How to Protect Your Own Accounts: Passwords, 2FA and Password Managers

Most hacked accounts are not broken into by clever tricks. They are taken over because of weak or reused passwords, phishing messages, or accounts with no second layer of protection. The good news is that a few simple habits stop most of these attacks.

If you are learning ethical hacking, this is also the best place to start: before you test other systems, learn how to defend your own. This guide covers passwords, password managers, two-factor authentication (2FA), phishing, and a checklist you can finish in about an hour.

Why accounts get taken over

• Reused passwords. When one website is breached, attackers try the same email and password on other sites. This is called credential stuffing.
• Weak or guessable passwords. Names, birthdays and simple patterns like Password123 are tried first.
• Phishing. A fake message or website tricks you into typing your password yourself.
• No second factor. A stolen password alone is enough to log in.

Step 1: Use a long, unique password for every account

Two ideas matter most: length and uniqueness.

• Longer is stronger. A passphrase of several random words (for example four or five unrelated words) is easier to remember and harder to crack than a short password full of symbols.
• Never reuse passwords. If every account has a different password, one breach cannot open the others.
• Don't use personal details such as names, birthdays, phone numbers or pet names.

Current guidance from standards bodies such as NIST also says you do not need to change a good password every few months. Change it when you think it has been exposed.

Step 2: Use a password manager

Nobody can remember dozens of long, unique passwords. A password manager does it for you. It creates strong random passwords, stores them in an encrypted vault, and fills them in when you log in. You only need to remember one strong master password.

• Bitwarden is open source and has a free plan.
• KeePassXC is free and open source, and stores your vault as a file on your own computer.
• 1Password and others are paid options with extra features.

Pick one from the official website, and create a long master passphrase that you use nowhere else. Never store your master password in a text file or a notes app.

Step 3: Turn on two-factor authentication (2FA)

2FA adds a second check after your password, so a stolen password alone is not enough. From weakest to strongest, the common types are:

1. SMS codes. Better than nothing, but they can be intercepted or redirected through SIM-swap attacks.
2. Authenticator app codes. Apps such as Google Authenticator, Microsoft Authenticator or Aegis create a code that changes every 30 seconds. This is a good choice for most people.
3. Security keys and passkeys. Physical keys or built-in device logins are the strongest option, and they resist phishing because they only work on the real website.

Start with your email account, because a hacker who controls your email can reset the password for almost everything else. Then add 2FA to your bank, social media, cloud storage and any crypto exchange.

Step 4: Save your recovery options

• When you enable 2FA, most services give you backup codes. Save them somewhere safe, such as inside your password manager or printed and kept in a secure place.
• Keep your recovery email and phone number up to date.
• If you use an authenticator app, learn how to move it to a new phone before you replace your old one.

Step 5: Spot phishing before it works

Phishing messages try to rush you into clicking a link and typing your login. Watch for these signs:

• A message that creates panic: "Your account will be closed in 24 hours".
• A sender address that is slightly different from the real one.
• A link that doesn't match the website it claims to be. Hover over it, or better, open the site yourself by typing the address.
• Requests for your password, 2FA code or recovery phrase. Real companies do not ask for these.

A password manager helps here too, because it will not auto-fill your password on a fake website with the wrong address.

Step 6: Check whether your email has been in a breach

The website haveibeenpwned.com, run by security researcher Troy Hunt, lets you enter your email address to see whether it has appeared in known data breaches. If it has, change the password for that service and for any other site where you used the same one.

Step 7: Keep things updated and backed up

• Turn on automatic updates for your operating system, browser and phone apps.
• Back up important files to an external drive or a trusted cloud service.
• Log out of old accounts you no longer use, and delete the ones you don't need.

Your one-hour checklist

1. Install a password manager and create a strong master passphrase.
2. Change the passwords for your email, bank and main social accounts to unique ones.
3. Turn on 2FA (authenticator app or passkey) for those accounts.
4. Save your backup codes inside your password manager.
5. Check your email on haveibeenpwned.com.
6. Turn on automatic updates.

Common mistakes

• Using the same password with small changes (like adding a number at the end).
• Saving passwords in your browser without a lock on your device. Use a device password or a proper manager.
• Sharing 2FA codes. Anyone asking for a code you just received is likely trying to log in as you.
• Ignoring security alerts about new logins or password changes.
• Skipping the email account. It is the master key to your other accounts.

Final thoughts

You don't need to be a security expert to be hard to hack. A password manager, unique passwords and 2FA on your important accounts block the large majority of everyday attacks. Spend one hour on the checklist today, and you will be safer than most people online.

Which account will you secure first? Tell me in the comments, and follow the blog for more guides on Kali Linux, programming, AI and crypto.