Password security audit checklist
Start with the email account. It resets every other password on this list, so it matters more than all of them and should be the first thing secured.
14 items
Makes your own editable copy. No account needed.
The items
- Password manager installed, if one isn't already in use
- Email account secured firstIt can reset almost everything else on this list, so it earns the strongest password and two-factor before any other account does.
- Reused passwords found and changed one at a timeStart with banking and email — the accounts that matter most, not the ones that are quickest to click through.
- Two-factor authentication turned on for email, banking and any account holding payment details
- Passkeys set up where offeredNothing to type or steal — increasingly available on the accounts that matter most.
- Recovery codes for authenticator apps saved somewhere other than the phone they belong toLosing the phone and the codes at the same time is how people get permanently locked out.
- Recovery phone number and email checked and updated on key accountsAn old number still listed as recovery is a way in for whoever has it now.
- Security questions reviewedMany use a real answer — a maiden name, a first school — that's findable on social media. Treat the answer like another password.
- Login alerts turned on where availableA notification for an unfamiliar sign-in is the earliest possible warning something's wrong.
- Old sessions and devices logged out from accounts that offer the option
- Browser-saved passwords migrated into a proper password managerConvenient, but weaker than a dedicated manager and rarely reviewed once it's forgotten.
- Unused or forgotten accounts closedAn old account nobody logs into any more is still a password sitting somewhere, waiting to be part of a breach.
- A breach check run against current email addressesTakes a couple of minutes and tells you whether a password needs changing right now rather than eventually.
- Family members' accounts checked, if you're the one who manages them
Makes your own editable copy. No account needed.
Questions people ask
- Which account should be secured first?
- Email, always. Whoever controls it can reset almost every other account you own, which makes it worth more protection than anything it merely unlocks.
- Is a password manager actually necessary?
- Close to it. Reusing passwords is the single biggest cause of accounts being compromised, and remembering a unique one for every account without help isn't realistic.
- What do people usually forget to check?
- Security questions. Many use real, findable answers — a mother's maiden name or a first school — set years ago and never revisited since.