Your Passwords Probably Suck: Lock Down These Accounts First

Your passwords probably suck. And honestly, that’s not even the biggest problem.

The bigger problem is that one bad password can unlock half your life. Once someone gets into your email, they can usually reset the password for almost everything else — your bank, your Amazon account, your Microsoft account. All of it.

So no, this isn’t about inventing one fancy password with a capital letter, a number, and an exclamation point on the end. That’s not a security plan. That’s password theater.

Prefer to watch instead of read? Here’s the full walkthrough — or skip it and keep reading below.

The Real Problem Isn’t One Weak Password

It’s reuse. The same password — or a slightly changed version of it — on multiple sites. Summer2024! on one account, Summer2025! on the next, the same thing with the site’s name tacked on the end of a third.

That’s not secure. That’s a pattern, and attackers understand patterns.

When some site you forgot you joined in 2014 gets breached, nobody sits there guessing your dog’s name. They take the leaked password and try it against your email and your bank. One leak becomes several compromised accounts.

Step 1: Lock Down Your Email

Not your streaming service. Not a forum you forgot about. Your email comes first, because it’s the password-reset button for everything else.

1. Change the password to something long and unique — not reused, not a variation of an old one.
2. Turn on multi-factor authentication (MFA). After your password, the site asks for a second step — usually a code from your phone. Even if someone steals your password, they can’t get in without it. Text-message codes are better than nothing, but use an authenticator app if your provider offers one.
3. Check your recovery options. Make sure the recovery email is still yours and the phone number is current. Remove anything you don’t recognize.
4. Review signed-in devices. Sign out old phones, old laptops, and any session you don’t recognize.

Everything else comes after this.

Step 2: Start Using a Password Manager

Once your email is secure, you need to stop reusing passwords — and unless you have the memory of a computer, that means a password manager. It creates a long, random password for every account and remembers them all. You remember one strong master password.

“But I don’t want all my passwords in one place.” I get it. But for most people, all their passwords already are in one place. It’s called using the same password everywhere. Or a notebook. Or clicking “Forgot password” every time and hoping email still works. That’s not a system. That’s digital roulette.

Give the password manager itself a strong master password and turn on MFA. It protects everything else, so treat it like a master key.

Step 3: Lock Down Anything That Moves Money

Banks, credit cards, PayPal — anything that can move money or stores payment details. For each: unique password, MFA on, recovery options checked.

Then turn on account alerts wherever they’re offered. You want to know when money moves, when a new device signs in, and when settings change. Make it harder to get in, and easier to notice when something weird happens.

And fix the recovery path, because that’s the step people skip. An old recovery email, an outdated phone number, or security questions answered with things people can find online — your first car, your high school, your mother’s maiden name — are all ways around your strong password. If you have to use security questions, give fake answers and store them in your password manager. If the recovery path is weak, the account is weak.

Step 4: Lock Down Microsoft, Google, and Apple

These aren’t just logins. They’re tied to your computer, your phone, your cloud files, your photos, and sometimes your saved passwords.

Same four things: unique password, MFA, recovery options, and trusted devices. Remove old phones, tablets, and laptops you no longer use. An old device that’s still trusted is a door you forgot you left open.

Step 5: Then Shopping and Social Accounts

Amazon, eBay, Facebook, and anything else that can spend money, message people as you, or embarrass you publicly. Scammers love these — a hijacked Facebook account gets used to message your friends with fake emergencies, and a hijacked Amazon account can place orders or change your address.

Lock them down the same way — after the first four. Don’t spend your first hour securing a recipe website while your email still uses the password you’ve had since 2006.

(If you want the bigger picture beyond passwords — scams, your phone, your router, backups — start here: 10 Things Making You Easy to Hack.)

The Short Version

1. Email first.
2. Then a password manager.
3. Then money accounts.
4. Then Microsoft, Google, and Apple.
5. Then shopping and social.

For each one: unique password, MFA on, recovery options checked, signed-in devices reviewed. That alone puts you ahead of most people.

Cleaning this up now is a lot easier than trying to get an account back after someone else is already inside it.

Stay grumpy.