A Beginner's Guide to Strong Passwords and Two-Step Login
Most account break-ins are not clever hacks. They come from reused passwords and missing second steps, which are easy to fix.
Most people reuse the same few passwords across many sites. The problem is that when one site is breached, attackers try the same email and password on other services. If your email account falls this way, the rest follows, because password resets go to your inbox.
A strong password is long and unique. Length matters more than complicated symbols, so a passphrase made of four or five unrelated words is both strong and easier to remember than a short jumble. Avoid names, birthdays and anything that appears on your social media.
Use a password manager to handle the rest. It creates a different random password for every site and fills it in for you, so you only need to remember one strong master passphrase. Most phones and browsers have a built-in manager, and there are many dedicated ones as well.
Turn on two-step login, also called two-factor authentication, for your most important accounts: email, banking, e-wallets and social media. It asks for a second proof, such as a code from an app, in addition to your password. An authenticator app is generally safer than codes sent by text message.
Save your backup codes somewhere safe. If you lose your phone, those codes let you get back into your accounts. Print them or store them in your password manager, not in a screenshot on the same device.
Be careful with links and messages that ask you to log in or share a code. Banks and services will not ask you to read out a one-time code. When in doubt, close the message and go to the official site or app yourself.
Finally, check whether your email appears in known breaches using a reputable breach-notification service, and change any passwords that do. Taking an hour to do these steps once will protect you for years.