How to Harden Your Online Accounts

Step by step

1. 5 min

   Deploy a dedicated password manager

   Install a reputable, encrypted password manager to generate and store unique, high-entropy credentials for every account. Never reuse passwords across services, as a breach in one platform risks your entire digital footprint. Use the vault’s built-in generator to create strings exceeding 20 characters.

   Note: Choose an application with end-to-end encryption and zero-knowledge architecture.
2. 10 min

   Enable multi-factor authentication everywhere

   Navigate to the Security settings of every high-value account and toggle on multi-factor authentication (MFA). Prioritize hardware security keys (FIDO2/U2F) or Time-based One-Time Password (TOTP) apps over SMS-based codes. SMS is vulnerable to SIM-swapping attacks and should be avoided.

   Note: Use an encrypted authenticator app like Raivo or 2FAS to sync codes across devices.
3. 8 min

   Review and revoke active sessions

   Access your account settings and locate the Devices or Sessions management panel. Identify every browser, mobile device, or third-party application currently holding an active session. Terminate all entries that are not actively in use to minimize your attack surface.

   Note: Do this periodically to catch forgotten logins on public or shared computers.
4. 5 min

   Remove stale third-party access permissions

   Check the Authorized Apps or Connected Accounts section of your primary email and social profiles. Scan for legacy services or apps you no longer use that maintain 'Sign in with' access. Revoke permissions for any application that does not require active integration with your account.

   Note: This prevents data leakage if a low-security third-party service is breached.
5. 3 min

   Secure and store your recovery codes

   Download or print the recovery codes provided when MFA was initially configured. Store these in a physically secure location or within an offline, encrypted text file separate from your primary password vault. These are your final resort if your authentication device is lost or destroyed.

   Note: Never store recovery codes in cloud-synced notes or unencrypted text files.
6. 2 min

   Monitor for unauthorized data breaches

   Sign up for breach notification alerts to monitor your email addresses and phone numbers against known database leaks. If a service you use is compromised, immediately change your password and refresh your API tokens. Use reputable, privacy-focused monitoring services that do not store your full password data.

   Note: A notification of a breach is a signal to rotate credentials, not a sign of an immediate hack.