save the backup codes in a secure place—not in your email.
4. 4
   Test the setup — Log out and log back in to confirm it works. You'll enter your password, then the code from the app.

Identify and change passwords you've reused across multiple sites to reduce breach risks.

1. 1
   Use a breach checker tool — Go to HaveIBeenPwned.com and enter your email. It shows which breaches your data appeared in.
2. 2
   List your most-used passwords — Write down the 5-10 passwords you use most often. Be honest—this is for your eyes only.
3. 3
   Check for reuse in your password manager — If you have one, use its 'security audit' feature to flag duplicate or weak passwords.
4. 4
   Change reused passwords immediately — Start with accounts that showed up in breaches. Generate new, unique passwords using your manager.
5. 5
   Monitor high-risk accounts — Set up alerts for logins on email and banking. Change passwords every 6 months for these.
6. 6
   Delete old accounts you don't use — Close accounts on sites you've forgotten about—they're still vulnerable if breached.

Use random words instead of complex characters for passwords you need to remember occasionally.

1. 1
   Pick four random words — Choose unrelated words like 'elephant coffee rocket blanket'. Avoid common phrases or personal info.
2. 2
   Add a number and symbol — Insert them randomly, e.g., 'elephant!7coffee rocket blanket'. This increases complexity without making it hard to recall.
3. 3
   Use it for low-risk accounts — Apply this to sites where you might need to type the password manually, like a streaming service on a smart TV.

Protect the backup methods hackers use to reset your passwords, like security questions and backup emails.

1. 1
   Review security questions — Go to account settings and update questions. Use false answers only you know—e.g., for 'first pet', put 'spaceship' instead of real info.
2. 2
   Set a dedicated recovery email — Create a new email just for password resets. Don't use it for anything else to keep it off hacker radars.
3. 3
   Remove phone-based recovery where possible — SIM swapping attacks make phones risky. Use an authenticator app or hardware key instead for 2FA.
4. 4
   Enable backup codes — For accounts that offer them, generate and print backup codes. Store them in a locked drawer, not digitally.