Two modes, one bookmark. Pick the one that fits your situation right now. Your choice is saved — future visits go straight to that mode (you can switch anytime via the top bar).
The modern playbook: passkeys everywhere supported, password manager as backstop for legacy sites, endpoint hygiene as co-equal with auth, browser compartmentalization to limit blast radius. Based on NIST SP 800-63B Rev 4 (July 2025), NCSC UK, CISA, EFF, and platform-vendor guidance.
Goal: zero passwords on every account that supports passkeys. Password + 2FA was the playbook for 2015-2022. The current playbook is passkey-first.
Use passkeys on Google, Microsoft, Apple, GitHub, Discord, your bank — every site that supports them. Use unique manager-generated passwords + strongest 2FA only as a fallback for sites that don't support passkeys yet (and that gap is shrinking fast).
Strong password + 2FA is no longer enough. Infostealer malware exfiltrates session cookies and bypasses 2FA entirely by riding your already-authenticated session. Endpoint hygiene (don't run untrusted software, browser compartmentalization, DNS filtering) is now co-equal with auth hygiene.
Sequential. Each step has expandable inline help where there's genuine nuance -- no scrolling away to find context for what you're working on.
Don't panic. Most adult emails are in 5-30 breaches by now -- Collection #1, Exploit.In, LinkedIn 2012, Adobe 2013, gaming-era stuff. What matters is the data exposed, not the breach count.
HIBP shows a "Compromised data" line per breach. Triage by THAT:
Bottom line: the breaches themselves are historical. Whether you're exposed TODAY is answered by working through this whole P1 list.
That password is burned forever. Even if you've never reused it, attackers' credential-stuffing wordlists include it now -- the moment any service it works on gets attacked, your account is one tried-password away from compromise.
Action:
If your password manager MASTER password is in the list: change the master immediately. The individual unique passwords the manager generated for sites are still safe -- they were never derived from the master.
Check at minimum: primary email, password manager master, primary bank, anything financial. Highest-blast-radius accounts first.
Short answer: not necessarily. For most consumers, the built-in option (Google Password Manager / Apple Passwords) is fine.
Google Password Manager (built into Chrome) if: you live in Chrome + Android (or Chrome + iPhone). Already there, syncs automatically, breach detection, stores passkeys. Verify:
Apple Passwords / iCloud Keychain if: you live in Safari + iPhone. Same logic -- built-in, free, just works.
Bitwarden (free) or 1Password (paid) if: Firefox/Safari heavy, family sharing needed, you want zero-knowledge encryption without the Google PM recovery cliff, or you need to store SSH/API keys + secure notes. Bitwarden is open-source and zero-knowledge by default.
The biggest security win is using ANY manager vs reusing passwords. Native-vs-dedicated is a secondary optimization.
Google Password Manager has an optional "on-device encryption" toggle. For typical consumers, don't enable it. Once on, it can't be turned off.
If you forget your Google password AND lose access to all signed-in devices, your saved passwords are unrecoverable -- Google has no recovery-contact mechanism like Apple's ADP.
Enable only if you have a threat model that requires zero-knowledge AND you accept the lockout risk. Otherwise leave it off.
A passkey replaces your password AND your 2FA with a single phishing-resistant credential bound to your device.
When you sign in, your device unlocks the passkey with biometrics (Face ID / Touch ID / Windows Hello) or your device PIN. The cryptographic proof never crosses the network -- the site only sees a one-time signed challenge.
Why it beats password + 2FA:
This is why the modern goal is passkey-everywhere. Passwords + 2FA become the legacy fallback for sites that don't support passkeys yet.
Tier-1 accounts. Compromise here cascades to everything else. Email is the recovery anchor for every password reset. Apple ID controls all your Apple devices + iCloud. Your password manager holds the keys to the kingdom. Banking + brokerage + crypto can't be recovered the way a social account can. Work top-to-bottom. Each chip opens its own hardening checklist with direct links to security settings.
One-stop review of devices, 2-Step Verification, saved passwords (breach check), and third-party app access. Run this first — it covers most of the items below.
Run Security Checkup ↗Hub for password, sign-in activity, advanced security options, and security info. Microsoft is now passwordless-by-default for new accounts (May 2025) — existing users should consider going passwordless too.
Open Security Overview ↗Hub for 2FA, trusted phone numbers, Recovery Contacts, Recovery Key, and app-specific passwords. Apple ID is the master account for every Apple device + iCloud -- compromise here = compromise of your phone, computer, photos, files, Apple Cash.
Open Apple ID account ↗When you enable Recovery Key, Apple's standard recovery process (which uses your trusted phone numbers + multi-day verification) is DISABLED. The Recovery Key becomes the only recovery path that doesn't require a trusted device you're already signed into.
If you lose all your trusted devices AND lose/forget your Recovery Key, your Apple ID is permanently locked. Apple has no override.
Recommendation: store the Recovery Key in TWO places -- password manager entry + printed copy in a physical safe. Don't enable unless you have both.
Bitwarden is zero-knowledge -- they cannot decrypt your vault. There is no "forgot master password" recovery. Lose the master password = lose the vault. Free tier supports authenticator app + email 2FA; Premium ($10/year) adds YubiKey FIDO2 + Duo.
Open Two-step Login ↗1Password has a unique recovery design: your account requires BOTH a master password AND a 34-character Secret Key. Both are required to sign in on any new device. Lose either, lose the vault. This is why printing + safeguarding the Emergency Kit is non-negotiable.
Open 1Password account ↗No deep-linkable 2FA page. Sign in first, then navigate.
Chase security guide ↗BofA is the only big US bank with FIDO2 hardware key support for consumers. Take advantage.
BofA security features guide ↗WF calls it "Advanced Access." No deep-linkable 2FA URL -- sign in first.
WF Advanced Access guide ↗Citi's consumer 2FA is essentially SMS-only with no toggle to disable it -- they send OTPs based on risk signals.
Citi MFA guide ↗Push from the mobile app is preferred. Passkey support for sign-in rolled out 2025.
Capital One mobile verification guide ↗Fidelity added TOTP authenticator support in 2024-2025. Enable from the mobile app first, then it works on web.
Fidelity 2FA guide ↗Schwab uses Symantec VIP exclusively for app-based 2FA -- no standard TOTP.
Schwab 2FA help ↗Vanguard supports FIDO U2F hardware keys (YubiKey). Must enable SMS first, then add key, then can remove SMS.
Vanguard trust + security ↗Setup is mobile-app only. TOTP authenticator is the practical baseline; passkey support is iOS-only.
Robinhood security best practices ↗All major US banks/brokerages support some form of 2FA (FFIEC mandate since 2005). Quality varies wildly -- many regional banks are even worse than the SMS-only big banks. Find what's available and use it.
Coinbase officially recommends moving off SMS due to SIM-swap risk. Use a hardware key or passkey.
Open Coinbase security ↗Kraken intentionally does NOT support SMS 2FA. Per-function 2FA toggles (Sign-in, Master key, Funding, Trading) -- you can require stronger 2FA for withdrawals than sign-in.
Kraken 2FA guide ↗Hardware key requires enabling TOTP or SMS first. At least one 2FA method is required.
Open Binance.US security ↗A hardware wallet replaces hot wallets (MetaMask, Phantom) AND exchange custody with cold storage. Private keys never touch an internet-connected device. For any meaningful crypto holdings, this is the actual defense -- 2FA on an exchange doesn't help if the exchange is hacked or if you lose the account.
Lower-tier accounts (the long tail). Apple ID + master identities moved up to P2. Social platforms are the active-scam vector; gaming/dev accounts are valuable to attackers; cloud / domain / gov / productivity / shopping are the remaining surface area. Work top-to-bottom.
Unified hub for Instagram + Facebook + Threads. Password, 2FA, login activity, OAuth grants all in one place.
Open Accounts Center ↗Different browser profiles isolate cookies, extensions, and saved logins. A compromised "casual" profile shouldn't expose your banking session. This is the highest-leverage low-effort defense against the modern threat (session cookie theft).
NIST, CISA, and NCSC don't formally recommend browser compartmentalization in their consumer guidance. The security practitioner community strongly recommends it. Standards bodies move slowly; the practical security benefit against modern threats is clear.
Browser profiles are NOT a sandbox — malware running on your OS sees all profiles. Profile separation reduces blast radius from compromised SITES, not from compromised devices.
Distinct colors and avatars for each profile so you visually know which one you're in. Chrome: Settings → You and Google → Manage profiles.
The strongest form of compartmentalization is hardware separation. A cheap dedicated laptop / iPad / Chromebook used ONLY for banking + investment / crypto — no other browsing, no email, no chat, no random apps. Practitioner consensus for executives, crypto holders, or anyone with significant financial accounts.
No 2FA — including passkeys — protects you if malware on your device exfiltrates an active session cookie. Endpoint hygiene is now co-equal with auth hygiene.
Don't run software you didn't deliberately go looking for. Infostealers reach users overwhelmingly via:
Krebs' rule for "support" calls: Hang up, look up the official number yourself, call back. Scammers spoof Google / Apple / Microsoft "support" and trigger real recovery prompts on your account.
Optional. For users with elevated targeting risk: executives, journalists, activists, public figures, crypto holders, sysadmins, anyone whose account compromise has outsized consequences.
Security posture decays without maintenance. These cadences keep you current without becoming a full-time job.
The standards have changed (NIST SP 800-63B Rev 4, July 2025). Most pre-2023 consumer security guides are partially obsolete.
| Outdated advice | Current authoritative position | Source |
|---|---|---|
| Change your password every 60/90 days | Rotate only on suspected compromise. Forced rotation drives users to predictable variants. | NIST 800-63B-4 |
| Use uppercase + lowercase + number + symbol | Composition rules PROHIBITED. Length beats complexity. 15+ chars where possible. | NIST 800-63B-4 |
| SMS 2FA is fine for important accounts | SMS is "restricted" — should be paired with risk evaluation. Outdated for high-value. SIM-swap is mainstream. | NIST 800-63B-4, NCSC |
| Strong password + 2FA = you're safe | No longer sufficient. Session-cookie theft via infostealer bypasses both. Endpoint hygiene now required. | Multiple 2024-2025 infostealer reports; Krebs |
| Just use Google Authenticator (with default sync) | Default cloud sync turns one compromise into total compromise. Disable sync or use non-syncing alt. | Krebs on Security 2024 |
| Security questions add protection | Effectively static passwords. Answers often public via social media. Most modern services have dropped them. | NIST 800-63B since ~2017 |
| Don't write down passwords | A written password in a safe is dramatically better than reuse. Password managers replace the need. | NCSC has explicitly contradicted this for years |
| Memorize one strong password and reuse it | Unique per account is non-negotiable. Use a manager. | CISA Secure Our World |
| You only need MFA on important accounts | Reused-password attacks weaponize less-important accounts. MFA everywhere it's offered. | CISA |
| Your antivirus catches malware | Optimistic. Modern infostealers evade AV for hours-to-days. Behavioral discipline ("don't run unknown EXEs") is the actual defense. | Infostealer reports 2024-2025 |
| Enable Google PM on-device encryption | For typical consumers, don't. No recovery contact mechanism — if you forget Google password AND lose all signed-in devices, passwords are unrecoverable. | Synthesis from EFF, NCSC silence + Google's own warning |
Work the platforms in priority order. Email FIRST (recovery anchor). Each platform has two branches: "I can log in" (lock-down checklist) or "I'm locked out" (recovery flow).
If the device you're on right now might have malware (downloaded something sketchy, ran a suspicious file, accounts started acting weird) — do NOT use it for recovery. Grab your phone, a friend's laptop, anything else. Changing passwords on a still-infected machine just feeds your new passwords to the attacker.
An attacker who got your session cookie via malware is already logged in as you. Reading your email, changing your recovery info, adding silent forwarding rules. Every minute you wait, the damage spreads.
One-stop review. Covers ~70% of the checklist below.
Run Security Checkup ↗Be thorough — first attempt is best.
You'll be asked:
Be thorough — multiple failed submissions degrade your trust score.
Open ACSR ↗
discord.com/wasntme/.After lockdown + cleanup. Use a DIFFERENT channel than the compromised one.
PSA: my Discord was compromised earlier today. If you received any DMs from me with crypto offers, "free Nitro," giveaway links, or any external links in the last [TIME PERIOD] — DO NOT CLICK. Those were the attacker, not me. I've secured the account. Sorry for the spam.
Heads up — my [Instagram / X] was compromised. If you saw any crypto/investment posts or weird DMs from my account in the last [TIME PERIOD], those weren't from me. I've recovered the account.
Subject: My email was compromised — please disregard any unusual messages Hi, My email was compromised on [DATE/TIME]. If you received requests for money, urgent requests for sensitive info, or unusual attachments from my address in the last [TIME PERIOD], please disregard. If you took action based on a recent message from me, contact me via [phone/other channel] to verify.
MFA did not help if it was an infostealer — they rode your live session.
Switch to prevention mode to harden everything you just rebuilt. Set up passkeys, harden endpoint, compartmentalize browsers. So this doesn't happen again.