Private account security guide: passwords, passkeys, multifactor authentication, recovery, sessions, and alerts

What to take away

This private account security guide treats account security as a chain. A strong password does little when an attacker also controls the recovery email. Multifactor authentication helps, but an exposed backup code or a live session can walk past the prompt. The goal is independent controls plus a tested way back in.

Rank accounts by what they can reach

Start where a reset cascades. A compromised inbox can reset the password manager, the bank, and the work suite in one afternoon.

For each, note these details:

Passwords where a password remains

Generate a distinct password per service and hold them in a protected manager. One reused password turns a single breach into a list of login attempts. Examples of password managers include Bitwarden and 1Password; Apple Passwords and Google Password Manager are built-in options.

Length beats symbol rules that people satisfy the same way every time. A password already exposed in a breach is spent, however long it is.

Do not send passwords by chat or email. Use delegated access, a family role, a team vault, or an emergency-access process when someone else genuinely needs in.

What a passkey changes

A passkey is public-key authentication. The service stores a public key; the private key stays with the authenticator or its protected sync system. Because the sign-in is bound to the real service, a lookalike login page collects nothing usable.

Backup and portability differ. A device-bound passkey stays on one authenticator. A synced passkey travels through a platform account, such as Apple iCloud Keychain or Google Password Manager. Before enrolling, find out what happens when the device is lost, the platform account is locked, or you switch ecosystems.

Choosing a second method

Multifactor authentication combines different factor types, such as something you know and something you hold. Two passwords are not two factors.

Common options are security keys, passkeys, authenticator apps, push prompts, and text or email codes. Examples of authenticator apps include Google Authenticator, Microsoft Authenticator, and 2FAS; physical security keys include Yubico Security Keys and Google Titan Security Keys. Availability varies by service. NIST's current authenticator guidance separates several authenticator types:

It notes that a manually typed one-time code is not phishing-resistant.

Those requirements target covered digital identity systems. They are useful concepts, not proof that a consumer account meets a federal assurance level. Use the strongest method you can operate and recover.

Recovery is a design decision

Register two independent ways to sign in wherever the service allows it. Store single-use recovery codes offline or in a vault separate from the device they rescue. Keep the recovery email and phone number current.

Do not let every path run through one phone, one number, one cloud account, or one room. A spare security key kept elsewhere covers a lost primary. A synced passkey is only as safe as the platform account behind it.

Sessions, tokens, and connected apps

After sign-in, the service issues a session token that keeps you in. Review devices and sessions by date, location, and browser, then end the ones you do not recognize. After a suspected compromise, use "sign out everywhere" if the service offers it. Google Account > Security > Your devices, Apple's device list under Settings > [your name], and Microsoft's Recent activity page offer provider-specific places to review access.

Then check what else holds access:

Privacy settings, data access, and takedowns

Account security controls who can get in; privacy controls affect what a service collects, retains, and shares while you use it. In Google Account > Data & privacy, review Web & App Activity and YouTube History; use My Ad Center to review ad personalization. On Apple devices, check Settings > Privacy & Security > Tracking and App Privacy Report; in Meta Accounts Center, review Ad preferences and Your information and permissions. Turn off optional collection or sharing you do not want, and delete stored activity where offered.

Before closing an account, use Google Takeout, Apple's Data and Privacy tools, or Meta's Download Your Information to save what you need; then use the service's deletion control. For personal information in search results, Google's Results about you can request removal from eligible Google Search results, but it does not delete the source page. Ask the site that published the information to remove the original.

Alerts are evidence, not instructions

Security alerts report several events:

Keep a second notification route current. An attacker inside the account can delete messages, so a separate address or device is what tells you something moved.

A response card for the first hour

Write down the official recovery route for each critical account, such as Google Account Recovery, Apple's account recovery, and Microsoft's account recovery. Add your mobile carrier's support number and account-recovery route, your bank's fraud number from its card or statement, device-lock steps, and one trusted person's number. Copy contact details from provider materials, not a message or search ad. Put no passwords and no reusable codes on it.

If a takeover happens, work from a known-clean device. Recover email and the password manager first. Revoke sessions, then replace the authenticators. Inspect forwarding and connected apps. Preserve the evidence. Tell the people or institutions affected. Report identity theft through IdentityTheft.gov, the FTC's recovery site, and contact your bank or state attorney general when relevant.

Common questions

Is a passkey the same as a password?

No. A passkey uses a cryptographic key pair and service-bound authentication, so no shared secret is typed into the site. The private key stays with the authenticator or its sync account.

Is SMS multifactor authentication useless?

No. It still beats a password alone, but it is exposed to phishing and phone-number takeover. Move high-value accounts to a security key, a passkey, or an authenticator app where the service supports one.

Where should recovery codes be stored?

Offline, or in a protected vault separate from the device they rescue, with clear labels and limited access. Treat them as a second key to the account, because that is what they are.

Does changing a password end every session?

Not always. Use the service's session and device controls, and revoke third-party tokens and app passwords. A password change alone can leave an attacker's session running.

Who do I contact about a privacy complaint in Canada?

For US readers, report identity theft through IdentityTheft.gov and consumer fraud to the Federal Trade Commission; your state attorney general may handle state consumer-protection complaints. If your matter is in Canada, the Office of the Privacy Commissioner of Canada handles federal matters, while provincial privacy commissioners handle matters under provincial law, including Quebec Law 25 and Alberta PIPA.