Security & Privacy
A clear, jargon-free guide to securing your email account, covering strong passwords, two-factor authentication, phishing red flags, and recovery settings.
The single highest-impact move is turning on two-factor authentication, ideally a passkey or an authenticator app rather than an SMS code, because it stops an attacker who already knows your password. After that, give the account a unique password of at least 16 characters kept in a password manager, then audit two settings almost nobody checks: mail forwarding rules and connected third-party apps. Your email deserves this attention because it is the reset point for nearly every other account you own, so whoever controls the inbox can trigger password resets everywhere else and intercept the links as they arrive.
The rest of this guide explains exactly where each setting lives and why it matters.
2FA means signing in requires something you know (your password) plus something you have (your phone or a hardware key). Not all second factors are equal, so choose in this order.
A passkey is a cryptographic credential stored on your phone or computer, built on the FIDO2/WebAuthn standard. It never transmits a reusable secret, and it is cryptographically bound to the real website's domain, so a fake login page simply cannot use it. That domain-binding is what "phishing-resistant" actually means. Google, Apple, and Microsoft all support passkeys for their own accounts today. A physical FIDO2 security key such as a YubiKey works the same way and is the gold standard for high-risk accounts.
If passkeys are not an option, use an authenticator app. These generate a six-digit code that rotates every 30 seconds using the TOTP standard (RFC 6238). Good choices are Google Authenticator, Microsoft Authenticator, or Authy. During setup you scan a QR code once; from then on the codes are generated on the device itself, with no internet or cell signal required.
Codes sent by SMS are far better than nothing, but they are vulnerable to SIM-swapping, where an attacker convinces your mobile carrier to move your number to their SIM and then quietly receives your codes. Use SMS only if it is the sole option your provider offers. To enable 2FA generally: Google Account > Security > 2-Step Verification, or account.microsoft.com > Security > Two-step verification.
Google's 2019 research with New York University found that adding a device-based second step blocked 100% of automated bot attacks and roughly 99% of bulk phishing attempts. That is a good illustration of why this one setting does more than any other on this list.
Length beats complexity. A four-word passphrase like "harbor-lantern-copper-drift" is both easier to remember and harder to crack than "P@ss1!". Aim for 16 characters or more. Uniqueness matters just as much: if you reuse your email password anywhere and that site is breached, attackers will "credential-stuff" the same combination against your inbox automatically, at scale.
A password manager (Bitwarden, 1Password, iCloud Keychain, or the one built into Chrome) generates and stores a distinct password for every account, so you only memorize one strong master password. Check whether your address has turned up in a known breach at haveibeenpwned.com; if it has, change that password immediately rather than waiting.
When someone does break in, they rarely just read your mail. They set up ways to keep access even after you change your password. These are the settings most people never open, and exactly where you should look first if you suspect trouble.
An attacker can add a rule that silently forwards a copy of every incoming message to their own address, or a filter that auto-deletes password-reset emails so you never see the alarm. Inspect both:
Delete anything you did not set up yourself.
Over the years you grant apps access to your account through OAuth: every "Sign in with Google" button, calendar tool, or old mail client is a standing key that survives a password change. Review and revoke what you no longer use.
Even a perfectly locked account falls if you hand over the password yourself, which is the entire goal of phishing. The tell-tale signs are consistent once you know them.
The single safest habit is never to log in through a link in an email. If a message claims there is a problem, open a new browser tab and type the company's address yourself. In Gmail you can flag a suspicious message via the three-dot menu > Report phishing, which also helps protect other people.
The common error is treating 2FA as the finish line and ignoring the two follow-ups above. A determined attacker who phishes a one-time SMS code can still plant a forwarding rule in the same session, and that rule keeps feeding them your mail long after you have reset the password. Securing the login without auditing forwarding, filters, and connected apps leaves the back door propped open.
Recovery options are how you get back in when you are locked out, and how an attacker gets in if they are stale or point at an address you no longer control. Set them deliberately.
Do a five-minute pass on this every few months and remove any device or recovery contact you do not recognize.
Yes. SMS codes can be intercepted through SIM-swapping, where an attacker ports your number onto their own SIM. Authenticator apps generate codes on your device with no signal required, so there is nothing to intercept over the network. Passkeys are safer still, because they cannot be phished at all.
This is exactly what backup codes are for, so store them offline before you ever need them. Several authenticator apps, including Authy and Microsoft Authenticator, also offer encrypted cloud backup so your codes restore to a new phone. As a last resort, your recovery email and phone let the provider re-verify your identity.
Not on a fixed schedule. Forced rotation tends to produce weaker, patterned passwords like "Summer2025" then "Summer2026". Change it when there is a real reason: a breach notification, a device you no longer trust, or any sign of compromise. A long, unique password paired with 2FA protects you far more than frequent changes.
For Google, Microsoft, and Apple accounts, yes. You can sign in with a passkey today, and it is the most phishing-resistant method available. Keep your password and 2FA as a fallback for older devices that do not yet support passkeys. Over time, passkeys are on track to become the default rather than the exception.
Theo writes about online safety the way a good friend would — clearly, calmly, and without trying to scare you. He's interested in the simple habits that stop most problems, and he thinks staying private online is a skill anyone can learn.
Keep reading
A reassuring, jargon-free guide to spotting fake online stores, covering the warning signs in prices, contact details, payment options, and reviews.
Theo Vance
A calm, jargon-free guide to protecting your privacy on your phone, covering app permissions, location sharing, lock screens, and trimming back data tracking.
Theo Vance