Protect the account that resets the others
Your primary email account often receives password-reset links, security notifications, and recovery messages. Someone who controls it may be able to take over other accounts without guessing their passwords. Give it a unique credential and the strongest practical authentication method it supports.
Review its recovery addresses, phone numbers, forwarding rules, connected applications, and active sessions. Remove entries you no longer recognize or control. A password change alone may not remove a malicious forwarding rule or revoke every authorized application. The surrounding account settings deserve the same attention as the sign-in screen.
Compare second-factor options
Text-message codes are widely available and can be better than relying only on a password. Their limitations include phone-number takeover, message interception in some circumstances, and exposure to phishing. If text messages are the only supported option, use them while also securing the mobile account and its recovery process.
Authenticator applications generate time-based codes without needing a text message. They reduce dependence on the phone network, but a deceptive website can still relay a code in real time. Store setup and recovery material responsibly, and understand whether your authenticator synchronizes secrets or keeps them only on the device.
Push approvals can be convenient, but repeated unexpected prompts may be an attack rather than a technical nuisance. Deny requests you did not initiate. Number matching and contextual information can help, but they do not justify approving an unfamiliar sign-in.
Understand passkeys and security keys
Passkeys use public-key cryptography and are bound to a relying party, which helps resist conventional credential phishing. The service receives a public key rather than a reusable password secret. Unlocking typically involves a device PIN or biometric check, depending on the implementation.
Some passkeys synchronize through a platform or credential provider; others remain bound to a device or hardware security key. Synchronization improves access across devices but makes the provider account and its recovery process important. Device-bound credentials reduce that dependency while making backup authenticators especially valuable. Check support across your actual devices before removing older sign-in methods.
Plan recovery before you need it
Save recovery codes when a service offers them. Keep them protected and accessible through a route that does not depend solely on the account being recovered. If you print them, store the paper securely. If you keep an encrypted digital copy, make sure you can still unlock it after losing your main device.
Register a second authenticator where supported and remove obsolete devices when replacing hardware. Review recovery contacts after a move, job change, or phone-number change. Recovery can become the weakest route into an otherwise well-protected account, so avoid treating it as a one-time administrative chore.
Recognize what a password score misses
A strength meter cannot protect a secret typed into a convincing imitation of a login page. Navigate from a trusted bookmark or by entering the known site address when a message demands urgent action. Inspect the full domain rather than relying on a logo, page design, or padlock alone.
Likewise, a password does not protect a session token stolen from an infected device. Keep the browser and operating system updated, limit extensions to those you need, and lock unattended devices. Avoid approving remote access or sharing authentication codes in response to unsolicited support requests.
Respond to suspected compromise in order
Use a device you have reason to trust. Secure the primary email and recovery routes, then replace the affected password with an independent random value. Revoke unfamiliar sessions, connected applications, app-specific passwords, and authenticators where the service allows it. Check for changed account details and unexpected activity.
If the old password was reused, change it on every affected account without recycling a common replacement. Contact the service through its official support route when access is lost or transactions are involved. Preserve relevant notices without forwarding live reset links or recovery codes to unrelated parties.
Finally, improve the layer that failed: uniqueness, phishing resistance, device security, or recovery controls. A stronger-looking password is only one possible part of that repair.
Return to the security guides