How to Protect Your Accounts: A Practical Guide to Password Best Practices

Step 1: Understand How Passwords Get Stolen

Knowing how passwords are exposed makes it easier to see why each best practice matters.

Data breaches. A company is hacked and attackers steal its database of usernames, email addresses and passwords. Some companies store passwords securely; others protect them weakly or not at all.

Data leaks. Stolen login data is sold, traded or posted online, often in massive collections assembled from many breaches. An old email and password pair can circulate for years.

Credential stuffing. Automated tools try leaked logins across banks, email providers, retailers and social platforms. Any account sharing the leaked password is vulnerable, even if that site was never breached.

Phishing. Fake emails, texts and websites imitate security alerts, delivery notices or account warnings to trick people into entering passwords.

Guessing and cracking. Short or personal passwords, including names, birthdays and familiar patterns, can be broken in seconds. One leaked password combined with password reuse can compromise many accounts at once.

Step 2: Discover Whether Your Passwords Are Compromised

Breach notices can be delayed, vague or lost in spam. Check every work, personal and older email address with Have I Been Pwned, review what each breach exposed and enable its free notifications.

Run the security checkup built into Google Password Manager, Apple Passwords, Microsoft Edge or a dedicated manager such as Bitwarden or 1Password. Fix results in this order: compromised passwords first, reused passwords next, then weak passwords.

Watch for warning signs

• Password reset emails or sign-in alerts you did not request.
• Messages, posts or purchases you did not make.
• Changed recovery details, unknown devices, apps, forwarding rules or filters.
• Unexpected logouts or contacts reporting strange messages from you.

Step 3: What to Do When a Password Is Compromised

1. Secure your email first. It is the master key for password resets across your other accounts.
2. Change the password safely. Type the website address yourself or use its official app, on a trusted device. Do not follow links in alerts.
3. Change it everywhere it was reused. Treat a leaked password as permanently burned.
4. Create a unique replacement. Small variations of the old password are easy for automated attacks to predict.
5. Enable multi-factor authentication. A stolen password should not be enough to sign in.
6. Sign out every active session. Remove anyone who may already have access.
7. Review account settings. Check recovery contacts, connected apps, trusted devices and email forwarding rules.
8. Protect your finances and identity. Review statements and consider free credit freezes if highly sensitive identity data was exposed.
9. Warn people who may be targeted. Tell contacts, vendors or clients to ignore suspicious requests.
10. Expect follow-up scams. Leaked personal details make later phishing attempts more convincing.

If you are locked out, use the service's official hacked-account recovery process, then complete every step above.

Step 4: Build Strong Passwords and Secure Habits

Use a password manager. It generates long random passwords, stores them in an encrypted vault and fills them only on legitimate sites. Protect the manager with a strong master password and MFA.

Prioritize length. A passphrase made from four to six random, unrelated words is generally stronger and easier to remember than a short complex password. Avoid names, birthdays, addresses, teams, pets and anything discoverable on social media.

Do not rotate passwords without a reason. Current NIST guidance advises against forced routine changes. Change a password after a breach, suspicious activity or sharing it with someone.

Use passkeys when available. Device-based sign-in with a fingerprint, face or PIN resists both breaches and phishing because there is no reusable password to steal.

Never share passwords or MFA codes by email, text or chat. Give each person a separate login, keep software updated, avoid passwords on shared computers and delete accounts you no longer use.

Step 5: Perform Regular Password Checkups

Security is not a one-time task. Add a quarterly reminder; after the first cleanup, a checkup usually takes less than half an hour.

• □ Search every email address on Have I Been Pwned.
• □ Run your browser or password manager's security checkup.
• □ Fix compromised, reused and then weak passwords.
• □ Confirm MFA on email, banking, financial and social accounts.
• □ Verify recovery details, forwarding rules and connected apps.
• □ Remove old devices and people who no longer need access.
• □ Delete unused accounts and update devices, browsers and apps.

Quick reference

Use a unique password for every account, let a password manager create and store them, prefer long passphrases, turn on MFA, use passkeys when offered and check for breaches regularly. When a password is exposed, secure email first, change it everywhere, end active sessions and review account settings. A few simple habits make it far harder for anyone else to walk through the front door of your digital life.