Most email takeovers start with a stolen or reused password. Five settings make that password far less useful to anyone else.
TL;DR
- Use a long, unique password for your email and nowhere else.
- Turn on multi-factor authentication, ideally with an authenticator app, a security key or a passkey.
- Keep your recovery phone number and email address up to date.
- Check your recent sign-ins and connected apps every few months.
Your email account is where password reset links arrive, so whoever controls it can usually take over your other accounts too. These five steps make that much harder.
1. Use a password that exists nowhere else
When a website is breached, criminals try the stolen email-and-password pairs on email accounts. If your email password is unique, those attempts fail.
Make it long. A passphrase of several unrelated words is easier to remember and stronger than a short jumble of symbols. A password manager can create and store unique passwords for every other account.
2. Turn on multi-factor authentication
Multi-factor authentication (MFA) asks for a second proof of identity, such as a code or a tap on your phone, when you sign in from a new device. The Federal Trade Commission recommends it because even if scammers get your password, it makes it harder for them to log in.
The options, from good to best:
- Text message codes: far better than nothing.
- Authenticator apps: codes generated on your phone, which can’t be intercepted in transit like a text.
- Security keys and passkeys: the Cybersecurity and Infrastructure Security Agency (CISA) describes these as phishing-resistant, because they won’t work on a fake login page.
Tip
When you turn on MFA, save the backup codes your provider offers and store them somewhere safe, such as your password manager or a printed copy at home. They get you in if you lose your phone.
3. Try a passkey
Most major email providers now support passkeys. Instead of typing a password, you confirm the sign-in with your fingerprint, face or device PIN. Because there’s no password to type into a fake page, passkeys stop most phishing attacks outright.
4. Keep recovery details current
Check that the recovery phone number and backup email address on your account are ones you still control. An old number that’s been reassigned to someone else is a weak point, and attackers who get in often change these details first.
5. Check sign-ins and connected apps
Every few months, look at your account’s security page:
- recent sign-in activity and devices you don’t recognize
- third-party apps with access to your mail
- forwarding rules and filters you didn’t create
Remove anything unfamiliar. If you find signs of a break-in, follow our steps for a hacked email account, and brush up on how to spot a phishing email so it doesn’t happen again.
Quick answers
Q: Are text message codes good enough?
A: They’re much better than a password alone. Authenticator apps, security keys and passkeys are stronger, because they’re harder for scammers to intercept or trick you into sharing.
Q: Is a password manager safe to use?
A: A reputable password manager makes it practical to use a different strong password everywhere, which protects you when one website is breached. Protect the manager itself with a strong master password and multi-factor authentication.
Q: What is a passkey?
A: A passkey replaces your password with a key stored on your phone or computer, unlocked with your fingerprint, face or device PIN. It can’t be phished the way a typed password can.
Email services change their settings and menus often. This guide is general information, not legal or professional security advice; check your provider’s help pages and official sources such as FTC.gov and CISA.gov.
