Guide updated on 4 November 2026. It brings together and replaces the site’s articles on passwords, password managers, two-step verification, passkeys, account recovery and connected apps.
Almost every account takeover starts the same way: someone logs in with a password they already had. According to Verizon’s 2025 Data Breach Investigations Report, stolen credentials were the way in for 22% of the breaches analysed, and automated attempts with stolen passwords (credential stuffing) made up a median 19% of all the logins a service receives each day. The same report found that, in the typical case, only 49% of a person’s passwords were different from one another: the rest were reused or nearly identical.
This guide lists the defences in order of importance, with the concrete steps to take. You don’t need to become an expert: you need one hour for your main email account and then a few minutes for each of the others.
1. The real problem is not a weak password, it is a reused one
When a website is breached, email and password pairs end up in collections traded between criminals. Automated tools then try them on email, banks, online shops and social networks, thousands of times a minute. Nothing needs to be guessed: it is enough that you used the same password somewhere else. That is why a complicated password used on ten sites is more dangerous than a simple one used only once.
The practical consequence is a single rule: every important account needs a different password. Everything else in this guide is about making that rule sustainable.
2. What a password should look like in 2026
The US NIST guidelines, revised in SP 800-63B in 2025, are the reference many services follow. They contradict some old habits:
- Length first. A password used on its own must be at least 15 characters; with a second factor, 8 is enough. Services should accept at least 64.
- No mandatory composition rules. Requiring “one capital letter, one number and one symbol” does not help: it produces passwords like
Summer2026!, which are easy to predict. - No forced periodic changes. Changing every 90 days leads to predictable tweaks (
Summer2027!). A password should be changed when there is a sign it has been exposed. - Checks against known passwords. Services must refuse common passwords and ones already seen in breaches.
- Password managers and paste allowed. A site that blocks pasting or autofill is working against your security.
If you choose a password yourself, the most practical method is a phrase of random words: four or five unrelated words, such as fork-lagoon-trombone-orbit. That is 26 characters and easy to remember. Avoid quotations, song lyrics and personal details (dates, the names of children or pets, your football team): they are the first guesses of anyone who knows you.
3. Password managers: the only realistic way to have a hundred different passwords
Nobody can remember dozens of unique passwords. A password manager creates them, stores them encrypted and fills them in for you. You only remember the main password, which must be long and used nowhere else.
A little-known advantage: a password manager only fills in the password on the right site. If you open a fake page imitating your bank, it fills in nothing. It is a warning sign that works even when your eye misses the difference in the address.
| Type | Examples | Pros | Cons |
|---|---|---|---|
| Built into the system or browser | Apple Passwords, Google Password Manager, Microsoft Edge | Free, already there, syncs passkeys | Awkward if you use devices from different brands |
| Independent manager | Bitwarden, 1Password, Proton Pass, KeePassXC | Works on every system, family sharing | Some are paid, needs setting up |
| Paper notebook at home | A notebook kept in a drawer | No online risk | Not available away from home, can be lost, does not warn about fake pages |
When choosing an independent manager, check that it offers client-side encryption (the provider cannot read your passwords), two-step verification on the manager account itself, and export in an open format so you are not locked in.
4. Two-step verification: what to choose and what to avoid
Two-step verification (2FA) adds a second proof at login. Even if your password is stolen, whoever uses it is stopped. Not all methods are equally strong.
| Method | Protection | When to use it |
|---|---|---|
| Passkey or physical security key (FIDO2) | Highest: resists phishing pages too | Email, banking, password manager, work accounts |
| Authenticator app (6-digit codes) or approval in the service’s app | Good, but a fake site can ask for the code in real time | Almost every other account |
| SMS | Fair: exposed to SIM-swap fraud and intercepted messages | Only if nothing else is offered; better than nothing |
| Code by email | Only as strong as the mailbox | Never on the same email account it is protecting |
The order matters. Start with your main email, because that is where every other password gets reset. Then banking and payments, your digital identity (in Italy, SPID or CIE), the password manager, cloud services with your photos and documents, and finally social networks and shops.
One rule to remember: never approve a login request you did not start. If your phone asks “Is this you signing in?” while you are doing nothing, someone has your password. Deny it and change the password straight away.
5. Passkeys: a password a fake page cannot steal
A passkey replaces the password with a pair of cryptographic keys, based on the FIDO Alliance standard. The private key stays on your device or in your password manager; the service only keeps the public one. To sign in you unlock your phone or computer with a fingerprint, your face or a PIN.
Its strength is that each passkey is tied to the exact address of the site it was created for. A fake page, however convincing, receives nothing it can use. And if the service is breached, the thieves only find public keys, which are useless for logging in.
How to start: in the security settings of Google, Microsoft, Apple, Amazon, PayPal and many other services you will find “Passkeys” or “Sign in without a password”. Create one on the phone you use most and a second one on another device, so you are not locked out if you lose one. Passkeys stored in Apple’s or Google’s manager, or in an independent one, sync across your devices.
One caveat: as long as the account still accepts the old password, the passkey does not remove that risk. Keep the password long and unique, or switch it off if the service allows.
6. Account recovery: the back door to lock properly
Many takeovers do not go through the login page but through “Forgot password”. If the recovery email or phone number is old, or belongs to someone you no longer control, whoever gets it back can reset your account. Equally, if you lose your phone with no alternative, you may lock yourself out.
- Check that your recovery email and number are current and yours. Mobile operators reassign unused numbers after a while.
- Save the recovery codes services give you when you turn on 2FA: print them or keep them in your password manager, not in the same mailbox they protect.
- Register at least two methods: for example a passkey on your phone and a security key or a second device.
- Ask your mobile operator whether it offers a PIN or a lock on SIM changes: it makes number hijacking harder.
7. Connected apps and open sessions: the access you forget about
Each time you use “Sign in with Google” or let an app read your email, calendar or files, you grant access that stays valid until you revoke it, even years after you stopped using the app. If the app’s provider is breached, those permissions become a route to your data that does not need your password.
Twice a year, spend ten minutes on these checks:
- Google: Google Account > Security > “Your connections to third-party apps & services” (official help). Remove what you do not recognise or use.
- Microsoft: Microsoft account > Privacy > “Apps and services you’ve given access”.
- Apple: Settings > your name > “Sign in with Apple”.
- Social networks: look for “Apps and websites” or “Integrations” in the settings.
- Sessions and devices: the same menus list the signed-in devices. Sign out the ones you do not recognise and, for email, check that nobody has created automatic forwarding rules.
8. If you think an account has already been compromised
- From a device you trust, change the password of that account and of every account that used the same one.
- Sign out all active sessions and remove connected apps you do not recognise.
- Turn on two-step verification or, better, a passkey.
- Check the recovery email and number, mail forwarding rules and delivery addresses in online shops.
- Check whether your address appears in known breaches on Have I Been Pwned.
- If money is involved, call your bank immediately and report it to the police (in Italy, the Polizia Postale).
If the suspicion comes from a program installed on your PC (an “infostealer”), changing passwords from that same computer is not enough: read the guide on infostealers and stolen accounts.
The one-hour plan
| Time | What to do |
|---|---|
| 10 minutes | Install or turn on a password manager and choose a main password of five random words. |
| 15 minutes | Main email: new password from the manager, passkey or authenticator app, recovery codes saved, recovery number and email checked. |
| 15 minutes | Banking, payments and digital identity: two-step verification on, transaction alerts on. |
| 10 minutes | Remove connected apps you do not use and sign out unknown devices. |
| 10 minutes | Check your address on Have I Been Pwned and note which accounts to review in the coming days, one a day. |
Sources
- NIST, SP 800-63B, Authentication and Authenticator Management (revision 4, 2025), password section.
- Verizon, 2025 DBIR research on credential stuffing.
- FIDO Alliance, Passkeys.
- Google, Manage your third-party connections.
- Have I Been Pwned, breach lookup.