You do not need to protect everything at once. A short, ordered list covers most of the risk in under an hour. No technical knowledge is needed. This guide is part of our two-factor login and passkeys guide.
The priority list
| Priority | Account | Why |
|---|---|---|
| 1 | Main email | It can reset your other passwords |
| 2 | Password manager | It holds every other password |
| 3 | Apple or Google account | Controls your phone, backups and saved passwords |
| 4 | Banking and payments | Direct access to your money |
| 5 | Mobile phone account | Protects your number from SIM swaps |
| 6 | Cloud storage | Holds personal documents and photos |
| 7 | Social media | Used to scam your friends |
| 8 | Shopping with saved cards | Can be used to spend your money |
| 9 | Crypto exchanges | Theft is usually final |
| 10 | Work accounts | Follow your employer's rules |
If you hold crypto, move exchanges to the top alongside your email. See securing exchange logins.
Why email comes first
Most "forgot password" links go to your inbox, so whoever controls your email can often take over the rest. Read why your email is the master key, then use the email security checklist.
How to do it fast
- Install an authenticator app.
- Set aside 30 minutes.
- Work down the list, one account at a time.
- Save the backup codes as you go.
If you are not sure of the method to use, 2FA methods compared explains your options. Anything is better than nothing, so if an account only offers text messages, use that.
Secondary accounts to think about
- Old email addresses still linked to accounts. Secure them or remove them.
- Accounts shared with family. Agree on who holds the second factor. See sharing passwords safely.
- Government and tax accounts. These often have strong options, so use them.