Guide · Technology

Protect your accounts: password managers, passkeys and security keys

Affiliate disclosure: US Brief may earn a commission from qualifying purchases through links on this page. As an Amazon Associate, US Brief earns from qualifying purchases. Read our affiliate disclosure.

Guide · Technology · AI-assisted · US Brief desk · Last reviewed October 19, 2026

Three habits do most of the work: a different strong password for every account, a second step at sign-in, and a plan for getting back in if you lose a phone or key.

1. Use a password manager

Nobody can remember a long, random, unique password for every account. A password manager generates strong passwords, stores them and fills them in for you, and it can flag weak or reused passwords. You only need to remember one strong passphrase: the one that unlocks the manager.

• Free, built-in options. Web browsers have built-in password managers, Apple devices include one (the Passwords app and iCloud Keychain), and Google Password Manager works in Chrome and on Android.
• Standalone managers. Some are free and some are paid. Compare which devices they support, how they handle sharing with family, and their security history before choosing.
• Start with what matters most. Change your email password first (password resets go there), then banking, phone carrier and social accounts.

2. Turn on multi-factor authentication (MFA)

MFA asks for a second proof at sign-in, so a stolen password alone isn’t enough. Look for it under “Security,” “Sign-in” or “2-step verification” in each account’s settings. Common options include codes sent by text message, codes from an authenticator app, sign-in prompts on your phone, passkeys and hardware security keys. Any MFA is better than none, but text-message codes can be intercepted or phished, so use a stronger option where one is offered.

3. Use passkeys where you can

A passkey replaces a password with a cryptographic key stored on your device or in your password manager, unlocked with your fingerprint, face or screen lock. Passkeys are built on FIDO standards and are designed to resist phishing: there is no password to steal, and a passkey only works on the real site it was made for. Many major services now offer them; look for “passkey” in your account’s security settings.

4. Consider a hardware security key

A security key is a small physical device that you plug in or tap to sign in. Keys that support FIDO2/WebAuthn (or the older FIDO U2F standard) are among the strongest protections for accounts that support them. Before buying:

• Check your accounts. Confirm that the accounts you care about support security keys.
• Match your devices. Keys come with different connectors (such as USB-A, USB-C or Lightning), and some also support NFC for tapping a phone.
• Get two. Register a backup key on each account and keep it somewhere safe. Losing your only key can lock you out.

5. Plan your recovery

• Save each account’s backup or recovery codes somewhere safe and offline.
• Keep your recovery email and phone number up to date.
• Check whether your email address appears in known data breaches at Have I Been Pwned, a free service, and change any reused passwords it turns up.
• Keep your phone, computer and apps updated; updates fix security flaws.

Guides are separate from US Brief’s news coverage. News stories never carry these product links, and no retailer or affiliate partner chooses or reviews what we write.

More guides

• Budgeting basics: a simple way to start
• Building an emergency fund
• Back up your phone and computer

Spot an error? Email contact@us-brief.com with the page link and a source.