The email came at 2 AM. "Your account password has been changed." You didn't change it. Heart pounding, you try to log in—denied. You try password reset—it goes to an email you don't recognize. Now they have your email. Your bank accounts are linked to that email. Your photos, your documents, your entire digital life, accessed through that one compromised password you used everywhere.
Your most important password isn't strong enough. And you've probably used it twice.
We've lived variations of this nightmare. The hard drive that failed on deadline with no backup. The compromised account that cascaded through connected services. The "it won't happen to me" confidence that made recovery so much worse. This guide is the checklist we wish we'd followed before, not after.
Password Security
Weak passwords are the most common security vulnerability. Fix this first.
The Problem with Most Passwords
Common issues we've seen (and made):
- Reused passwords: One breach compromises everything
- Simple passwords: "password123" appears in every breach database
- Pattern-based: "Summer2026!" follows predictable patterns
- Personal info: Pet names and birthdays are easily researched
The Solution: Unique, Random, Long
Every account needs a unique, randomly generated password of at least 16 characters.
"That's impossible to remember!"
Correct. You're not supposed to remember them.
Password Managers
A password manager stores all your passwords behind one master password:
Benefits:
- One password to remember
- Unique, strong passwords everywhere
- Auto-fill reduces friction
- Secure notes for other sensitive data
- Alerts for breached passwords
Our approach: We use a password manager for everything. The master password is a long passphrase we've memorized. Everything else is randomly generated.
Using Our Password Generator
Our Password Generator creates strong passwords instantly:
- Set length (16+ characters recommended)
- Include all character types when allowed
- Generate and copy
- Store in your password manager
For accounts that don't allow special characters, generate alphanumeric passwords of extra length.
Master Password Strategy
Your password manager's master password is critical:
Good approach: A long passphrase of 4-6 random words
- Example: "correct horse battery staple" (but make your own)
- Easy to type, hard to crack
- Memorize it; don't write it down
Backup: Many password managers offer recovery options. Set them up before you need them.
Two-Factor Authentication (2FA)
Passwords alone aren't enough. Enable 2FA everywhere possible:
Strongest to weakest:
- Hardware keys (YubiKey, etc.)
- Authenticator apps (not SMS)
- SMS codes (better than nothing)
Priority accounts for 2FA:
- Email (gateway to other accounts)
- Financial accounts
- Password manager
- Social media
- Work accounts
We lost access to an account because we only had SMS 2FA and changed phone numbers. Now we use authenticator apps with backup codes stored safely.
Backup Strategy
Data you don't back up is data you're willing to lose.
The 3-2-1 Rule
3 copies of important data 2 different storage types 1 offsite backup
Example:
- Original on your computer
- External hard drive at home
- Cloud backup
This protects against device failure, theft, and local disasters (fire, flood).
What to Back Up
Critical:
- Documents and work files
- Photos and videos
- Financial records
- Password manager data
- Authenticator app backups
Important:
- Application settings and preferences
- Email archives
- Project files
- Personal writing
Optional:
- Media (can often be re-downloaded)
- Applications (can be reinstalled)
Backup Methods
Local backups (fast recovery):
- External hard drive
- Network-attached storage (NAS)
- Time Machine (Mac) or File History (Windows)
Cloud backups (offsite protection):
- Cloud storage services (Google Drive, Dropbox, iCloud)
- Dedicated backup services (Backblaze, Carbonite)
- Encrypted cloud storage for sensitive data
Versioned backups: Some services keep multiple versions, allowing recovery from accidental changes or ransomware.
Backup Schedule
Automatic is best: Set it and forget it.
Minimum frequency:
- Critical work: Daily
- Personal files: Weekly
- Full system: Monthly
Testing Backups
Backups that don't work aren't backups. Periodically:
- Restore a file from backup
- Verify it's complete and current
- Test recovery procedures
We had "backups" for years before discovering they'd stopped working months earlier. Now we verify quarterly.
Account Security
Email Security
Email is your identity hub—password resets go there.
Secure your email:
- Strong, unique password
- 2FA enabled (authenticator app, not SMS)
- Recovery options configured
- Check connected apps periodically
Account Inventory
Know what accounts you have:
- Check password manager for stored accounts
- Search email for "welcome" or "confirm your email"
- Review connected apps in major accounts (Google, Facebook, Apple)
For unused accounts:
- Delete if no longer needed
- Update security if keeping
- Remove connected app permissions
Recovery Planning
If you lose access to your primary email or phone:
Prepare recovery options:
- Recovery email address
- Recovery phone number
- Backup codes stored safely
- Trusted contacts (where supported)
We keep printed backup codes in a fireproof safe. Overkill? Maybe. But we've needed them.
Device Security
Computers
Basic security:
- Operating system updates enabled
- Antivirus/security software active
- Firewall enabled
- Automatic screen lock
Enhanced security:
- Full disk encryption (FileVault/BitLocker)
- Firmware password (prevents boot tampering)
- Secure boot enabled
Mobile Devices
Basic security:
- Passcode enabled (6+ digits or biometric)
- Automatic updates
- Find My Device enabled
- Remote wipe capability
App permissions:
- Review periodically
- Revoke unnecessary access
- Be cautious with location permissions
Network Security
Home WiFi:
- Strong, unique password (use our Password Generator)
- WPA3 or WPA2 encryption
- Router firmware updated
- Guest network for visitors
Public WiFi:
- Assume it's insecure
- Use VPN for sensitive activities
- Avoid financial transactions
- Don't auto-connect to open networks
Privacy Practices
Data Minimization
Share only what's necessary:
- Don't provide optional information
- Use burner email for signups
- Limit social media personal info
- Review privacy settings regularly
Encrypted Communication
When privacy matters, use encrypted channels:
Messaging: Signal, WhatsApp (end-to-end encrypted) Email: ProtonMail or encrypt sensitive content Files: Encrypt before cloud storage
Our Text Encryption tool encrypts sensitive text before sharing through regular channels.
Browser Privacy
- Use private/incognito for sensitive browsing
- Consider privacy-focused browsers
- Install an ad blocker
- Limit cookies and tracking
Social Engineering Awareness
Technology can't fully protect against manipulation:
- Verify unexpected requests (even from known contacts)
- Be suspicious of urgency
- Don't click links in unsolicited messages
- When in doubt, contact the source directly through known channels
Incident Response
If You're Breached
Immediate actions:
- Change passwords (start with email)
- Enable 2FA if not active
- Check for unauthorized access
- Review connected accounts
- Monitor financial accounts
For financial compromise:
- Contact banks immediately
- Place fraud alerts
- Consider credit freeze
- Document everything
If You Lose a Device
Immediate actions:
- Remote wipe if possible
- Change passwords for logged-in accounts
- Revoke device access from services
- Report theft if applicable
Why encryption matters: With full disk encryption, a lost device is an inconvenience, not a catastrophe.
If You Lose Access
Recovery steps:
- Use backup codes
- Try recovery email/phone
- Contact service support
- Use identity verification if available
This is why recovery planning matters—before you need it.
The Security Checklist
Today (15 minutes)
- Generate strong password for email account
- Enable 2FA on email
- Start using a password manager
This Week (1-2 hours)
- Update passwords for critical accounts (banking, primary email)
- Enable 2FA on financial accounts
- Set up automatic local backup
- Generate 2FA backup codes and store safely
This Month (2-3 hours)
- Audit all accounts in password manager
- Set up cloud backup for critical data
- Review privacy settings on social media
- Enable device encryption
- Check browser extensions and connected apps
Quarterly (30 minutes)
- Test backup restoration
- Review and update recovery options
- Check for breached passwords
- Update devices and software
- Review account activity
Conclusion
Security isn't paranoia—it's the difference between an inconvenience and a catastrophe.
A breached password with unique passwords everywhere? Annoying, but contained. A breached password you used everywhere? Cascading disaster. A lost laptop with encryption? Buy a new laptop. A lost laptop without encryption? Someone has your entire digital life.
The setup takes hours. The protection lasts years. Use our Password Generator to create strong, unique passwords. Store them in a password manager. Enable 2FA. Set up backups that run automatically.
Future you, facing an attempted breach at 2 AM, will be grateful present you took this seriously.
Keep Reading
- Create Secure Passwords Guide - Deep dive into password strategy
- Text Encryption Privacy Guide - Protect sensitive communications
- IP Address Privacy Guide - Understand your digital footprint
Related Tools
- Password Generator - Create strong, unique passwords
- Text Encryption - Encrypt sensitive information before sharing