Most people know they should use strong passwords. Few have actually audited every account they own. This checklist gives you a systematic process — work through it once and your digital security will be dramatically stronger.
How to use this checklist
Work through each section in order. Don't try to do everything in one sitting — prioritize your email accounts and financial accounts first, then work through the rest over the following week.
Passwords
Use a unique password for every account
Password reuse is the #1 cause of account takeovers. If one site is breached, every account using the same password is at risk.
Use passwords at least 16 characters long
A 16-character random password at 72 bits of entropy would take millions of years to brute-force even with modern hardware.
Include uppercase, lowercase, numbers, and symbols
A mix of all four character types maximizes the search space an attacker must cover.
Avoid dictionary words, names, and personal info
Dictionary attacks and targeted attacks use your name, birthday, and pet names as starting points.
Never use 'password', '123456', or common phrases
These appear at the top of every leaked password list and are the first thing any attack tries.
Generate passwords — don't make them up
Humans are terrible random number generators. Use our password generator to create truly random passwords.
Password Manager
Use a reputable password manager
Bitwarden, 1Password, and Dashlane are all excellent options. A password manager is the only practical way to use unique, complex passwords for every account.
Set a strong, memorable master password
Your master password protects everything else. Use a long passphrase — 5+ random words — that you can memorize.
Enable password manager 2FA
Your password manager holds all your credentials. Protect it with a hardware key or authenticator app.
Check for reused passwords in your vault
Most password managers have an audit feature that identifies reused and weak passwords. Address them one by one.
Two-Factor Authentication
Enable 2FA on your primary email account
Email is the master key to everything else — password resets go there. It must be your most protected account.
Enable 2FA on financial accounts (bank, investing, PayPal)
Your financial accounts are the most valuable targets. Enable 2FA immediately.
Enable 2FA on your primary social media accounts
Account hijacking for social media is extremely common and can have serious personal and professional consequences.
Use an authenticator app — not SMS — for 2FA
SMS-based 2FA can be defeated by SIM-swapping attacks. Authenticator apps (Authy, Google Authenticator) are much more secure.
Save 2FA backup codes somewhere secure
If you lose your 2FA device, backup codes are the only way in. Store them in a secure location — not just in your email.
Account Hygiene
Check HaveIBeenPwned.com for your email address
This free service tells you if your email appears in any known data breach. Check every email address you use.
Immediately change passwords for any breached accounts
If your email or password appears in a breach, change it immediately. Don't wait.
Review and remove connected apps you no longer use
Third-party apps connected to your Google/Facebook/Twitter account have ongoing access to your data. Revoke any you don't recognize or use.
Set up account recovery options on critical accounts
Ensure your recovery email, phone number, and backup codes are up to date for your most important accounts.
Review active sessions and sign out of unknown devices
Most major services show all active sessions. Review them and sign out of any device you don't recognize.
Your priority order
If you can only do a few things today, do these first:
- Enable 2FA on your primary email account
- Enable 2FA on your bank and financial accounts
- Get a password manager and start saving new passwords there
- Check HaveIBeenPwned for your email addresses
- Change any passwords found in known breaches
- Replace shared/reused passwords one account at a time