Digital Security: The Full Guide

Correction, 11 October 2026: I corrected the 1Password and Apple account-recovery instructions and clarified what hardware keys protect. If you followed the earlier version, please revisit the recovery sections.

Start with Digital Security: Start Here for the account basics, updates, backups and scam-verification habits. This guide adds implementation detail, recovery planning and account-specific advice.

The examples use 1Password, but you can keep another password manager that meets your needs. Optional privacy choices are labelled separately.

Who this guide is for

This guide is for ordinary personal use on a phone and computer. No technical background is required.

The setup helps reduce exposure to:

Credential stuffing. Attackers take leaked username/password pairs from one site’s data breach and try them automatically against every other site you’ve signed up for. Works because people reuse passwords.
Phishing. Fake login pages that look real, designed to steal your password and your MFA code at the same time.
Lost or stolen devices. Someone finds your laptop on the train and tries to read everything on it.
Opportunistic malware. Drive-by downloads, malicious browser extensions, unpatched software being exploited by automated scanners.
SIM-swap attacks. An attacker convinces your phone carrier to port your number to a SIM they control, and starts intercepting your SMS codes.

This guide does not protect you against: a determined, well-resourced attacker who is specifically targeting you. If you’re a journalist, activist, politically exposed person, or you hold life-changing amounts of cryptocurrency, treat this as a starting point and see Beyond the baseline.

How to use it. Complete the starter first, then use the sections below for the details you need. Prepare recovery before removing any working sign-in method.

A note on terminology. I use MFA (multi-factor authentication) as the generic term throughout. You’ll also see 2FA (two-factor authentication) and 2SV (2-Step Verification, Google’s marketing name). They all mean the same thing: proving who you are in more than one way (something you know, something you have, something you are). I use MFA because it’s the most general and doesn’t hard-code an assumption about how many factors there are.

The stack at a glance

A reference map for the sections below.

Several specific picks below are borrowed from Andrej Karpathy’s Digital Hygiene. See Further reading for the inventory. The grouping is my own.

Tier 1: The account basics

Complete Digital Security: Start Here first. It covers the account basics, updates, backups and scam-verification habits. Continue below for hardware-key setup, recovery planning and account-specific details.

If you need help with migration, random-word passphrases or security questions, see Password manager details.

Tier 2: Hardware keys and passkeys

You need compatible security keys and time to enrol and test them. Check the current price, currency, shipping and device compatibility before ordering.

Why hardware keys?

An authenticator code can block someone who only has a leaked password, but it can also be captured and relayed by a fake login page. Passkeys and FIDO hardware keys resist that kind of phishing.

Keep the verification habits from the starter. For sign-in and software requests:

Never click login links in emails, SMS, or chat. Email sender addresses are trivially spoofable, and even a careful reader can be fooled by a well-made fake. When you get a message that wants you to sign into a service, open a new browser tab and type the service’s address yourself (or use a bookmark, or a URL you’ve deliberately chosen from a guide like this one; the rule is about links pushed at you, not links you type by hand). This avoids following a fake sign-in link supplied by the sender.

Never install remote-access software in response to an unsolicited support call or message. End the contact and use the organisation’s official support channel. A caller claiming to represent your bank or a software company is not proof of identity.

Hardware keys reduce reliance on spotting fake login pages:

The key won’t work on a site it’s not registered for.

FIDO authentication binds the credential to the service. The browser and authenticator check that relationship, so a lookalike domain cannot obtain an authentication response valid for the real site. This protects the sign-in exchange; it does not stop malware on your device or someone exploiting a weaker recovery route.

Keep checking unusual payment requests and software-install prompts: those attacks do not need to defeat the key.

What to buy

Get two Security Key C NFC keys from Yubico. Check the current price in your checkout currency, including shipping, and confirm the connector works with your devices.

Buy from Yubico directly or an authorised reseller. Avoid unknown marketplace sellers.

The FIDO-only Security Key line is sufficient for the website authentication described here. You do not need the more expensive YubiKey 5 Series unless you want its additional protocols or features.

Why two? An enrolled spare protects against losing or damaging the everyday key. Store them separately. Apple requires at least two for its security-key mode; see Apple’s requirements.

Why NFC? It lets compatible phones read the key with a tap. Check support on the devices you use.

What to enrol

Test your everyday devices and your spare key during setup. Enrolling a key changes how you authorise new sign-ins and may require reauthorising existing devices. Keep a working session open while testing, and do not remove an old factor until the new methods work. 1Password’s setup instructions cover its supported authentication flows.

Enrol both keys on, at minimum:

Primary email (Gmail / iCloud / Outlook)
1Password
Any Google / Apple / Microsoft accounts you have
GitHub if you have one

Official enrolment guides beat anything I can write here:

If setup asks you to create a security-key PIN, record it safely. The PIN belongs to the key, not the website. Repeated incorrect attempts can require a reset and re-enrolment, so do not guess if you have forgotten it.

After enrolling both keys, review the remaining sign-in and recovery methods. Removing SMS or authenticator codes can reduce phishing exposure, but only do so after testing an independent recovery route for that account. A spare key must be enrolled, accessible and stored separately from the everyday key.

Before changing fallbacks, read MFA storage and recovery and, on a Families plan, Who recovers the organiser?.

Passkeys, in one paragraph

Passkeys are phishing-resistant credentials that can be stored on a hardware key, device or in a syncing password manager. Use them where supported. Saving everyday passkeys in 1Password is convenient across devices; a hardware key can separately protect new sign-ins to 1Password. It does not encrypt your vault or protect data already accessible on a compromised device. The account password and Secret Key protect vault encryption. Authentication and encryption are separate layers.

Tier 3: The Recovery Kit and Fire Drill

Prepare a recovery route that works without your everyday phone, then rehearse it while you still have access.

The architecture

For the password-based 1Password account described here, normal sign-in on a new device uses your sign-in address, email, Secret Key, account password and configured second factor. Approval from another linked device is not required. The account password and Secret Key protect vault encryption; MFA protects account authentication. 1Password explains the distinction.

The practical goal is to keep the required material accessible without your main devices and arrange a recovery route that survives losing your home copy. A spare signed-in device helps, but does not replace that preparation.

The Home Kit

Keep recovery material in secure storage you can reach when needed:

Your 1Password Emergency Kit and account-password backup. The kit contains the sign-in details and Secret Key, including a setup QR code. Treat it as sensitive. 1Password recommends recording the password on a safely stored printed copy; separating it is an option described below.
An independent second factor. Keep a spare enrolled security key and its PIN, or an authenticator backup, accessible without the vault or everyday phone. See MFA storage and recovery.
Account-specific recovery material. A 1Password recovery code needs access to the account email and leaves MFA enabled. Google offers backup codes; Apple’s security-key mode instead needs an enrolled key or trusted Apple device. Use each provider’s instructions.
A reference sheet. Record bank and carrier support details and where any recovery material stored elsewhere can be found.

Check that the material is present and current. Protect it as carefully as the accounts it can unlock.

Optional: split the paper secrets

If theft of the paper kit is a concern, leave its account-password field blank and keep the password in a separate secure location. A sealed envelope with a trusted person or in secure off-site storage is one option. Make sure you can retrieve it when needed and that anyone intended to help knows the arrangement.

This limits what one stolen location reveals, at the cost of another item to maintain and retrieve. It does not guarantee safety if an attacker also obtains recovery codes, email access or an authorised device. Choose the arrangement you can reliably use.

What if my house burns down with the Home Kit inside?

Keep a usable recovery route away from the home copy. Options include a complete set of securely stored sign-in material, a recovery code with independent email and MFA access, another accessible signed-in device, or another family organiser. Test the route you choose; a password-only envelope does not replace a lost Secret Key.

If every usable credential and recovery route is lost, support cannot reconstruct the secrets needed to decrypt your vault.

Who recovers the organiser?

On a Families plan, another family organiser can initiate account recovery. An ordinary family member cannot, and an organiser cannot recover themselves through that route. If suitable, appoint another trusted organiser and tell the family who can help.

Organiser recovery applies to 1Password, not your email or Apple account. Solo users and sole organisers should follow the independent MFA fallback recommendation.

Travelling: the recovery pack that leaves home with you

Use the pre-trip checklist. The test is whether losing your phone and bag together would leave a usable route back into your accounts. Protect any paper secrets you carry.

The annual fire drill

Once a year, test sign-in without your everyday phone or an existing browser session. Repeat after material changes to devices, accounts or recovery arrangements.

Use a trusted personal computer and a fresh browser profile without extensions or existing sessions, such as Chrome Guest or a new Firefox profile. You do not need to factory-reset it or find a computer you have never used. Avoid public kiosks and managed work computers. A fresh browser profile does not protect against malware in the operating system.

Have your recovery material available and leave working devices and sign-in methods intact:

Sign in to 1Password. Open the sign-in address from your Emergency Kit. Enter your account details and password, authenticate with the spare key or configured authenticator, and open a vault item. If you retain an authenticator fallback, also test that you can reach it without your phone or vault.
Reach your primary email independently. Sign in using the prepared credentials and second factor. If email is needed to recover 1Password, it must not depend solely on the locked vault. Follow the provider’s recovery instructions.
Check bank and carrier access. Establish what each requires without the registered phone or SIM. Test a supported alternative where possible and record official support details and any in-person requirements. A second contact number is not automatically eligible for login codes.

A recovery-code reset changes your 1Password account details and requires signing in again on devices. It is a separate procedure, not necessary for this routine sign-in drill; read the recovery-code instructions before using it.

Sign out of the test sessions afterwards. Fix any gaps the drill exposes, update the stored material and check that your file backups can also be restored.

Tier 4: Devices and communications

Use this section to check data protection and recovery. Messaging privacy is an optional choice.

Full-disk encryption

Check that device encryption is enabled, and keep its recovery method accessible without the device.

macOS: turn on FileVault in System Settings and keep its recovery method accessible independently of the Mac.
Windows: check Device Encryption or BitLocker in Windows Settings. Availability depends on the device and Windows edition. Confirm encryption is active and save a recovery-key copy somewhere you can reach without that computer; if Windows saved it to your Microsoft account, check your recovery keys.
iPhone / Android: use a strong screen-lock passcode and keep the device supported and updated. Avoid short or easily observed codes.
Screen locking and disk encryption serve different purposes. Locking restricts access to the running session; encryption protects stored data. Keep automatic locking enabled.

Signal for sensitive messaging

Optional privacy choice: Signal is my recommendation for sensitive conversations. WhatsApp also protects message contents with end-to-end encryption; its metadata and backup arrangements differ. Switching messengers is not a prerequisite for completing the account-security steps.

If you use WhatsApp cloud backups, check whether end-to-end encrypted backups are enabled. Choose a disappearing-message period that suits the conversation; neither app prevents a recipient saving what you send.

Backups

The starter asks you to enable backups; here is how to check the arrangement. Include photos, documents, creative work, tax records and notes. The 3-2-1 model means three copies, on two kinds of storage, with one off-site. A computer, an external backup drive and a cloud backup are a practical example. Disconnect an external backup drive when it is not being used.

Backblaze Computer Backup is a straightforward option for supported Windows and Mac computers; check current pricing and compatibility. For a technical setup using Restic and Backblaze B2, see my automated backups guide.

Test a restore once setup is complete. Retrieve an important file and open it, ideally on another trusted computer. Check that you can reach the backup without relying on the lost device for credentials or MFA. Repeat during your recovery review and after changing the computer, backup tool or storage provider.

Retire old devices

Check the manufacturer’s security-support window for your specific model and operating system. Once updates end, stop using it for sensitive accounts and plan replacement.

Don’t log into personal accounts on work computers

An employer with administrative control of a device can install monitoring and security software, inspect activity, or access data during incident response. The exact capabilities and policies vary. Avoid putting your personal password vault and sensitive accounts on a device you do not control.

Keep personal and work accounts on different devices. Use your own phone or laptop for personal business. This applies specifically to managed devices (ones where an employer’s IT department holds admin rights); a personal laptop you also use for freelance work is fine.

Honest limits: what this guide doesn’t cover

The setup reduces common risks, but cannot guarantee account safety:

Compromised devices or software. Malware, a malicious browser extension or a compromised update can expose data when you use it, including an unlocked vault. Keep extensions to those you need and review permission changes.
Determined targeted attackers. This guide is a starting point for someone facing sustained, well-resourced attacks; seek advice suited to that situation.
Untrusted people or storage. Recovery arrangements depend on who can reach the material. If someone at home may misuse access, choose storage and help appropriate to that threat.
Physical coercion or compelled disclosure. Account authentication does not solve these situations. They require a separate assessment of what data to carry and how to respond.
Loss of every recovery route. See recovery planning. A single disaster should not take all usable routes.

Beyond the baseline

The options below address additional privacy needs or a realistic risk of targeted attacks. They are not prerequisites for the baseline. Consider them where they solve a specific problem:

Google Advanced Protection. Enforces a security-key-or-passkey on every login, restricts third-party app access, and adds extra download scanning plus a hardened account-recovery hold. Enrolment is much lower-friction now (a passkey works, where it once took two physical keys), but the ongoing restrictions still break some older apps and make recovery slower and stricter. Tier 2 already gave you the headline win (phishing-resistant Google login); APP’s extra is the app-access lockdown and recovery hardening. Real gain, still real friction. For a narrow population.
Compartmentalised email identities. Use an email aliasing service to mint a unique address for every account you sign up for. When a service is breached or starts spamming you, you kill the alias without affecting anything else. SimpleLogin (open source, Proton-owned) or Apple Hide My Email (Apple-only, bundled with iCloud+).
Virtual physical mail forwarding. A service receives your physical post, scans it, digitises it, and lets you decide per-item what to do (shred, forward, ignore). Your home address stops being given out to every merchant, subscription, or dinosaur institution. HotSnail serves Australia, but its public privacy material leaves key scan-security controls unverified; don’t route sensitive mail through it without satisfactory written answers. Virtual Post Mail serves the US.
Virtual card numbers. Where available, separately controlled or merchant-restricted cards can limit exposure. Check the provider’s actual controls; an ordinary digital card is not automatically disposable or merchant-specific.
Tor Browser for specific anonymous sessions.

Cryptocurrency custody, hot-wallet key management, hardware wallet hygiene, and seed-phrase backup strategy are all their own thing and out of scope for this post.

Australia-specific

myGov (ATO / Medicare / Centrelink)

Protect myGov with a unique password and a passkey where possible. Prepare another sign-in route before changing or deleting an existing one.

If you use time-based one-time passwords (TOTP), choose an authenticator that supports myGov’s required SHA256 algorithm. myGov’s instructions list compatible options and specifically exclude Microsoft Authenticator. A supported password manager can store these codes; keep 1Password’s own recovery dependencies separate as described in FAQ 19.

The old myGov Code Generator app is being retired; follow the current instructions to switch methods. If you lose a device, another passkey, the myGov app or a connected Digital ID may help, depending on what you set up. Some unresolved lockouts require a new account and relinking services. Use myGov’s sign-in help, rather than assuming a phone call can restore the account.

Australian banking

Bank authentication and replacement-phone enrolment differ by provider. Check the options your bank actually offers, including in-app approval, SMS or passkeys, and use the strongest supported method you can recover reliably.

Store a unique banking password in your manager where the bank uses one.
Establish how to regain access when both the phone and its SIM are unavailable. Ask about overseas identity checks and keep the international support number outside your phone.
Only rely on a secondary number if the bank confirms it can receive the relevant codes. A contact number, family member’s number or VoIP line is not automatically an authentication fallback.
Follow the bank’s travel-notification guidance and carry an independent way to pay while recovery is underway.

Australian phone carriers (Telstra, Optus, Vodafone, etc.)

Protect both the carrier account and the process for replacing or moving your number. These are different controls: a stronger website login does not by itself stop someone persuading support to issue a replacement SIM.

Check your carrier’s available sign-in methods. Telstra supports passkeys, including the option to turn off password sign-in. Other providers have their own arrangements.

Ask your carrier what checks apply to a replacement SIM and to porting your number, whether any additional account lock is available, and how you would complete those checks without the original phone while overseas. An app-unlock PIN is not necessarily a port-out PIN. Keep SMS off critical accounts where a recoverable, stronger alternative is available.

Card-not-present fraud

A separate virtual card can limit the consequences of merchant exposure, depending on its controls. A digital version of an ordinary debit card is not necessarily disposable or restricted to one merchant. Check what your provider offers, use transaction alerts and limits, and report suspicious charges promptly.

If the worst happens: identity-theft recovery (Australia)

Account takeover often turns into identity-fraud cleanup, and Australia has specific machinery for it. Keep these on your Home Kit reference sheet so you’re not googling them mid-panic:

IDCARE (1800 595 160), the free national identity and cyber support service. They build you a tailored response plan and talk to the institutions on your behalf. This is the first call after a serious compromise.
Place a credit ban. OAIC explains how to request a free 21-day ban, extend it and ask one credit reporting body to pass the request to the others. Confirm coverage and expiry. A ban restricts use and disclosure of your credit report; it does not prevent every kind of identity fraud.
ReportCyber, the official channel to report cybercrime to police; generates a report reference banks and insurers will ask for.
Cancel and reissue any exposed cards through your banking app, and if your Medicare or driver-licence numbers were exposed, replace those documents (Services Australia and your state transport authority both have compromised-credential processes).

Password manager details

Moving to another manager

Use the receiving manager’s current import instructions, such as Bitwarden to 1Password. Check which passwords, passkeys, authenticator codes, attachments and shared items transfer; an import may omit some of them. Treat export files as sensitive and remove them after verification.

Keep the old account until you have checked the migrated data and successfully used the new manager during normal sign-ins. For exporting from 1Password, see its export instructions.

Generating a random-word passphrase

Use the EFF diceware instructions to choose words randomly rather than inventing a memorable phrase. Keep a safe paper backup using your chosen recovery arrangement; do not rely on memorisation alone.

Security questions are passwords in disguise

For account-recovery questions such as a mother’s maiden name or childhood street, treat the answer as another password: generate a random answer and save it with the question in the account’s vault entry. Publicly discoverable biographical facts make poor recovery secrets.

FAQ

1. I’m about to travel for three weeks. What’s the pre-flight checklist?

Rehearse the fire drill without using your everyday phone, and test a backup restore.
Carry an enrolled key separately from your phone, and arrange access to the spare.
Make sure your Emergency Kit, memorised account password and MFA fallback remain accessible after losing your bag. Protect any paper secrets you carry.
Check email recovery independently of the vault. Do not make the missing phone the only route to both.
Keep your bank’s and carrier’s international support numbers outside your phone, establish their lost-phone procedures, and follow any travel-notification guidance.
If you bring a supported spare device, sign in and test it before departure. A spare is convenient, not a requirement for password-and-Secret-Key sign-in.
Agree a way to reach your trusted contact without your normal messaging apps, such as a call to a memorised number. Do not assume a fresh borrowed device can restore all your messaging sessions.

Before surrendering a device for inspection, powering it off reduces access to data in a running session and requires its passcode on restart. It does not prevent compelled disclosure; consider what data you need to carry in the first place.

2. I think I’m locked out right now. What do I do first?

Use a trusted device. Prefer your own supported spare. A guest browser session on a borrowed computer does not protect against malware in the operating system. Avoid public kiosks for vault access.
Try normal 1Password access first. Unlock an existing app if available, or sign in with the account details from your Emergency Kit, your account password and an enrolled key or configured authenticator. Do not reset a working spare device.
If account details are missing, use the recovery route you prepared. A recovery code requires access to the account email and leaves MFA enabled, so recover email first if you need that route. Another family organiser can initiate recovery where available. Follow FAQ 3 and FAQ 4; support cannot guarantee recovery of lost encryption credentials.
Restore bank and carrier access using their documented processes. Contact official support where necessary, and expect requirements to vary by provider. Use your independent payment option while access is unresolved.

3. What if I forget my 1Password master passphrase?

Retrieve the safely stored password backup from your recovery material. If you can still unlock an app with biometrics, preserve that access and follow 1Password’s forgotten-password instructions; biometric access may expire.

Otherwise, use your prepared recovery route. After recovery changes the account details, update the stored copies.

4. What if I lose both YubiKeys?

Recovery depends on the account:

1Password: use the independent authenticator fallback if you retained it. An existing authorised app or browser can also let you turn off MFA so you can enrol replacements. Another family organiser is a further recovery route. A recovery code alone does not turn off MFA.
Apple with security keys enabled: use a trusted Apple device to manage the keys. If every trusted device and enrolled key is lost, you may be permanently locked out. Apple’s instructions explain the limits.
Other accounts: use their configured backup or recovery methods. Do not assume that every provider offers printable codes.

Remove the lost keys from each account and enrol replacements. Restore strong MFA promptly after any temporary removal.

5. What if 1Password itself gets breached?

The account password and Secret Key protect the encrypted vault stored by 1Password. Theft of that encrypted data is different from compromise of an unlocked device or a malicious software update, which may expose secrets when you use them. Hardware-key MFA protects account authentication, not offline decryption or an already-compromised device. Keep the distinction in mind when assessing any breach report. 1Password’s security model.

6. What if 1Password goes out of business, or gets acquired by someone I don’t trust?

You can migrate, but check what the chosen method carries. Desktop 1PUX exports are broader than CSV, and both are unencrypted files: keep them off shared or synced storage and delete them after use. Desktop file exports do not include passkeys; supported mobile Credential Exchange flows can transfer them. Verify passwords, passkeys, MFA and attachments before closing the old account. 1Password export instructions.

7. If I store passkeys in 1Password, isn’t 1Password the single point of failure? And are passkeys really replacing passwords?

A manager makes passkeys convenient across devices, but concentrates access there. Protect the devices that can open it and keep recovery material independent. Passkeys and vault protection explains the separate roles of encryption, account MFA and device security.

8. My whole digital life is in 1Password. Doesn’t that terrify you?

A password manager concentrates access, which makes recoverability important. You should be able to regain access without the everyday phone or the vault itself. Use the fire drill to check that.

9. My Home Kit got stolen in a burglary. Now what?

Treat the kit’s contents as exposed. From a trusted device, remove the stolen key from every account where it was enrolled, replace recovery codes and any exposed authenticator seed, and regenerate your 1Password Secret Key. Change the account password if it may also be exposed. Rebuild the kit, enrol a replacement key and test recovery. Do not assume a separated password makes stolen recovery material harmless.

10. What if I die? How does my family access my accounts?

Write a short letter explaining the recovery material’s location and the complete access route, store it securely with your estate documents, and tell a trusted person it exists. For direct 1Password sign-in, the person needs the Emergency Kit, account password and a working second factor. If relying on organiser recovery, explain how the account email will be accessed too.

1Password’s Emergency Kit guidance recommends giving a copy to someone you trust. Apple’s Digital Legacy Contact and Google’s Inactive Account Manager offer provider-specific arrangements. Check what those arrangements allow and make sure the intended person understands your plan.

11. Do I really need two YubiKeys? Isn’t that paranoid? What if one breaks?

The spare protects against losing or damaging the everyday key. See What to buy for enrolment and storage advice, including Apple’s requirement.

12. Can I just use my phone as a YubiKey via Face ID?

Partly. Apple and Google support a flow called hybrid transport (cross-device passkeys). Your phone uses Bluetooth proximity to authorise a sign-in on a nearby laptop, with Face ID as the user check. It’s genuinely useful as a convenience. But it isn’t a substitute for a dedicated hardware key. Your phone is also the single most likely thing you’ll drop, lose, or have stolen. Use phone-as-key on top of your YubiKeys, not instead of them.

13. My partner shares my 1Password vault. If their phone is compromised, am I compromised?

A compromised device can expose any vault data accessible to that person, including shared vaults. Your personal vault is separate unless its contents or credentials have also been shared. Keep joint household logins in shared vaults and individual accounts in personal vaults. Hardware keys protect new sign-ins; they do not stop malware reading data from an already-authorised, unlocked app.

14. What happens to my Recovery Kit when I move house?

Keep the recovery material secure and accessible during the move. Update any changed storage locations and contact details, tell anyone who may need to help, and repeat the recovery drill.

15. Why do I need a password manager if Chrome already saves my passwords?

Google Password Manager can generate strong unique passwords, fill websites and apps, and work with a Google account protected by MFA. If it meets your needs, using it consistently is a sound starting point. A separate manager may suit a mixed-device household or shared-vault workflow better; that is the reason to consider switching.

16. Why 1Password instead of free Bitwarden or Apple’s iCloud Keychain?

Bitwarden and Apple Passwords are reasonable choices if they suit your devices and sharing needs. Apple also supports iCloud Passwords on Windows, so it is not simply Apple-only. Check compatibility with the devices you actually use. My preference for 1Password is its interface and family workflow, not a claim that the alternatives are inherently unsafe.

17. Is SMS MFA really that bad? My bank only supports it.

Use SMS if it is the only MFA offered; it is better than leaving a password as the sole check. Prefer phishing-resistant passkeys or hardware keys where supported. Authenticator codes avoid SIM-swap exposure but can still be phished. For SMS-dependent accounts, understand your carrier’s SIM-replacement checks and the service’s lost-phone recovery process.

18. My bank demands an SMS to my (lost) phone to let me log in. What now?

Use the bank’s official lost-phone process and support channel. Recovery requirements vary, so use your independent payment option while access is unresolved. See Australian banking for what to establish in advance.

19. Is it OK to store MFA codes in 1Password alongside my passwords?

For ordinary accounts, storing authenticator codes with the password is convenient and still protects against a password leaked elsewhere. Someone who obtains the unlocked vault, however, gets both.

Keep 1Password’s own TOTP in a separate authenticator, with a backup you can reach without the vault. If email is part of your 1Password recovery, make sure you can recover email independently too. An app such as Ente Auth supports encrypted backups, but its password and recovery material must not exist only inside the vault you are trying to recover.

For a solo user or the sole family organiser, I recommend keeping this independently backed-up TOTP fallback alongside enrolled hardware keys. It helps if both keys are lost. The trade-off is explicit: the fallback remains phishable, so the account is not hardware-key-only. Another family organiser or an accessible authorised device provides other recovery routes; a 1Password recovery code by itself leaves MFA enabled.

Test the fallback without your everyday phone or vault before relying on it, and never remove a working method until its replacement and recovery route are established.

20. My partner and family won’t do any of this. How do I handle shared accounts?

Help them set up the manager, sign-in protection and recovery together, using the devices they already understand. Put joint logins in a Families shared vault and keep individual logins separate. If someone will only accept a unique password and SMS MFA for an account, start there and make sure they know how to recover access.

21. What about my kids’ accounts?

Help children use unique passwords, supported MFA and age-appropriate recovery arrangements. A family organiser can help recover their 1Password account. Teach them not to disclose passwords or verification codes to callers or messages; legitimate sites still require passwords in their normal sign-in flows.

22. I already have decent passwords and SMS MFA. Isn’t that good enough?

Unique passwords and SMS MFA are useful progress. Where supported, passkeys or hardware keys improve resistance to fake login pages and SIM-swap attacks. Add them with tested recovery rather than treating enrolment alone as completion.