Start With Passwords — But Do It Right This Time

The most common entry point for account breaches isn’t a sophisticated hack. It’s a reused password from a site that got leaked years ago. Attackers buy lists of email/password combinations from old breaches and try them across banking sites, email providers, and social media accounts. If you’ve ever used the same password on two different sites, this is your immediate priority.

The fix is a password manager. Tools like Bitwarden (free tier, open-source), 1Password ($2.99/month), and the built-in managers in iOS and Android all do the same core job: generate a long, unique, random password for every account and remember it for you. You only need to remember one master password. That’s the entire trade-off.

A strong master password doesn’t need to be a random string of characters. A passphrase — four or five unrelated words strung together like correct-marble-dinner-fog-lamp — is both memorable and far harder to crack than P@ssw0rd123. Length matters more than complexity.

One thing password managers won’t do automatically: you’ll need to go back and update old accounts. Prioritize email, banking, and social media first. Those three categories cover the accounts that cause the most damage if compromised.

Two-Factor Authentication: Turn It On Everywhere That Matters

Two-factor authentication (2FA) means that logging into an account requires both your password and a second piece of verification — usually a six-digit code that expires after 30 seconds. Even if someone has your exact password, they can’t get in without that code.

There are three common forms of 2FA, and they’re not equally secure:

• Authenticator apps (Google Authenticator, Authy, built into 1Password): The best option for most people. Codes are generated locally on your device and can’t be intercepted via your phone number.
• SMS text codes: Better than nothing, but vulnerable to SIM-swapping attacks where someone convinces your carrier to transfer your number to their device. Don’t rely on this for high-value accounts like email or banking if an app option exists.
• Hardware security keys (YubiKey, Google Titan): The most secure option, but a practical choice mainly for journalists, executives, or anyone with a reason to be a high-value target. For most people, an authenticator app is sufficient.

At minimum, enable 2FA on your email, banking, and any account linked to a payment method. Email is the most critical: it’s the recovery mechanism for almost every other account you own. If someone gets into your email, they can reset passwords everywhere else.

Software Updates: The Boring Habit That Actually Prevents Most Attacks

Unpatched software is the root cause of a large proportion of successful cyberattacks — not just on individuals but on companies and governments. When a vulnerability is discovered in Windows, macOS, Android, iOS, or a browser, developers release a patch. Attackers know that millions of people delay installing updates, so they actively scan for devices still running the old version.

The practical rule: don’t delay operating system and browser updates. For your phone, enabling automatic updates in settings removes the decision entirely. For Windows and macOS, updates can be scheduled for times you’re not using the device — there’s no reason to run months-old software when a three-minute restart handles it.

Third-party apps matter too, especially browsers, PDF readers, and email clients. These are common attack vectors because they handle content from the internet constantly. Keeping them current closes the door on a large class of known exploits before they ever reach you.

One common misconception: antivirus software is a partial layer of protection, not a substitute for updates. Antivirus can catch known malware after it arrives. Patching prevents many attacks from succeeding in the first place.

Public Wi-Fi: What’s Actually Risky and What Isn’t

Public Wi-Fi advice has been overcomplicated for years. The honest picture in 2026: most sites and apps you use encrypt their traffic by default using HTTPS and TLS. Someone sitting on the same coffee shop Wi-Fi network as you can see that you’re connected, but can’t easily read what you’re sending to your bank or email provider if those connections are encrypted.

What’s still risky on public networks: logging into sites that don’t use HTTPS (look for the padlock icon in your browser — its absence is a warning), using apps that haven’t implemented proper encryption, and connecting to networks with generic names like “Free Airport WiFi” that might be set up specifically to intercept traffic.

A VPN (Virtual Private Network) adds a layer of protection by encrypting all your traffic and routing it through a secure server. Reputable options include Mullvad ($5/month, no-logs policy audited independently), ProtonVPN (free tier available, Swiss jurisdiction), and ExpressVPN ($8.32/month on annual plan). Free VPNs with no clear business model are a risk — if you’re not paying, your traffic data may be the product.

The realistic recommendation: enable your phone’s built-in Personal Hotspot for sensitive tasks like banking when you’re away from home. Save VPN spending for frequent travelers or anyone regularly using untrusted networks for work.

Phishing: How to Recognize It Before You Click

Phishing — fraudulent emails, texts, or links designed to steal your credentials or install malware — has become more convincing over time. The spelling-error-filled scam emails of the early 2000s still exist, but they share space with highly polished fakes that replicate bank websites or delivery notifications with near-perfect accuracy.

The reliable signals that something is off:

• The sender’s actual email domain doesn’t match the company. “[email protected]” is not Amazon. Look at what comes after the @ symbol.
• Urgency that doesn’t match context. Real banks don’t email you threatening to close your account in 24 hours unless you click a link immediately.
• Links that don’t go where they claim. Hover over any link before clicking. The URL that appears in the bottom bar of your browser is the real destination.
• Requests for information a company already has. Your bank knows your account number. If someone is asking you to “verify” it by entering it somewhere, that’s not your bank.

When in doubt, don’t click the link in the email. Instead, open a new browser tab and navigate directly to the website by typing the address yourself. If the email was legitimate, whatever action it wanted you to take will be visible from your actual account dashboard.

Device Security: What Happens When Your Phone or Laptop Gets Lost

Physical device security is often overlooked in favor of online threats, but a stolen or lost device with no PIN is a wide-open door. Enable a strong lock screen PIN or passphrase on both your phone and laptop. Six-digit PINs are significantly harder to brute-force than four-digit ones, and a short alphanumeric passphrase is better still.

Enable full-disk encryption if it isn’t already on. iPhones encrypt storage automatically when a passcode is set. Android devices running Android 10 and above are encrypted by default. For Windows laptops, BitLocker is built into Windows 11 Pro; for Home edition users, “Device Encryption” in Settings covers most modern hardware. Mac laptops use FileVault, enabled in System Settings under Privacy & Security.

Set up remote wipe capability before you need it. Find My on iPhone and iPad, Find My Device on Android, and Find My Mac on macOS all let you erase a device remotely if it’s stolen and connected to the internet. This won’t help if a device is immediately wiped by the thief — but it’s a meaningful safeguard for situations where the device is lost rather than stolen.

For managing and securing your software environment on Windows, our essential software guide covers the tools worth installing to keep your system both productive and protected.

What You Don’t Need to Worry About (Right Now)

Security advice can spiral into paranoia fast. To keep things grounded: the average person is not a target of nation-state hackers or sophisticated persistent threats. The attacks that affect most people are automated and opportunistic — attackers running scripts against millions of accounts looking for weak passwords and unpatched systems. The steps above address exactly those threats.

You don’t need a separate secure email provider for everyday use. You don’t need to run a Linux system to stay safe. You don’t need to cover your laptop camera with tape unless you have specific reasons to believe you’re a high-value target. The basics — unique passwords, 2FA, updated software, phishing awareness — eliminate the vast majority of real-world risk for an ordinary user.

If your needs grow (running a small business, handling sensitive client data, working in a field with elevated personal risk), the operating systems section covers how different platforms approach security at a deeper level. And if you’re thinking about securing your connected devices at home, our smart home security guide applies many of these same principles to IoT devices specifically.

Where to Go From Here

Start with the two highest-leverage actions: set up a password manager this week and enable two-factor authentication on your email today. Those two steps alone put you meaningfully ahead of most people’s default security posture. Everything else — VPN, hardware keys, encrypted storage — builds on that foundation and can be added over time.

For ongoing security news explained without the hysteria, the Cybersecurity and Infrastructure Security Agency (CISA) publishes practical guidance aimed at everyday users, not just IT professionals. It’s a reliable reference when you want to check whether a specific threat is worth acting on.

Security doesn’t have to be complicated — it just has to be consistent. A password manager, 2FA on important accounts, and updated software handle the scenarios that affect most people most of the time. Get those right first, and the rest is refinement.