Find account security
Look for “two-step verification” or “multi-factor authentication” in the account’s security settings. Start with your main email account.
Lesson 02 / Protect your accounts
Password Security
Your first line of defense starts with a password you do not reuse.
Think long. Think unique.
A strong password is difficult to guess and belongs to only one account. Reusing a password means one stolen password can put several accounts at risk.
- Aim for at least 16 characters when the service allows it.
- Use a password manager to generate a random password.
- If you need to remember it, use a long passphrase made from unrelated words.
- Avoid names, birthdays, team names, and other details people can discover about you.
Remember: Do not copy a password example from a website. A public example is no longer a secret.
You do not have to remember them all
Let a password manager help.
A password manager keeps your account passwords in a protected vault. It can generate different passwords for each account and help fill them in when you sign in.
- Choose a reputable password manager and learn how its recovery process works.
- Protect the vault with a strong, unique master password and MFA when available.
- Start by replacing reused passwords on your email and other important accounts.
Add another layer
What is multi-factor authentication?
Multi-factor authentication, or MFA, uses more than one kind of proof to verify your identity. For example, a password is something you know, while a security key is something you have.
Select a method
A security key or supported passkey can resist phishing. An authenticator app is another useful option. If text messages are the only choice, enabling them is better than password-only access.
Keep recovery options safe
Store recovery codes somewhere secure. Never share sign-in codes with someone who contacts you, and deny approval requests you did not start.
Learn more: CISA password guidance (opens in a new tab).