Two simple changes to be safer online

The websites I use day to day all offer different options around security and login. They provide inconsistent descriptions. Some hide the options behind so many screens you need a guide just to find them. In this post we discuss the two practical changes you can make to start feeling safer online:

1. Use a password manager.
2. Use passkeys where available.

Some of your accounts are more important than others; email and banks for example - start with these. Your main email account, banking, Apple or Google account, and any account connected to your money or identity are the most important to get secure.

1. Use Password Manager

If criminals obtain an email address and password from a breached website, they may automatically try the same combination on services such as Gmail, Amazon or online banking. This is known as credential stuffing.

Once they have your password (and your email address) they will straight away try to log in to all the services people commonly use (gmail, amazon, barclays bank etc).

This is why using the same password on different services is a big problem.

What to do? Remembering different passwords for every site isn't the way.

A password manager helps you use a different password for every account without needing to remember them all.

Where to Start?

Start with your email account.

Email is often used to reset passwords for other accounts. If someone gains access to your email, they may be able to take control of much more than your inbox (as bad as that can be).

Begin with email and then the other really important accounts:

• Your main email account
• Your bank and financial accounts
• Your Apple, Google or Microsoft account
• Your mobile phone provider
• Social media accounts
• Shopping accounts that store payment details

How to Choose a Password Manager

A password manager stores your passwords securely and can create strong, unique passwords for each of your accounts.

You may already have one built into your phone or browser:

• Google Password Manager works with Chrome and Android.
• Apple Passwords works across iPhone, iPad and Mac.
• Microsoft Password Manager is built into the Edge browser.
• Independent services such as Bitwarden and 1Password work across a wider range of browsers and devices.

Built-in password managers are a perfectly reasonable place to start. The best password manager is usually one that works on all the devices you use and that you feel comfortable using consistently.

I use Google Password Manager because it is built into Chrome and automatically offers to save and fill my passwords.

Creating a Strong Password in Chrome

When changing a password:

1. Sign in to the website normally.
2. Open the account or security settings.
3. Select Change password.
4. Enter your current password.
5. Click or right-click inside the New password box.
6. Choose Suggest strong password or Use strong password.
7. Allow Chrome to save the new password in Google Password Manager.
8. Complete the password change.

The exact wording may vary slightly between websites and devices.

You do not need to write down or memorise the generated password. Google Password Manager stores it and can automatically enter it the next time you sign in. It can also synchronise saved passwords between devices when you are signed in to Chrome with your Google Account.

Which Type Should You Choose?

Use Google Password Manager when you mainly use Chrome and Android.

Use Apple Passwords when you mainly use an iPhone, iPad and Mac. Apple’s Passwords app can store passwords, passkeys and verification codes across Apple devices.

Use Microsoft Password Manager when you mainly use Edge and Windows. It can store and fill both passwords and passkeys.

Consider an independent password manager such as Bitwarden or 1Password when:

• You regularly switch between Apple, Android and Windows devices.
• You use several different browsers.
• You want to share selected passwords safely with family members.
• You want more control over how your passwords are organised.

Avoid using several password managers at the same time. Choose one main service so you always know where your passwords are stored.

Whichever password manager you choose, protect it with a strong main password and turn on two-factor authentication or a passkey where available.

2. Set Up Passkeys Where Available

Passkeys are a newer way to sign in without typing a traditional password.

Instead, you confirm your identity using something already built into your device, such as:

• Face ID
• A fingerprint
• Your device PIN
• A physical security key

Passkeys are designed to be easier to use and harder to steal through phishing.

With a traditional password, a fake website can trick you into typing your login details. A passkey is linked to the genuine website or app, which makes this kind of attack much more difficult.

Where Should You Use Passkeys First?

Start with your most important accounts when passkeys are offered:

• Your email account
• Your Apple, Google or Microsoft account
• Financial accounts where supported
• Password manager accounts
• Major shopping and social media accounts

Not every website or bank currently offers passkeys. Some financial services use their own secure apps, card readers or approval systems instead.

Where passkeys are available, they are usually worth considering.

Are Passkeys the Same as Two-Factor Authentication?

Not exactly.

Two-factor authentication usually asks for a second check after your password. This might be a code, an app notification or a physical security key.

A passkey can replace the password itself and uses your device to confirm who you are.

Some accounts may still ask for an additional security check, particularly when you sign in from a new device or make a sensitive change.

Do This Gradually

You do not need to spend an entire weekend reorganising your digital life.

A simple approach is:

Today

• Choose and set up a password manager.
• Secure your main email account.
• Save any recovery codes somewhere safe.

This Week

• Update your bank and financial accounts.
• Check whether your email provider offers passkeys.
• Turn on two-factor authentication where passkeys are not available.

Over Time

Whenever you sign in to an important account, check its security settings.

Ask yourself:

• Is this password unique?
• Is it stored in my password manager?
• Is a passkey available?
• Is two-factor authentication switched on?
• Are my recovery email address and phone number still correct?

You can improve your security one account at a time.

A Final Word About Recovery

Better security is only useful if you can still access your accounts.

Before making major changes, check that you understand how account recovery works.

Make sure:

• Your recovery email address is current
• Your recovery phone number is correct
• You have saved backup codes
• You know how to access your password manager from a replacement device
• A trusted family member knows where to find essential recovery information if needed

Do not store passwords or recovery codes in an unprotected note, email draft or photograph.

The Two Changes to Remember

You do not need to become a cybersecurity expert.

Start with two practical steps:

1. Use a password manager and begin with your email and financial accounts.
2. Set up passkeys on important accounts wherever they are available.

These changes will not remove every online risk, but they can make your accounts significantly harder to compromise.