Fix your email first
Your email address is the master key to your whole digital life. Every account you own has a "forgot password" button. That button sends a reset link to your email. So if someone gets into your email, they can take over everything else, one account at a time. No other step on this page matters until this one is done.
1. Is your email address good enough?
Good: @gmail.com, @icloud.com, @outlook.com, @hotmail.com, @proton.me. They are free, they are not tied to any subscription, they are yours for life. Every one of them lets you switch on 2FA and a passkey.
Not good: an address from your internet provider. In Belgium that means @telenet.be, @pandora.be, @skynet.be, @proximus.be, @scarlet.be, @voo.be and @belgacom.net.
The problem is not the provider. The problem is that the address belongs to your subscription, not to you.
The day you switch provider, the countdown starts. Belgian providers have to give you free access for 18 months after you cancel. After that they are allowed to charge you for it. In practice people lose access sooner.
Now picture that happening while your bank, your government login, your insurance and your Instagram all still send their password resets to that address. You cannot reset any of them, because you cannot read the email any more. That is not a hack. That is just moving house.
Also not good: your work or school address, because it belongs to your employer or school and disappears when you leave, plus any old address you can no longer log in to.
2. Create a Gmail address (if you need one)
- Open gmail.com in your browser or install the Gmail app.
- Tap Create account, then For my personal use.
- Fill in your name and date of birth.
- Choose an address. Keep it simple and permanent, like your name plus a number. Avoid nicknames you may regret in 10 years.
- When asked for a password, let your phone suggest a strong one and save it.
- Add a recovery phone number and a second recovery email. These get you back in if you are ever locked out.
3. Turn on 2FA and a passkey straight away
A new email account without 2FA is not yet safe. In Gmail: your profile picture → Manage your Google Account → Security → 2-Step Verification → Turn on. Choose a passkey or an authenticator app rather than text messages if you are offered the choice. While you are on that screen, add a passkey too.
4. Save the backup codes you are about to see
When you switch on 2FA, the website shows you a list of 8 to 10 backup codes (sometimes called recovery codes). Do not click past this screen. These are your emergency way back in if you lose your phone. Without them, losing your phone can mean losing the account forever.
Each code works once. Save them now, in one of these places:
- Best: in your password manager. Open the entry for that account and paste the codes into the Notes field, so the codes live right next to the login.
- Also good: on paper. Print them or write them down. Keep the paper with your passport and other important documents at home.
- Also good: in a locked note. On iPhone, the Notes app can lock a note behind Face ID.
- ❌ In your email inbox
- ❌ As a screenshot in your photos
- ❌ In a file called "passwords" on your desktop
- ✅ Save them the moment you see them
- ✅ Keep them somewhere only you can reach
- ✅ Cross one off after you use it
More detail: card 3 (Recovery Codes)
Make your list of important accounts
You do not have to secure the whole internet. You have to secure about 10 accounts. Everything else can wait, or does not matter at all if it is lost.
Write the list on paper. It takes 5 minutes and it turns a vague worry into a job with an end.
1. Start with what hurts most if it is stolen
- Money: your banking apps, PayPal, Revolut, Wise, any investment or crypto app
- Your identity: itsme, MyMinfin and your other government logins, health insurance, pension
- The accounts that control your phone: Apple Account (iCloud) or Google Account
- Your email itself, which you already did in step 1
- Social media: Instagram, Facebook, LinkedIn, TikTok, Snapchat, X, YouTube
- Shopping and subscriptions: Amazon, Zalando, Bol, Coolblue, Netflix, Spotify
- Utilities: mobile provider, energy, insurance
2. Put them in order
Number them, with the one that would ruin your month at the top. That is almost always your bank, followed by anything holding your identity documents.
Do the routine, once per account
Here is the trick that saves you hours. Do not go through all your accounts 4 times, once for your email, once for passwords, once for 2FA and once for passkeys. Go through each account once and do everything while you are already in there.
Almost every app hides this in the same place: Settings → Account → Security, or Settings → Password and security.
1. The routine, about 10 minutes per account
- Change the email address to your new one from step 1.
- Set a new password and let your password manager invent and save it. Never reuse one.
- Turn on 2FA. Pick an authenticator app or a passkey over text messages when you are offered the choice.
- Save the backup codes it shows you, the same way you did in step 1.
- Add a passkey if the account offers one. It takes about 10 seconds and it is the strongest login that exists today.
2. Where your passwords should live
Is it really safe to keep all my passwords in one place? Yes. It is far safer than the alternative. Your passwords are stored scrambled. Only your face, fingerprint or device code can unlock them. Nobody at Apple or Google can read them. Compare that to reusing "Summer2023!" on 40 websites, where a single leak exposes all 40.
3. Work down your list
Bank first, then your identity logins, then social media, then the rest. Tick each one off on the paper list from step 2. For the accounts that did not make your list, just do the routine the next time you happen to log in.
More detail: card 1 (Passwords) and card 2 (Multi-Factor Auth)
Lock the phone that holds it all
You have just moved your entire digital life behind one phone. That is the right thing to do. It means the phone itself now deserves 5 minutes of attention.
If you have an iPhone, there is only 1 password you need to keep in your head: your Apple Account password, the one most people call their iCloud login. Make it long and unique, used on nothing else. Every other password in your life goes into the Passwords app, where you never have to think about it again.
On Android: exactly the same, with your Google Account password and Google Password Manager.
1. The one thing that is not a password, but matters just as much
Your phone passcode. You type it every day, so you will not forget it. That is why it does not count as something to memorise. But it is the real master key:
- It opens your Passwords app whenever Face ID does not work.
- It can be used to reset your Apple Account password.
So someone who watches you type your passcode in a café and then steals your phone can lock you out of your own account within minutes. This is a real and common theft, not a hypothetical.
Two settings stop it:
- Use 6 digits at minimum. Even better, use letters: Settings → Face ID & Passcode → Change Passcode → Passcode Options → Custom Alphanumeric Code.
- Turn on Stolen Device Protection: Settings → Face ID & Passcode → Stolen Device Protection. Away from home, changing your Apple Account password then needs Face ID plus a 1 hour delay, so a thief with your passcode cannot take your account.
And cover your screen when you type your passcode in public, the same way you would at a cash machine.
2. Turn on Find My
This lets you find, lock or wipe the phone from any other device if it is lost or stolen.
3. Make sure you can get back in
Everything now sits behind one account, so give yourself a way back in before you need it.
- Write your Apple Account password on paper and keep it at home with your important documents. Not in a note on your phone, because your phone is the thing you might lose.
- Check your trusted phone number is current and add a recovery contact, someone you trust who can help you back in: Settings → your name → Sign-In & Security → Account Recovery.
More detail: card 11 (Securing Your Phone)