Password Hygiene in 30 Minutes

You don't need to fix all 80 accounts. You need to fix 5.

Every security expert says the same thing: use a password manager, use 2FA, use unique passwords.

And every normal person hears: "that's a 3-hour project I'll do next weekend." Then never does.

Here's the version that actually works: you don't need to fix all 80 accounts. You need to fix 5.

Fix these 5, in this order, and 99% of attacks become impossible. The other 75 accounts can keep their old passwords forever. It genuinely doesn't matter.

The 5 accounts that matter

1. Primary email (10 minutes)

Your email is the master key. If someone gets into your email, they can "forgot password" into literally every other account you own.

• New password: 20+ characters, random
• 2FA: authenticator app (not SMS — SIM swaps are real)
• Recovery email: a second email you control
• Recovery phone: yes, add it

2. Banking / financial (5 minutes)

Same drill:

• New password: unique, 16+ characters
• 2FA: app-based if possible, SMS if not
• Enable transaction alerts (email or push)

3. Password manager itself (5 minutes)

If you're setting up Bitwarden or 1Password, that master password is now the most important password in your life. Make it long (a passphrase is fine), write it down physically, and store it somewhere safe.

• Master password: 5+ random words, or 20+ random chars
• 2FA on the password manager: yes, mandatory
• Write down the master password on paper and store it in a safe or fireproof box

4. Apple / Google ID (5 minutes)

Your Apple ID or Google account controls your phone backups, photos, and app purchases. If it's compromised, someone can wipe your devices remotely.

• New password: unique, long
• 2FA: mandatory (both companies support app-based 2FA)
• Review "trusted devices" list and remove anything you don't recognize

5. Crypto exchange / wallet (5 minutes)

If you hold crypto, this is the highest-value target after email. Exchange breaches are the #1 way people lose funds.

• New password: unique, long
• 2FA: app-based only (SMS is not safe for crypto)
• Withdrawal whitelist: enable it
• Email confirmation for withdrawals: enable it

What you do NOT need to do

• Change every password today
• Use a "password formula" that you can remember (they get cracked)
• Pay for a premium password manager (Bitwarden free is fine)
• Use SMS 2FA if app-based is available (SMS is vulnerable to SIM swaps)
• Rotate passwords every 90 days (this outdated advice creates weaker passwords, not stronger)

The one thing that actually matters

All the passwords in the world are useless if you don't use a password manager. Humans cannot remember 80 unique random passwords.

Bitwarden is free and takes 10 minutes to set up. There is no excuse.

What about the other 75 accounts?

Leave them. Really.

If a random forum you signed up for in 2014 gets breached, they get... your old password for that forum. Which you don't use anywhere else that matters (because you fixed the 5 that matter).

If you have time, migrate them to the password manager as you use them. But don't make it a project. The 5-account fix is 99% of the security value.

Full checklist + 2FA setup walkthrough · 14-day refund

If you only do one thing

Fix your email account. Add 2FA to it. That's 5 minutes and it blocks 90% of the worst-case scenarios.

Do that now. Then come back for the other 4 when you have time.