Security fades with time. New accounts appear, phones change and people move out. An annual check-up keeps everything in order. This how-to is part of our guide to passwords for families and digital legacy.
Pick a date
Choose a day and put it in your calendar. Make it a family event, with snacks if necessary.
Step 1: Check for leaks
- Run your password manager's security report.
- Check your email addresses for known breaches.
- Note anything weak, reused or exposed.
Step 2: Replace what needs replacing
Fix the flagged passwords, starting with your email and bank. There is no need to change good passwords, and current NIST guidance says that services should not force regular changes.
Step 3: Review your second factors
- Is two-factor login on for all key accounts?
- Do your backup codes still work, and do you know where they are?
- Can you replace SMS with something stronger? See 2FA methods compared.
Step 4: Secure your email and devices
Run through the email checklist and check for forwarding rules. Update phones, computers and the router. Look at your security questions.
Step 5: Clean up old accounts
Close accounts that you no longer use, particularly those holding payment details. Each one is a leak waiting to happen.
Step 6: Review shared access
- Is anyone in the shared vault who should not be?
- Have you removed ex-partners and former housemates?
- Are kids ready for more responsibility?
Step 7: Update your plans
Check your emergency access, legacy contacts and digital legacy plan.
The whole checklist
| Task | Done? |
|---|---|
| Manager security report run | ☐ |
| Email addresses checked for leaks | ☐ |
| Weak and reused passwords replaced | ☐ |
| Two-factor login confirmed | ☐ |
| Backup codes located | ☐ |
| Email settings reviewed | ☐ |
| Devices and router updated | ☐ |
| Unused accounts closed | ☐ |
| Shared access reviewed | ☐ |
| Legacy plan updated | ☐ |
If you hold crypto, add a yearly backup health check.