Your email is the master key.

Protect your inbox

• Your email unlocks your other accounts

  If someone gets into your email, they can request password resets for your other accounts, grab the reset links from your inbox, and lock you out.

  Source: FTC Consumer Advice, How To Recover Your Hacked Email or Social Media Account (Aug 2023)

• Two-factor usually isn't on by default

  Two-factor authentication usually isn't turned on for you. Look in your account settings for two-factor authentication, two-step verification, or multi-factor authentication, and start with email, banking, and payment apps.

  Source: FTC Consumer Advice, Use Two-Factor Authentication to Protect Your Accounts (Sept 2022)

• Which second factor is strongest

  Text message codes can be stolen through a SIM swap, so an authenticator app is safer. The FTC calls security keys the strongest option because they don't use credentials hackers can steal.

  Source: FTC Consumer Advice, Use Two-Factor Authentication to Protect Your Accounts (Sept 2022)

• MFA makes a big difference

  99%

  CISA says using multi-factor authentication on your accounts makes you 99% less likely to be hacked. That's CISA's figure; the page doesn't explain how it was measured.

  Source: CISA, Multifactor Authentication

• Have I Been Pwned is a free breach check

  Have I Been Pwned, created and run by Troy Hunt, is a free site where you can check whether your email address showed up in a known data breach.

  Source: Have I Been Pwned, Who, What & Why

• It doesn't store your password with your email

  When Have I Been Pwned loads email addresses from a breach, it doesn't load the matching passwords with them.

  Source: Have I Been Pwned, FAQs

• Keep your real address for important stuff

  Mozilla doesn't recommend using email masks when you need your identity verified or for very important email. It says to give your real address to your bank, doctor, and lawyer.

  Source: Firefox Relay, FAQ