Secure Your First 5 Accounts
Last updated: October 2026
Don't change every password at once. Start with these five, in order. Change each as you next log in — not all at once.
The ladder
- Email — it resets every other account, so protect it first
- Bank — your money
- Phone carrier — SMS-based 2FA goes to your number
- Main cloud account — device backups and sync
- Main social account — your digital identity
Change as you go
- Change each password when you next log in to that account
- Use 15+ characters (16 or more recommended)
- Store each in your password manager
Two-step verification and passkeys
- Enable 2FA on every account that offers it
- Passkeys can replace passwords where supported — they're phishing-resistant
- Passwords still work everywhere; use passkeys where available [NEEDS SOURCE for platform support]
On-device checklist
- Email password changed (15+ chars, stored in manager)
- Bank password changed (15+ chars, stored in manager)
- Phone carrier account secured (PIN, port protection)
- Main cloud account secured (recovery contact/key set up)
- Main social account secured (2FA enabled)
- 2FA enabled on all 5 accounts
- Recovery kit printed and stored safely
Note: This checklist stores only tick states in localStorage under the key "pm-secure-5-checklist". It never stores any passwords or secrets.
Sources
- NIST SP 800-63B-4 (final Aug 2025) - digital identity guidelines