Last updated: November 2026. The single most important account to protect is your primary email. Anyone who controls it can reset the passwords of almost everything else you use.
Most account hacks are not the work of genius hackers. They happen because people reuse the same password everywhere, one website gets breached, and criminals simply try that email-and-password combination on every other popular service. This is called “credential stuffing”, and it works far more often than it should.
The fix is not complicated. Unique passwords plus two-factor authentication (2FA) stop the vast majority of account takeovers. This guide explains how to do both without needing to memorise dozens of complex strings.
What makes a password strong?
Length matters more than complexity. A long password made of several random words is both harder to crack and easier to remember than a short jumble of symbols.
| Example | Verdict | Why |
|---|---|---|
| rahul@123 | Very weak | Name + common pattern; in every hacker’s word list |
| Mumbai2026! | Weak | City + year + symbol is a predictable formula |
| Tr0ub4dor&3 | Medium | Looks complex, but letter swaps are well known to cracking tools |
| mango-bicycle-thunder-velvet | Strong | Four random words: long, unique and easy to remember |
| Generated by a password manager (20+ random characters) | Very strong | Truly random; you never need to remember it |
The rules that actually matter
- Use a different password for every important account. This is the most important rule of all.
- Make it long — at least 12–16 characters, or 4+ random words.
- Avoid personal details — names, birthdays, phone numbers, vehicle numbers, pet names, favourite cricket player.
- Do not change passwords on a schedule for no reason. Change them when there is a breach or suspicion of misuse.
Use a password manager
Nobody can remember 50 unique passwords. A password manager remembers them for you, generates strong new ones, and fills them in automatically on the correct website — which also protects you from fake look-alike login pages, because the manager will not fill your password on the wrong domain.
- Built-in options: Google Password Manager (Android and Chrome) and Apple Passwords / iCloud Keychain (iPhone, iPad, Mac) are free and good enough for most people.
- Dedicated managers: well-known independent apps work across all devices and browsers and offer extra features like secure sharing with family.
You only need to remember one strong master password (use the four-random-words method) and protect the manager itself with 2FA.
What is two-factor authentication?
Two-factor authentication means logging in needs two different things: something you know (your password) and something you have (your phone, a security key) or are (your fingerprint). Even if a criminal steals your password, they cannot get in without the second factor.
Types of 2FA, from strongest to weakest
| Method | Security | Notes |
|---|---|---|
| Passkeys / hardware security keys | Strongest | Resistant to phishing; nothing to type or steal |
| Authenticator app (6-digit codes) | Strong | Codes are generated on your phone; not exposed to SIM-swap |
| Push approval in an app (“Is this you?”) | Good | Never approve a prompt you did not trigger |
| SMS OTP | Basic | Far better than nothing, but vulnerable to SIM-swap and OTP-sharing scams |
In India, banks and UPI apps use SMS OTPs and device binding as required by RBI, so you cannot always choose. For email, social media and shopping accounts, prefer an authenticator app or a passkey.
Passkeys: the password replacement
A passkey lets you sign in with your phone’s fingerprint, face unlock or screen lock instead of a password. It is tied to the real website, so it cannot be typed into a fake page. Google, Apple, Microsoft, Amazon, WhatsApp and many other services now support passkeys. If an account offers one, turn it on — it is both easier and safer.
A 30-minute plan to secure your accounts
- Primary email (Gmail / Outlook): set a unique strong password, turn on 2FA or a passkey, check recovery phone and email, and review the list of logged-in devices.
- Phone account (Google / Apple ID): same steps. This account controls backups, location and app purchases.
- Banking and UPI apps: use a unique app PIN that is not your birth year, turn on app lock, and set a sensible daily UPI limit.
- WhatsApp: Settings → Account → Two-step verification → set a 6-digit PIN. This stops someone from registering your number on another phone.
- Social media: enable 2FA on Instagram, Facebook and X/LinkedIn.
- Save backup codes that each service gives you when you turn on 2FA. Store them in your password manager or print them and keep them safe.
- Check for breaches: enter your email on a reputable breach-checking service such as Have I Been Pwned, or use the password check in Google or Apple’s password manager. Change any password that shows up.
Never share an OTP. No bank, courier company, telecom operator or government office will ever ask you to read out an OTP. Anyone who does is attempting fraud. If you have already lost money, follow our UPI fraud recovery steps immediately.
Signs your account may be compromised
- Login alerts or OTPs you did not request
- Friends receiving strange messages or payment requests from you
- Changed recovery email, phone number or password
- Unfamiliar devices or locations in your account’s security page
If you notice any of these: change the password from a clean device, sign out of all sessions, turn on 2FA, check recovery details, and warn your contacts not to send money. Report financial fraud to 1930.
Frequently asked questions
Is it safe to save passwords in my browser?
Using the built-in password manager in Chrome, Safari or Edge — protected by your device lock and account 2FA — is much safer than reusing passwords. Just make sure your device has a screen lock and the browser account itself is secured.
What if I lose my phone with the authenticator app?
Use your saved backup codes to sign in, then set up 2FA on the new phone. Many authenticator apps also support secure cloud backup. If your phone is lost or stolen, block it through the government’s Sanchar Saathi portal.
Should my UPI PIN and ATM PIN be the same?
Ideally not. Use different PINs, avoid birth years and repeating digits (1111, 1234), and never write them on the card or in your phone’s notes.
Do I need 2FA on accounts I rarely use?
For important accounts, yes. For old accounts you no longer need, the safest option is to delete them so they cannot be breached at all.
Bottom line
Unique passwords, a password manager and two-factor authentication on your email and phone accounts will protect you from most online attacks. Spend 30 minutes this week following the plan above, and pair it with the device-level steps in our phone clean-up and malware-check guide and the identity steps in our Aadhaar safety guide.
Note: Menu names in apps change over time. If a setting has moved, search for “security”, “two-step” or “passkey” in the app’s settings. This article is general guidance; see our disclaimer.