Guide 🔑 Passwords, passkeys & 2FA — the 30-minute setup that blocks 99% of account hacks

Most account takeovers aren't genius hacking. They're one leaked password + reuse. Fix those two things and you remove yourself from the pool of easy targets. This is the exact order to do it in — no theory, just the moves.

🧠 Why this works
Attackers run "credential stuffing": take one breached email+password combo, try it on 500 other sites automatically. If every account you own has a different password, the whole attack dies at the first site. Nobody can memorise 90 unique passwords — that's what the manager is for.

⏱️ Minutes 0–10 → get a password manager

• Pick one and install it on phone + browser: Bitwarden (free tier is genuinely enough), 1Password, or iCloud Keychain if you're all-Apple
  
• Your master password = a passphrase: 4–5 random words, something like a weird sentence you'd never forget but nobody could guess. Length beats complexity — "PurpleChair!Monday92" is weak next to "coaster-mango-relay-quiet-lamp"
  
• Let the browser prompt you to import saved passwords — five minutes, automatic
  
• Turn on the manager's built-in authenticator/TOTP if your plan has it, or pair it with a free app (Aegis on Android, 2FAS, or the manager itself)
  

⏱️ Minutes 10–20 → fix the big 10, not all 90
Don't try to rotate every password tonight — you'll quit by account #12. Change only the crown jewels, in this order:

1. Your primary email — it resets everything else you own. Unique password, never reused anywhere. Non-negotiable.
   
2. Banking / UPI / brokerage
   
3. Google / Apple account (your phone's identity)
   
4. WhatsApp + main socials
   
5. Work logins
   
6. Shopping sites that store your card
   

Generate each one in the manager — 16+ characters, random, done. The rest get rotated naturally as you log into them over the next month.

⏱️ Minutes 20–30 → 2FA where it matters

• Turn on 2FA for every account in the big-10 list above
  
• Priority order: passkey → authenticator app → SMS (SMS is last because SIM-swap and OTP-phishing exist — it's still miles better than nothing)
  
• Save the backup/recovery codes each site gives you — put them in the password manager's notes. The day your phone dies, these codes are the difference between "minor annoyance" and "account forever gone"
  

🗝️ Passkeys — the upgrade worth taking
Passkeys replace passwords entirely: your phone's fingerprint/face IS the login, and there's no password for anyone to phish or leak. If a site offers "Sign in with a passkey" (Google, Amazon, and most major ones now do) — say yes. It feels like a convenience feature; it's actually the strongest consumer security upgrade in a decade.

🚫 The traps that undo all of this

• Reusing the email password "just for unimportant sites" — that's the whole attack
  
• Keeping the manager locked with a weak master password anyway
  
• Approving 2FA prompts you didn't trigger — never approve a prompt you didn't just cause; that prompt means someone has your password RIGHT NOW, change it immediately
  
• Storing backup codes in the same email inbox they protect
  

TL;DR — manager in 10 min, big-10 passwords in 10 min, 2FA + backup codes in 10 min, say yes to passkeys. Half an hour, one Sunday, and credential stuffing becomes someone else's problem.

If you've already had an account hit, run the 60-minute breach response playbook first, then come back and do this. Wider security baseline lives in the cybersecurity starter path.

Which password manager did you land on — and did anything in the setup bite you? Share below, it helps the next person. 👇