Short answer
A unique, long password for each account plus a second factor already gives very good protection. Where available, passkeys are even more convenient and more resistant to phishing. A working recovery route is just as important.
Step by step
- 01
Identify your key accounts
Start with email, banking, payment services, cloud storage and your smartphone account. Whoever controls your email account can reset many other passwords.
- 02
Set up a password manager
A password manager creates and stores long, unique passwords. Many operating systems and browsers already include one.
- 03
Turn on MFA
Use an authenticator app, a security key or passkeys. Text-message codes are better than no second factor, but more vulnerable.
- 04
Use passkeys where offered
A passkey replaces the password with a cryptographic key pair bound to the genuine website. Fake sites cannot capture it.
- 05
Prepare recovery
Store recovery codes safely, for example printed out or in your password manager, and keep your backup number and address up to date.
Checklist
- Password manager set up
- Unique passwords for email, banking and payment services
- MFA or passkey for your most important accounts
- Recovery codes stored safely
- Backup phone number and email up to date
Common mistakes
- Reusing one strong password for many accounts.
- Storing recovery codes only on the device that might get lost.
- Approving MFA prompts you didn't trigger yourself.
- Choosing too short a master password for the password manager.
Frequently asked questions
What's the difference between MFA and a passkey?
MFA adds a second factor to the password. A passkey replaces the password and is bound to the genuine website, which makes it particularly good protection against phishing.
How long should a password be?
Length matters more than special characters. A long password generated by a password manager, or a long passphrase of several random words, is a good choice.
What happens if I lose the smartphone holding my passkeys?
Passkeys are often synced via the device manufacturer's account. Recovery codes and a second registered device or security key also help.
Do I need a paid password manager?
Not necessarily. Built-in options in your operating system or browser are enough for many people. Paid services often offer extra features such as family sharing.
Sources
Checked on 6 Oct 2026.