It is tempting to use one password, or one inbox, for everything. Keeping work and home apart protects both. This guide is part of our guide to securing your key accounts.
Why separation matters
- Breaches cross the line. A leaked hobby-site password that you reused at work can give someone access to your whole company. See credential stuffing.
- You can lose access overnight. When you leave a job, your work email goes. Any personal account tied to it goes with it, and so may your password reset links.
- Your employer can see work systems. Work accounts and devices may be monitored.
- Attackers target workplaces. One reused password can start a ransomware attack, and it may be traced to you.
What to keep apart
| Keep separate | Why |
|---|---|
| Passwords | A leak stays on one side |
| Email for sign-ups | Personal accounts survive a job change |
| Password vaults | You keep your vault when you leave |
| Authenticator entries | Do not tie personal accounts to a work phone |
| Browser profiles | Saved logins stay apart |
| Devices | Personal data stays off work machines where you can manage it |
Practical steps
- Search your work inbox for accounts you registered with it, such as utilities, shopping, or streaming.
- Change each one to a personal email address.
- Move any personal passwords out of a work password manager.
- Create separate browser profiles for work and home.
- If you have a personal phone, use it for your personal authenticator.
If you use your own device for work
Many jobs allow this. Follow your employer's rules, keep your phone's lock screen strong, and use the work app or container where one exists. If your employer can wipe the device, keep your own backup.
Before you leave a job
- Move any personal accounts off your work email.
- Remove your personal data from work devices.
- Take your own password vault and backup codes, and nothing belonging to the company.
- Hand work logins back properly.
Work accounts need extra care
Treat fake password reset requests and push prompts seriously, and report them to your IT team. Read about MFA fatigue. Never approve a prompt that you did not trigger, even if someone claiming to be from IT tells you to.