Passwords and account security

Passwords, PINs, passkeys, security codes… it can feel as though signing in has become a job in itself.

You don’t need to understand every technical detail. Start by protecting your most important accounts and making sure you can recover them if something goes wrong.

Protect your main email account first

Your email often holds the keys to your other accounts. Password-reset messages for shopping, social media and other services usually arrive there.

Give it a strong, unique password—or use a passkey where supported—and check its recovery details.

What’s the difference?

A password is a secret you use to access an account. Each important account should have a different one.

A device PIN usually unlocks a particular phone or computer. It is not necessarily the password for your Microsoft, Apple or Google account.

Two-step verification adds another check when you sign in. This might involve an authenticator app, a security key or a code.

A passkey is a digital credential that can let you sign in using your device’s face recognition, fingerprint or screen-lock PIN. You don’t invent or remember it yourself.

Make remembering easier

A reputable password manager can create and store different passwords for your accounts. Your phone or browser may already include one.

Choose a system that works across the devices you actually use. Protect the account that holds your password collection, and understand its recovery arrangements.

If you share a computer, use separate user accounts so your saved passwords aren’t casually available to everyone using it.

Should I use passkeys?

The National Cyber Security Centre recommends passkeys wherever available. They help protect against fake sign-in websites and remove some of the remembering.

Before relying on one, check where it is stored and how you would sign in after losing or replacing your device. Some passkeys sync through an account; others stay on a particular device or security key.

Where passkeys aren’t available, use a strong, unique password and enable two-step verification.

Prepare before you get locked out

Take a few minutes to check:

Is your recovery telephone number current?
Can you still access your recovery email?
Have you stored any recovery codes somewhere safe?
Do you know which account contains your saved passwords?
Will your authenticator or passkeys transfer when you change phones?

Never read out a sign-in code or approve a login simply because an unexpected caller asks you to.

What I can help with

We can identify your important accounts, choose a manageable way of signing in and check recovery arrangements together. You don’t need to change everything in one afternoon.