Stay safe out there.

Passwords

• Use a different password for every account

  When one site is breached, attackers try the leaked email and password on hundreds of other sites. A unique password keeps that leak contained to one account.

• Let a password manager remember them

  Nobody can memorise 100 random passwords. A reputable password manager stores them encrypted, fills them in for you and only autofills on the real site — which also helps against fake login pages.

• Length beats clever tricks

  Aim for 16+ random characters. Swapping letters for symbols (p@ssw0rd) fools no one — attackers' tools try those patterns first. For passwords you must type or remember, use a passphrase of 4–6 random words.

• Change passwords when there's a reason

  Forced changes every 90 days tend to produce weaker passwords (Summer2025! → Autumn2025!). Change a password right away if a service reports a breach or you suspect someone else knows it.

• Treat security questions like passwords

  Your first pet or mother's maiden name can often be found on social media. Give a random answer instead and save it in your password manager.

Accounts

• Turn on two-factor authentication (2FA)

  A second step stops most account takeovers even if your password leaks. Prefer an authenticator app or a hardware security key over SMS codes, which can be intercepted through SIM swapping.

• Use passkeys where offered

  Passkeys replace passwords with a key stored on your device, unlocked with your fingerprint, face or PIN. They can't be phished or reused, so switch to them on sites that support them.

• Protect your email above all

  Your email can reset the password of almost every other account. Give it your strongest password and 2FA, and review its recovery phone number and backup address.

• Check whether you've been breached

  Services like Have I Been Pwned tell you if your email appeared in a known data breach. Change any affected passwords, and anywhere you reused them.

Everyday habits

• Watch out for phishing

  Be suspicious of urgent messages asking you to log in, pay or "verify" something. Don't follow the link — open the app or type the site's address yourself, and check the domain carefully.

• Keep everything updated

  Updates for your phone, computer, browser and apps fix security holes that attackers actively exploit. Turn on automatic updates wherever you can.

• Be careful on public Wi-Fi

  Stick to sites that use HTTPS, avoid installing anything a captive portal asks for, and use your phone's mobile data for banking if you're unsure about a network.

• Never share passwords or codes

  Real support staff will never ask for your password or 2FA code. If you need to share access, use your password manager's sharing feature rather than chat or email.

• Lock your devices

  Use a PIN, fingerprint or face unlock with a short auto-lock time, and turn on device encryption and "find my device" so a lost phone doesn't become a lost identity.