A good account-security setup should protect you on an ordinary Tuesday as well as when something goes wrong. Passkeys and password managers can reduce repeated passwords and make phishing harder, but they work best alongside recovery options that you understand.
Prioritise your primary email account
Your email account often controls password resets for many other services. Secure it first with a strong, unique password or a passkey if available, and enable a reliable form of multi-factor authentication. Review recovery addresses, phone numbers and any devices already signed in. Remove options you no longer control.
What a password manager actually solves
A reputable password manager can generate and store different passwords for each site, reducing the temptation to reuse one familiar password. Choose a well-supported product, understand its device compatibility and create a strong method of unlocking it. Consider what happens if you lose your phone, forget your master password or need access while travelling.
Passkeys change the sign-in process
Passkeys use cryptographic credentials associated with your device or credential provider rather than requiring you to type a reusable password for that site. They can be resistant to common phishing attempts, but availability and recovery methods differ between services. Learn where the credential is stored and how it can be accessed from a replacement device before migrating everything.
Plan your recovery deliberately
Store recovery codes securely and separately from the account they protect. Check whether the service allows a second authentication method, and think carefully before removing an old phone or security key. For important accounts, recovering access may be more complicated than adding an extra sign-in method, so follow each service’s official instructions.
A sensible order of operations
Start with email, financial and government accounts. Use passkeys where supported, unique passwords elsewhere and multi-factor authentication when available. Periodically review the list of connected devices and update out-of-date recovery details. The Australian Cyber Security Centre’s personal cyber security handbook provides current guidance for these steps.
Sources & further reading
Have a correction or a useful source? Contact the editorial desk.
