How to secure your online accounts: where to start

Securing online accounts mostly comes down to three protections, starting with your email account: passphrases, a password manager and multi-factor authentication (MFA). Most people have dozens of online accounts, from email and banking to shopping, streaming and government services. Criminals rarely need to “hack” anything clever to get into them. More often they use a password that was leaked from another website, or trick someone into typing it into a fake page. This guide explains how to secure online accounts with those three protections, which make that much harder, and walks through how each one is set up.

Why it matters

An account is usually only as strong as the way you sign in to it. A short or reused password can be guessed, or tried on other websites after a data breach. Once someone is inside an email account, they can often use “forgot password” links to take over other accounts too.

That’s why the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) puts email first. Its multi-factor authentication guide explains that “a cybercriminal with access to your email accounts can reset passwords for your other accounts.”

Which accounts the ACSC lists first

The ACSC’s MFA guide lists accounts in this order of importance:

1. user and email accounts
2. financial services, such as online banking
3. accounts that save or use payment details, such as online shopping and payment services
4. social media accounts
5. other accounts holding personal information, such as government services accounts.

Many people find it easier to work through one group at a time rather than every account at once. The multi-factor authentication checklist is set out the same way.

Passphrases: long beats complicated

A passphrase is a password made of several words. Length is what makes a password hard to guess, and a string of random words is long but still easy to type and remember. The ACSC’s passphrase page describes a passphrase as “four or more random words” and says “The longer your passphrase, the better.” Its examples include “crystal onion clay pretzel”.

The other half of the idea is that every account gets its own. If one website is breached, a unique passphrase means the leaked one doesn’t open anything else.

How to create a passphrase

Based on the ACSC’s passphrase guidance (checked October 2026). The ACSC’s page has the full guidance.

1. Pick four or more words at random. Words that have nothing to do with each other work better than a song lyric, saying or something about you.
2. Put them together as a single password, such as the ACSC’s example “crystal onion clay pretzel”.
3. If a website insists on capitals, numbers or symbols, add them to the passphrase. The ACSC says this is fine.
4. Use a different passphrase for every account.
5. Store them in a password manager, so only the password manager’s own passphrase has to be remembered.

Password managers

A password manager is an app that remembers your passwords for you. The ACSC describes it as “an application or program that stores passwords or passphrases for all of your accounts”, so that you “only need to remember one master password.” Most can also create long random passwords and fill them in automatically on the right website.

There are standalone password manager apps, and there are ones built into phones, computers and web browsers. The ACSC’s advanced personal security guide recommends turning on MFA for the password manager itself, and making its master password your strongest. The guide to how password managers work and what to compare explains the different types.

How to start using a built-in password manager (Google example)

Based on Google’s instructions (checked October 2026). Menus can change between versions; Google’s guide has the latest steps. Apple, Microsoft and standalone password managers work in a similar way, and their own help pages describe the details.

1. Sign in to Chrome or your Android phone with your Google Account.
2. When you sign in to a website, accept the prompt to save the password. Google says the manager can “Suggest strong and unique passwords and save them in your Google Account.”
3. When creating a new account or changing a password, accept the suggested strong password.
4. To review saved passwords, go to passwords.google.com.
5. Google says the manager can “Notify you about compromised passwords” and help change them. Changing any that are flagged replaces them with new, unique ones.

Multi-factor authentication (MFA)

Multi-factor authentication means signing in takes two or more different kinds of proof. The ACSC groups them as something you know (a password or PIN), something you have (a phone, authenticator app or security key) and something you are (a fingerprint or face). It’s also called two-factor authentication (2FA), two-step verification or 2-Step Verification.

The point is simple: even if a criminal has the password, they also need the second thing. The ACSC describes MFA as “one of the best ways to protect against someone breaking into your account.”

The common types

• Codes by text message (SMS). A one-time code is sent to your phone. Google’s help page notes that “verification codes sent by texts or calls can be vulnerable to phone number-based hacks”.
• Authenticator apps. An app on your phone shows a new six-digit code every 30 seconds. The ACSC says this is “more secure than receiving a code by SMS.”
• Prompts on your phone. Some services send a “Is this you trying to sign in?” notification to a phone you’re already signed in on.
• Security keys and passkeys. Physical keys, or passkeys stored on your device. The ACSC calls security keys “a more secure form of MFA than the other options above.” See what passkeys are and how they work and how hardware security keys work.

How to turn on 2-Step Verification for a Google Account

Based on Google’s instructions (checked October 2026). Menus can change; Google’s guide has the latest steps.

1. Go to myaccount.google.com and sign in.
2. Select Security & sign-in.
3. Under How you sign in to Google, choose Turn on 2-Step Verification.
4. Follow the on-screen prompts to add a second step, such as Google prompts, an authenticator app, a passkey or a phone number.
5. Google also offers backup codes for when your phone isn’t available. The guide to planning account recovery with backup codes explains how to get them.

Google notes that for an account used through work, school or another group, “these steps might not work”, and says to contact the administrator for help.

How to turn on two-step verification for a Microsoft account

Based on Microsoft’s instructions (checked October 2026). Microsoft’s guide has the latest steps.

1. Sign in at account.microsoft.com/security and open the Security tab.
2. Select Manage how I sign in.
3. Under Additional security, find Two-step verification and choose Turn on.
4. Follow the on-screen instructions. If you use the Microsoft Authenticator app, you’ll scan a QR code with your phone.
5. If an older app or device then says your password is wrong, Microsoft explains that it may need an “app password”, which is only available once two-step verification is on.

Microsoft warns that with two-step verification on, “if you lose your contact method, your password alone won’t get you back into your account”, and says it can “take you 30 days to regain access.” It says it “strongly recommend[s]” having three pieces of security information on the account.

How to turn on two-factor authentication for an Apple Account

Based on Apple’s instructions (checked October 2026). Apple’s guide has the latest steps. Many Apple Accounts already have it turned on.

1. On iPhone or iPad, open Settings, then tap your name.
2. Tap Sign-In & Security.
3. Turn on two-factor authentication and follow the on-screen instructions.
4. On a Mac, the same option is in System Settings > your name > Sign-In & Security.

Apple explains that after this, signing in on a new device needs your password plus a six-digit code that appears on your trusted devices or is sent to your trusted phone number.

One-time codes and sign-in requests

MFA only works if the second step stays with you. That’s why scammers so often ask for codes, as the guide to phishing, smishing and vishing explains. Scamwatch’s phishing page says: “Never share your personal information, credit card details, passwords or one-time codes.” The ACSC’s MFA guide adds: “Never approve unknown sign-in attempts or share your MFA code.”

Scamwatch notes that scammers can make calls and texts look like they come from a real bank, and describes checking with the organisation using “contact details you’ve found yourself.”

Things to watch for

• A code or sign-in prompt you didn’t ask for. It can mean someone else has your password and is trying to get in. The ACSC says never to approve unknown sign-in attempts.
• Anyone asking you to read out a code. Scamwatch says never to share one-time codes, and warns that scammers can make calls and texts look like they come from a bank.
• Recovery details that are out of date. An old phone number or email address can lock you out once MFA is on. Microsoft warns that recovery can take 30 days.
• Reusing the email account’s password anywhere else. Because email can reset other accounts, the ACSC treats it as the most important one.
• A new phone. The ACSC’s MFA guide describes moving an authenticator app to the new phone “before disposing of, or resetting, the old one”. See how to set up a new phone securely.

Common questions

How do I secure my online accounts?

The three main protections are a unique passphrase for each account, a password manager to remember them, and multi-factor authentication (MFA). The ACSC lists email accounts first, because someone with access to email “can reset passwords for your other accounts”. It describes MFA as “one of the best ways to protect against someone breaking into your account.” Start points are in which accounts the ACSC lists first and multi-factor authentication.

How do I secure my Microsoft account?

Turning on two-step verification adds a second check when signing in, and Microsoft’s help page explains how. Sign in at account.microsoft.com/security, open the Security tab, select Manage how I sign in, then turn on Two-step verification under Additional security. Microsoft warns that if you lose your contact method, your password alone won’t get you back in, and that regaining access can take 30 days. Full steps: two-step verification for a Microsoft account.

Which account is most important to secure first?

Email. The ACSC’s MFA guide lists user and email accounts first, because “a cybercriminal with access to your email accounts can reset passwords for your other accounts.” Financial services such as online banking come next, then accounts that save payment details, social media, and other accounts holding personal information, such as government services. The order is set out in which accounts the ACSC lists first.

Is a passphrase better than a complicated password?

The ACSC’s guidance focuses on length rather than complexity. It describes a passphrase as “four or more random words”, such as its example “crystal onion clay pretzel”, and says “The longer your passphrase, the better.” Capitals, numbers or symbols can be added where a website insists on them. A different passphrase for each account means a leaked one doesn’t open anything else. See how to create a passphrase.

Is an authenticator app more secure than SMS codes?

The ACSC says so: it describes an authenticator app as “more secure than receiving a code by SMS”, and calls security keys a more secure form of MFA again. Text-message codes are still one form of MFA. Google’s help page notes that “verification codes sent by texts or calls can be vulnerable to phone number-based hacks”. The options are compared in the common types of MFA.

What do I do if I think my account has been hacked?

The ACSC’s email attacks emergency response guide lists steps including changing the password, updating recovery details, checking forwarding rules and turning on MFA. A code or sign-in prompt you didn’t ask for can mean someone else has your password, and the ACSC says never to approve unknown sign-in attempts. The guide to what to do if an account is hacked explains what official sources say to do.

Where to get official help

• The ACSC’s Report and recover page has ReportCyber. Its where to get help page lists the 24/7 hotline, 1300 CYBER1 (1300 292 371).
• IDCARE offers free support if your accounts or personal information have been misused. Its contact page lists 1800 595 160 for individuals.
• The multi-factor authentication checklist helps work through MFA account by account, and the My security checklist lists these topics for the devices and accounts you use, so you can see which ones you’ve looked at.