Browsers & Accounts · Passwords, Passkeys & Two-Step · Lesson 1 of 5

A Password Security Checkup

Read your password manager's report and fix the accounts that matter most first.

Reading your password report

Earlier you learned what a password manager is. Most of them also run a free security checkup, a report that looks at every saved password and flags the risky ones. Chrome calls it Password Checkup. Edge has Password Monitor. Safari and the Passwords app on a Mac show Security Recommendations. Firefox shows alerts in its list of saved passwords.

The report usually sorts problems into three groups:

• Compromised. A data breach is when criminals steal account details from a company. A compromised password is one that showed up in a breach, so it's already published online.
• Reused. The same password on more than one site. If one site leaks it, criminals try it everywhere else. This trick is called credential stuffing.
• Weak. Short or easy to guess, like a pet's name plus 123.

You may see dozens of warnings. You don't have to fix them all tonight. Fix them in order of harm:

1. Compromised passwords, because criminals may already have them.
2. Your main email. Password reset links go there, so it unlocks almost everything else.
3. Money accounts, like your bank, credit card and shopping sites with saved cards.
4. Then the reused and weak ones on everything else, a few a day.

When you change a password, let the manager's generator make it. A generator is a button that creates a long, random password and saves it for you. You never have to remember it.

One warning. Real breach alerts appear inside your browser or password manager. If an email or text says your password leaked and gives you a link, don't tap it. Open the checkup yourself to see if it's real.

On the practice computer, open the security report. Change the two breached passwords with the generator, fix the reused bank password, then turn on two-step verification for your email.

Why email and bank come first

Why does email come before almost everything? Think about what happens when you click "Forgot password" on a site. The site sends a reset link to your inbox. So anyone who controls your email can reset your bank, shopping and social media passwords, one after another.

That makes your email account worth more than any single password. Give it the strongest protection you have:

• A long, unique password you use nowhere else.
• Two-step verification, a second check after your password, such as a code or a tap on your phone. You turned it on for a Microsoft account in the Windows track. Email providers offer it in their security settings.
• A passkey, if your provider offers one. The next module covers these.
• Recovery details that are up to date, like a backup phone number you still own.

Money accounts come next, because a takeover costs you directly. Banks add their own checks, but a stolen password still gives criminals a head start.

A few habits make each fix count:

• Change it on the real site. Type the address yourself or use a bookmark. Don't follow a link from a message.
• Fix every copy. If you used one password on five sites, all five need new ones, not just the site that leaked.
• Sign out other devices if the site offers it, so anyone already signed in gets kicked out.

Curious which breaches your address has been part of? The free site Have I Been Pwned (haveibeenpwned.com) and Mozilla Monitor let you search by email. Being listed doesn't mean you've been hacked. It means it's time to change that password.