Correction, 11 October 2026: I corrected the 1Password and Apple account-recovery instructions and clarified what hardware keys protect. If you followed the earlier version, please revisit the recovery sections.

Personal digital security starts with a few practical habits: unique passwords, phishing-resistant sign-in, software updates and a recovery plan you can use after losing your phone.

This is the short version of my Digital Security: The Full Guide. Allow an afternoon for the account setup. Hardware keys are a next step; you can complete the basics without buying them. The full guide covers recovery kits, travel and provider-specific exceptions.

1. Get a password manager

Install 1Password, choosing Individual for yourself or Families for shared vaults and organiser-assisted recovery. Check the current subscription price. Let it generate a unique password for each site, and choose a strong account passphrase from five randomly selected words. Print the Emergency Kit and store it safely, including a paper backup of your account password.

Bitwarden, Proton Pass, Google Password Manager and Apple Passwords can also be suitable. If your existing manager works for you, keep it. If you switch, check what the migration carries and test passwords, passkeys, attachments and sign-in codes before closing the old account.

2. Stop reusing passwords

Replace reused or compromised passwords, starting with email, banking, your phone carrier and important social accounts. Your password manager can generate and remember the replacements.

3. Turn on passkeys wherever they’re offered

Passkeys resist fake-login-site phishing because they are bound to the service. Use them where offered, saving everyday passkeys in your chosen manager if you want them across devices. They do not stop someone persuading you to send money or install malware, and weaker sign-in fallbacks still need attention.

Where passkeys are unavailable, enable multi-factor authentication (MFA). This adds another proof of identity alongside your password, such as a code from an authenticator app or a text message. You may also see it called two-factor authentication (2FA) or two-step verification.

Authenticator codes are useful, and SMS is better than no second factor. Codes for ordinary accounts can live in 1Password, but keep 1Password’s own authenticator and its recovery backup outside the vault. Make sure your primary email can also be recovered without it.

4. Turn on auto-updates, and lock your screen

Enable automatic security updates on your phone, computer and apps, and allow required restarts. Set a strong screen-lock code and automatic locking.

5. Back up important files

Turn on automatic backups for important photos and documents, and check that you can restore something.

6. Verify urgent money requests

A caller can impersonate a relative, including with a cloned voice. Hang up and call back on a number you already know before acting on an urgent money request. A private family word adds a check, but can itself be disclosed or stolen; it does not replace the callback. At work and in life, verify claims about changed payment details through an independent trusted channel.

Don’t get locked out

Prepare and test your password manager’s recovery method before you need it. The details below use 1Password as the example; other managers have their own instructions.

  • Your Emergency Kit and account password. The kit contains your sign-in address, email and Secret Key. For the password-based account described here, these details plus your configured second factor let you sign in on a new device; another linked device is not required.
  • An independent second factor. Keep an authenticator backup accessible without your phone or vault. If you use hardware keys, enrol a spare and keep it separately. A second signed-in device is useful redundancy.
  • Your account-specific recovery method. Generate a 1Password recovery code; it needs access to your email and leaves MFA enabled. Print email backup codes where offered. For Apple with security keys enabled, you need an enrolled key or trusted Apple device; losing all of them can permanently lock you out. Apple’s recovery limits.

On a Families plan, another organiser can help recover your 1Password account. If you are the only organiser, appoint another trusted organiser or follow the solo fallback recommendation. Support cannot reconstruct lost encryption credentials if every recovery route is gone.

Run the full guide’s recovery drill without your everyday phone, and check that the material stays accessible if your main devices are lost together.

Next step: add hardware keys

Protect 1Password and your primary email with enrolled hardware keys where supported. A Security Key C NFC from Yubico provides phishing-resistant authentication. It protects new sign-ins, not data already accessible on an infected or unlocked device.

Get two, checking current price, currency, shipping and device compatibility. Enrol both on each account and keep them separately. Apple requires two for its security-key mode; a 1Password family organiser cannot recover your Apple account.

Test before removing old sign-in methods. Keep a working session open while you try the spare key. For 1Password users without another family organiser, retain an independently backed-up authenticator fallback: it helps if both keys disappear, but its codes remain phishable. The full guide explains the trade-off.

Order the keys early if you plan to use them, then follow the enrolment and recovery instructions when they arrive.

Further reading