Most people's digital security is a single point of failure with extra steps. Locking it down — password manager, two-factor authentication, recovery codes, tested backups — is a weekend project, not a lifestyle.
Tool recommendations and vendor menu paths reflect the state of things as of mid-2026. Security products and account settings move fast — verify the details before relying on them.
You have one email account. That account can reset the password on every other account you own. If someone gets into it — or if you get locked out of it — everything downstream falls over. Your bank, your domain registrar, your GitHub, your photos from the last ten years.
The good news: fixing this is a weekend project. Here's the setup, roughly in the order I'd build it.
Start with a threat model, not a shopping list
Before installing anything, ask who you're actually defending against. The answers are usually some mix of:
- Credential stuffing. A site you signed up for in 2014 got breached, and now bots are trying that email/password combo everywhere. This is the most common attack by far, and it's fully solved by unique passwords.
- Phishing. A convincing email or SMS (Short Message Service — a plain text message) gets you to type your password and second-factor code into a lookalike page.
- Device theft or loss. Your laptop gets stolen from a café table.
- You. Accidentally deleting things, losing a phone, forgetting where you put something important.
That last one deserves emphasis. For most people, losing access to your own accounts is a more likely disaster than being hacked. A security setup that makes you unhackable but also unrecoverable is a bad trade. Everything below is designed with both failure modes in mind.
A password manager is non-negotiable
The whole point is that you should not know most of your passwords. They should be 20+ random characters, unique per site, and stored in something that fills them in for you.
Options worth looking at:
| Tool | Model | Notes |
|---|---|---|
| Bitwarden | Cloud, open source | Generous free tier, self-hostable (Vaultwarden) |
| 1Password | Cloud, commercial | Polished apps, family sharing, a secret key adds a second factor to the vault itself |
| KeePassXC | Local file | Full control — you handle sync and backup yourself |
| Proton Pass | Cloud, open source | Good if you're already in the Proton ecosystem |
| Apple Passwords / Google Password Manager | Built in | Fine as a starting point, weaker cross-platform story |
Any of these beats reusing passwords. Pick one and move on.
The master password is the one you must memorise. Use a passphrase — five or six random words, generated, not chosen by you. Something like correct-battery-staple-hinge-marble (yes, that xkcd). Long and memorable beats short and cryptic.
Then, critically: write the master password down on paper and put it somewhere physically safe. A home safe, a sealed envelope with important documents, a trusted family member. The threat model for a piece of paper in your house is completely different from the threat model for a string typed into a browser. People are strangely resistant to this and then lose their vault.
Passkeys
Passkeys are worth adopting where they're offered. Instead of a shared secret you type in, your device holds a private key and proves possession of it. There's nothing to phish and nothing to leak in a breach.
Google, Apple, Microsoft, GitHub, Amazon and a growing list of others support them. Most password managers can store them too, which keeps them portable across devices rather than trapped in one ecosystem. Keep a password and a second factor on the account as a fallback while the ecosystem is still maturing.
Two-factor authentication, ranked
Two-factor authentication (2FA) means the password alone isn't enough — a second, independent proof is required to sign in. Not all second factors are equal:
| Method | Phishing resistance | Weak point |
|---|---|---|
| SMS codes | SIM swapping; codes can be relayed to a lookalike site | |
| TOTP app | A lookalike site can relay the code in real time | |
| Hardware key | Losing the key — so register two | |
| Passkey | Ecosystem lock-in if not stored somewhere portable |
SMS codes — better than nothing, meaningfully worse than everything else. SIM swapping — where SIM stands for subscriber identity module, the chip that ties your number to your phone — is a real, industrialised attack: someone social-engineers your carrier into moving your number to their SIM, and now they receive your codes. Where possible, remove your phone number as a 2FA method entirely, or at least demote it from being a recovery option.
TOTP (time-based one-time password — the 6-digit rotating codes) — the sweet spot for most accounts. Use a dedicated app rather than one tied to a single vendor:
- Aegis (Android, open source, encrypted exports)
- Ente Auth (cross-platform, open source, end-to-end encrypted sync)
- 2FAS (cross-platform, open source)
A note on storing TOTP secrets in your password manager: it's convenient, and it's a real reduction in security, because your vault now holds both factors. My take is that it's an acceptable trade for low-stakes accounts and a bad one for your email, your bank, and your code hosting. Keep those in a separate app.
Hardware security keys — YubiKey, Nitrokey, Google Titan. These implement FIDO2/WebAuthn (Fast Identity Online 2 and Web Authentication, the open standards behind passkeys and security keys). They are phishing-proof in a way TOTP is not: the key cryptographically checks the domain it's talking to, so a lookalike site gets nothing. If you protect anything valuable, this is the upgrade.
Buy two keys. One lives on your keyring, one lives in a drawer at home. Register both on every account that supports them. A single hardware key is a single point of failure, and losing it while it's your only factor is genuinely painful.
Recovery codes: the part everyone skips
When you enable 2FA, most services hand you a list of one-time backup codes. This is the moment where people click "OK" and never think about it again.
Those codes are what save you when your phone ends up at the bottom of a lake. Treat them as seriously as the accounts they protect:
- Print them. Store them with your passport and birth certificate, or in a safe.
- Or store them encrypted in a file, in a location that is not the account they unlock. Storing your Google recovery codes in Google Drive is a beautiful circular trap.
- Never store them in a plaintext note, in your email, or in a screenshot in your camera roll (which is probably syncing to the cloud account they protect).
For the encrypted-file route, age (a small modern file-encryption tool) is pleasantly simple:
# encrypt with a passphrase
age -p -o recovery-codes.age recovery-codes.txt
# decrypt later
age -d recovery-codes.age > recovery-codes.txt
Then put the .age file wherever you like — cloud storage, a USB (Universal Serial Bus) stick, both. The encryption is doing the work, so the storage location matters much less.
Audit your recovery paths. This is the most under-examined attack surface in any account. Ask: if an attacker clicked "forgot password", what would they need? Often the honest answer is "access to an old email address I abandoned in 2011" or "my phone number". Go and remove stale recovery emails and phone numbers from your important accounts. An account is only as strong as its weakest recovery route.
Worked example: locking down a Google account
I'm using Google here as an example because it's the account most people have and the one most likely to be the root of their identity tree. The same principles apply to Apple, Microsoft, Proton, Fastmail and anything else — the menu names differ, the concepts don't.
Walk through these:
- Security Checkup — review devices, third-party apps with access, and recent activity. Revoke anything you don't recognise or no longer use. That app you authorised once in 2019 still has a token.
- 2-Step Verification — enable it, add a hardware key or authenticator app, then remove SMS as a method if you have stronger options registered.
- Backup codes — generate, print, store offline. Regenerate them if you ever suspect they've been exposed.
- Recovery email and phone — make sure the recovery email is an account you still control and that is itself secured with 2FA.
- Advanced Protection Program — Google's hardened mode, requiring hardware keys and restricting third-party app access. It used to be aimed at journalists and campaign staff, but it's available to anyone and it's a reasonable choice if this account is your identity backbone. Expect some friction with third-party mail clients.
- App passwords — audit and delete any that exist. They're a 2FA bypass by design, and old ones tend to linger.
- Google Takeout — export your data. More on this in the backups section below.
Equivalents elsewhere, since you should do the same sweep on each:
- Apple — Settings → your name → Sign-In & Security. Enable Advanced Data Protection for end-to-end encrypted iCloud, and set up a recovery key and/or recovery contact.
- Microsoft — account.microsoft.com/security. Watch the recovery options here especially; they're easy to leave stale.
- GitHub / GitLab — 2FA is mandatory on GitHub for contributors now. Also audit your SSH (Secure Shell) keys, personal access tokens, and OAuth app grants (OAuth is the standard that lets a third-party app act on your account). Tokens are a common forgotten backdoor.
- Your domain registrar — genuinely one of the highest-stakes accounts you own. Lose your domain and you lose the email addresses that recover everything else. Enable 2FA and registrar lock.
- Your bank — often the worst offender, frequently offering only SMS. Use what they give you and set up transaction alerts.
- Password manager itself — put 2FA on the vault too.
Backups: 3-2-1, and actually test them
Security includes availability. Ransomware, a dying SSD (solid-state drive) and a spilled coffee all end the same way if you have no copies.
The classic rule: three copies of your data, on two different media, one of them off-site. In practice, for most people:
Tools worth knowing:
| Tool | Interface | Encryption | Notes |
|---|---|---|---|
| restic | Command line | Built in | Fast, deduplicating; backs up to S3, B2, SFTP and more |
| BorgBackup | Command line | Built in | Similar model, excellent compression; Linux/macOS |
| Duplicati / Kopia | Graphical | Built in | Friendly if you'd rather not live in a terminal |
| Time Machine / File History | Built into the OS | Optional | Good enough for the local tier |
(S3 is Amazon's Simple Storage Service, B2 is Backblaze's equivalent, and SFTP is the SSH File Transfer Protocol — i.e. restic talks to most places you could put a backup.)
A minimal restic setup:
# once
restic init --repo /mnt/backup/repo
# regularly (cron, systemd timer, launchd)
restic -r /mnt/backup/repo backup ~/Documents ~/Projects ~/Pictures
# prune old snapshots
restic -r /mnt/backup/repo forget --keep-daily 7 --keep-weekly 4 --keep-monthly 12 --prune
And then restore something. An untested backup is a hypothesis, not a backup. Once a quarter, pick a random file and pull it out of the archive. This is the step everyone skips and the step that turns a backup strategy into an actual safety net.
Don't forget the data you don't think of as files: your cloud accounts. Google Takeout, Apple's Data and Privacy export, and equivalent tools let you pull your mail, photos and documents into something you physically hold. Do it once a year. Cloud accounts get suspended, and appeals processes are famously opaque.
Encryption at rest
If your laptop is stolen, disk encryption is the difference between "I lost a laptop" and "someone has my SSH keys, browser sessions, and every document I own."
| Platform | Tool | Notes |
|---|---|---|
| macOS | FileVault | On by default on recent machines — verify it |
| Windows | BitLocker | Save the recovery key somewhere that isn't the encrypted machine |
| Linux | LUKS (Linux Unified Key Setup) | Ideally set up at install time |
| iOS / Android | Built in | Only as strong as your lock screen — a six-digit PIN (personal identification number) is much weaker than an alphanumeric passcode |
For individual files and portable drives: age for simple encryption, GPG (GNU Privacy Guard) if you need the wider ecosystem, VeraCrypt for encrypted containers and volumes.
The recurring theme: encryption moves the problem from "where is this stored" to "who holds the key". That's a much easier problem to reason about — but it means the key material and its backup are now the thing that matters.
Extra credit if you write code
A few things specific to developers, since our machines hold keys to production systems:
- SSH keys — use ed25519, protect them with a passphrase, and consider keeping them on a hardware key (
ssh-keygen -t ed25519-sk). Keys with no passphrase sitting in~/.sshare a gift to anyone with your laptop. - Sign your commits — GPG or SSH signing. It stops someone pushing commits with your name on them.
- Scan for secrets before they land — gitleaks or trufflehog as a pre-commit hook. Everyone commits a
.enveventually. - Rotate tokens — personal access tokens and CI (continuous integration) secrets should have expiry dates. Audit them periodically; the ones you forgot about are the risky ones.
A leaked secret is a leaked secret — deleting the commit does not undo it. Rotate the credential, always, immediately. Git history is forever and scrapers are fast.
The short version
If you do nothing else this week:
- Install a password manager, set a strong passphrase, write it on paper and store it safely.
- Change the password on your primary email account to a generated one.
- Turn on 2FA there with an authenticator app or hardware key.
- Print the backup codes and put them somewhere physical.
- Remove stale recovery emails and phone numbers.
- Verify disk encryption is on.
- Set up one automated backup, then restore a file from it.
That's maybe two hours, and it eliminates the overwhelming majority of realistic ways you lose control of your digital life. The rest — hardware keys, off-site backups, encrypted archives — you can layer on over the following months.
Security isn't a product you buy — it's a handful of habits that make the difference between a bad afternoon and a catastrophe.