Passwords, Password Managers, and Passkeys: How to Secure Accounts Without Remembering Everything

Most people today have dozens of accounts online and a few passwords that circulate among them repeatedly. This is sufficient for daily life and also sufficient for criminals to create a cascade from a single leak.

The good news is that over the past few years, recommendations have become much simpler. You no longer need to change your password every month. You don’t need to include exclamation marks and numbers. You only need to remember one password.

This text shows what to do step by step: what a good password looks like according to the American NIST and Polish CERT Polska, why you need a password manager and what risks you face if you lose it, which second login factor actually stops a fraudster, and which just looks serious, as well as what passkeys are and whether it’s worth switching to them already.

There is also a section for those who are setting this up for their parents or grandparents – including how to save emergency access in case of illness or death.

Why Passwords Leak

A password is rarely “guessed” by someone. Much more often, it simply exists somewhere already.

Leaks from Services Where You Have an Account

The company where you created an account ten years ago was attacked, and the user database ended up online. Passwords are usually encrypted one-way (hashing – an irreversible hash is calculated from the password), but weak passwords can be reconstructed from these hashes.

CERT Polska analyzed such leaks, including from Polish services: “over half of the passwords in the analyzed sets were no longer than 8 characters.” Among the list of the fifty most popular Polish passwords are 123456, qwerty, zaq12wsx, polska, misiek, and marcin.

The same team checked how much it costs an attacker. CERT Polska employees created passwords they would consider strong – Galwaniczny123$, zaq1@WSXcde3$RFV, admin.1admin.1admin.1admin.1 – and secured them with the outdated SHA1 algorithm. “Cracking the above passwords took less than 5 minutes.”

Reusing the Same Password Across Multiple Services

This is the most important mechanism and has a name: credential stuffing, which is the automated input of stolen “email plus password” pairs into hundreds of other services. The program tries your data from a leak from a store in 2016 at the bank, in email, and on Facebook. If the password is repeated, it gains access.

Therefore, the uniqueness of a password is more important than its complexity. A strong password used in ten places is practically as weak as the weakest of those ten services.

Password Stealers in Downloadable Files

Infostealer is a type of malware whose sole purpose is to collect all saved passwords, cookies, and card data from a computer and then send them elsewhere. It arrives on the computer along with a “free version” of a paid program, a key generator, a game mod, or an invoice attachment.

This channel is dangerous because it bypasses the entire discussion about password length. The password is not guessed; it is read from the browser's memory.

Phishing

A fake login page, strikingly similar to the real one. You enter your username and password, and often also the code from an SMS or app – and you pass them in real-time to the fraudster, who logs in at the same moment on the real site.

NIST states this directly in guidelines SP 800-63B-4, section 3.1.1: “Passwords are not phishing-resistant” – passwords are not resistant to phishing. The same applies to codes from SMS and codes from apps, which will be discussed shortly.

Stolen Session Cookies

A session cookie is a small file that the browser stores after logging in, so it doesn’t ask you for your password with every click. Whoever steals such a cookie gains access to the account without a password and without a second factor, as the system recognizes it as an already logged-in session.

This is where the advice that recurs several times in this text comes from: after every incident, you need to log out of all devices, not just change the password.

Password Saved in the Browser on Someone Else's Computer

A computer in a hotel, at a family member's house, in a library, at work. The browser asks, “save password?”, someone clicks “yes” in a hurry, and the password remains.

Password Given Over the Phone

A classic scenario: a “bank employee” or “Microsoft consultant” calls and asks for your password or for the code that just arrived via SMS. No legitimate institution will ever ask for your password or one-time code. Never, without exceptions.

How such an attack is built from your public posts and photos is described in a separate guide: Vacation photos in the hands of a fraudster.

What Really Makes a Password Strong

For twenty years, we were taught that a strong password is one with an uppercase letter, a number, and a special character. This recommendation has been officially withdrawn – and not by bloggers, but by the institutions that once introduced it.

Length is Most Important

NIST SP 800-63B-4, section 3.1.1.2, requires: “Verifiers and CSPs SHALL require passwords that are used as a single-factor authentication mechanism to be a minimum of 15 characters in length” – a password used as the only login factor must be at least 15 characters long. If it works together with a second factor, the minimum drops to eight.

CERT Polska recommends users in Poland have at least 14 characters and notes that in June 2025, this threshold was raised from 12 characters.

CISA, the American cybersecurity agency, goes further and states in the material “Use Strong Passwords”: “At least 16 characters – longer is stronger!”

The American Federal Trade Commission (FTC) provides a lower threshold in its consumer guide: “aim for at least 12 characters.”

The differences arise from who the material is directed at. The practical conclusion is one: 14–16 characters is a sensible minimum, and longer is better.

Uniqueness for Each Service

Each account has its own password. No exceptions for “less important” services, as it is precisely the less important services that most often leak.

No Connection to Personal Data

Child's name, year of birth, street name, dog's name, club name. All of this is found in public profiles. CERT Polska adds another category: predictable components such as the name of a company or service. As it puts it, “the password zaq1@wsxCERT can be considered as weak as zaq1@wsx if used by an employee of CERT Polska.”

Why “P@ssw0rd!” is Weak Despite Special Characters

Because it is not original, just predictable. NIST explains this in Appendix A: “a user who might have chosen »password« as their password would be relatively likely to choose »Password1« if required to include an uppercase letter and a number or »Password1!« if a symbol is also required.”

Password cracking programs take a dictionary and append ready rules to each word: first letter uppercase, a to @, o to zero, exclamation mark at the end, year at the end. Such sets of rules are publicly available. Replacing letters does not add strength because the attacker knows the same tricks as you.

Why the “Three Random Words” Method Works

Because length increases faster than memorability difficulty. CISA suggests “a memorable phrase of 4–7 unrelated words” and provides examples: HorsePurpleHatRun, Horse Purple Hat Run Bay Lifting.

CERT Polska recommends building a password from a complete sentence, with at least five words, and provides examples: Wlazl Kostek Na Mostek I Stuka, zielony ParkingDla 3malych Samolotow, DwaBialeLatajace Sophisticated Kroliki. It notes that the described scene should contain an unrealistic element because people subconsciously choose items they currently have in front of them. The third example also shows another trick: inserting a word from another language, as password-cracking dictionaries are usually monolingual.

Note: examples published online cease to be secret at the moment of publication. Come up with your own.

Why Forced Changes Every 30 Days Deteriorate Security

NIST SP 800-63B-4, section 3.1.1.2: “Verifiers and CSPs SHALL NOT require subscribers to change passwords periodically. However, verifiers SHALL force a change if there is evidence that the authenticator has been compromised” – periodic password changes cannot be enforced, but a change must be enforced when there is evidence of compromise.

CERT Polska provides justification in Polish: “The requirement for periodic password changes has also been abandoned because the new passwords resulting from it are most often variations of previous ones, usually constructed in an easy-to-predict manner. Studies show that users are unable to remember an entirely new strong password, e.g., every month.”

In other words: Lato2026! changes to Jesien2026!, and that is not a new password, just the next word in the sequence.

Only in Poland: the obligation for periodic password changes in systems processing personal data stemmed from a regulation by the Ministry of Interior and Administration from 2004. CERT Polska reminds that this provision was repealed on February 6, 2019. If your employer or office still enforces a change every 30 days, they are doing it out of habit, not legal obligation.

Allowed Characters and Pasting

NIST requires that services accept all printable ASCII characters along with spaces, as well as Unicode characters, and that the maximum length be at least 64 characters. It prohibits imposing complexity rules: “Verifiers and CSPs SHALL NOT impose other composition rules (e.g., requiring mixtures of different character types) for passwords.”

Separately – and this is important for users of password managers – NIST mandates: “Verifiers SHALL allow the use of password managers and autofill functionality” and recommends allowing pasting: “Verifiers SHOULD permit claimants to use the »paste« function when entering a password.”

A service that blocks pasting a password or truncates it to twelve characters is violating current guidelines. This is a warning sign about the quality of its security.

Password Manager from Scratch

What It Is

A password manager is a program that stores all your passwords in an encrypted database, generates new ones, and fills them in for you on websites. You remember one password – that of the password manager itself. CERT Polska: “The purpose of these programs is to enable secure password storage, so you don’t have to remember them.” NIST adds in section 3.1.1.2: “Password managers have been shown to increase the likelihood that subscribers will choose stronger passwords, particularly if the password managers include password generators.”

How the Master Password Works

The master password decrypts the entire database. It must be long and unique because it is the only key. This is exactly the case for which CERT Polska recommends the full sentence method – you need a very strong password that can also be remembered from memory, because at the moment you enter it, you do not yet have access to the manager.

You will not save the master password in the same manager. Do not save it in notes on your phone – write it down on paper and hide it where you keep your documents.

What Happens When You Lose the Master Password

This is the most important question before choosing a manager. Some solutions are designed so that the provider does not know your master password and cannot reset it – losing the password means losing the entire database. Some offer emergency mechanisms: a recovery key to print, a trusted contact, recovery through a system account.

Before you enter your first password, check the documentation for the recovery procedure and complete it – generate the key, print it, hide it. CERT Polska warns of the same: “However, there is some risk of losing access to data stored in the password manager… If we did not take care to prepare a backup, recovering access to many accounts may require going through account recovery procedures with service providers.”

Built into the Browser and System or Separate Application

There is no one right answer, and we do not recommend a specific product here. There are two types of solutions, and they mainly differ in scope.

Built into the browser or system – Google’s password manager in Chrome and Android, iCloud Keychain and Apple’s Passwords app, managers in Firefox or Edge. Already installed, free, works without configuration, synchronizes with your account. CERT Polska evaluates them positively: “Those in browsers or phones perform their function well.” Limitation: they work best within one ecosystem. With an iPhone and a Windows computer, it becomes inconvenient.

Separate application – works independently of the browser and system, usually across all platforms at once, with advanced features: secure notes, sharing entries with family, emergency access, audit of repeated passwords. It costs time to implement and often money.

Criteria to consider instead of rankings:

• Does it work on all devices you actually use, including those your family uses.
• What is the recovery procedure after losing the master password, and can you perform it yourself.
• Does it allow enabling a second factor for the manager itself.
• Does it allow exporting the entire database to a file, so you can move elsewhere.
• Does it have emergency access for a close person.
• Does the manufacturer publicly describe how it encrypts data and does it order independent audits.
• Is the interface understandable for the person who will use it – this criterion is more important than it seems, as a manager that someone does not use protects nothing.

Synchronization and Access on the Phone

Practically all solutions synchronize the database between devices via the cloud, encrypting it before sending – the cloud provider sees only unreadable data. This way, losing one device does not mean losing passwords. CERT Polska: “This risk is lower in the case of cloud solutions, as the data is not directly stored on our device.”

On the phone, the manager integrates into the system’s autofill and suggests passwords in apps as well. You need to specify it once in the system settings as the default password service.

Exporting and Moving

Check this before it’s needed: export the database to a file and see if the file is actually created. Warning – exporting is usually a plain text file with passwords readable to the naked eye. Do not leave it on the desktop, do not send it by email, do not upload it to the cloud. After moving, delete the file and empty the trash.

Risks and How to Mitigate Them

A password manager is a single point where everything is concentrated. This is a real risk.

• Break-in on the computer. An infostealer can extract data from an unlocked manager. Limitation: up-to-date system, up-to-date browser, no “cracks,” short auto-lock time for the manager.
• Loss of the master password. Limitation: recovery key on paper, prepared in advance.
• Break-in on the provider's account. Limitation: second factor on the manager’s account, preferably a hardware key or passkey.
• Leak at the provider. Even if the database is encrypted, a strong master password determines whether it can be unpacked. This is another reason to have 20 characters instead of 10.

Why a Piece of Paper in a Drawer at Home is Better Than the Same Password Everywhere

This is not a joke. NIST in Appendix A notes that very complex passwords “are less likely to be memorable and more likely to be written down or stored electronically in an unsafe manner” – and treats this as an argument against enforcing complexity, not against writing down.

The average person is attacked by an automated system from another continent, not a neighbor rummaging through a drawer. A notebook with passwords kept at home with documents is much safer than a single password Kasia1980 at the bank, in email, and on Facebook.

Rules for the notebook: keep it with documents, do not carry it with you, describe it briefly, not directly, and update it with every password change. If the last one stops working, it’s time for a manager.

Second Factor of Authentication: Four Methods and Their Resilience

The second factor (also known as 2FA, MFA, two-step verification, or two-factor authentication – these are synonyms) is an additional proof of identity beyond a password.

CERT Polska explains the division: "Something you know – e.g., a password or PIN. Something you have – e.g., a hardware token, phone, Smart Card. Something you are – e.g., a fingerprint or an iris scan.".

CISA is very straightforward on this matter: "Not all MFA methods give you the same level of protection. Some MFA types are better than others – phishing-resistant MFA is the standard all industry leaders should strive for, but any MFA is better than no MFA.".

SMS Code

The most widespread and weakest. CISA classifies SMS in the document "Implementing Phishing-Resistant MFA" as "Vulnerable to phishing, SS7, and SIM swap attacks" and adds that "This form of MFA should only be used as a last resort MFA option." Three distinct weaknesses:

• Phishing. You enter the code on a fake site, and the scammer forwards it within the same minute.
• SIM swap. A criminal convinces the carrier to transfer your number to their SIM card – CISA describes this as "a form of social engineering in which cyber threat actors convince cellular carriers to transfer control of the user's phone number to a threat actor-controlled SIM card.".
• Telecommunication network interception. Vulnerabilities in the SS7 protocol, which operators use to communicate with each other.

FTC puts it more simply: the code from an SMS or email "is the least secure type of two-factor authentication.".

Important caveat: SMS is much better than having no second factor. If this is the only option, enable it.

Authenticator App

An app on your phone generates a six-digit code that changes every 30 seconds. It does not require signal or internet, thus eliminating SIM swap and network eavesdropping. Phishing remains – the code can be phished just like from an SMS. NIST: "OTP authentication is not phishing-resistant." CISA places this method in the middle category of the table and calls it, along with push with number matching, the best option for those who cannot immediately implement phishing-resistant methods.

Popular apps listed by CERT Polska include Google Authenticator, Microsoft Authenticator, Aegis, Bitwarden Authenticator, and 2FAS – and each describes how to back them up. This is not a coincidence, as will be explained shortly.

Push Notification

A question "Are you logging in?" arrives on your phone, and you click "yes." Convenient, but without additional security, it is susceptible to fatigue attacks: an attacker generates dozens of notifications in the middle of the night until someone clicks "approve" to stop the phone from vibrating.

NIST deemed this serious enough to exclude simple approval: "This method is no longer considered acceptable… This has been observed with 'authentication fatigue' attacks.".

The version with number matching (a number appears on the login screen that you enter in the phone) is clearly better – CISA classifies it alongside codes from apps.

Hardware Key and Passkey

A small USB or proximity key, or a passkey stored on your phone or computer. It operates on the FIDO/WebAuthn standard.

This is the only category resistant to phishing, as the key checks the website address before signing anything. It simply will not work on bank-logowanie.xyz – not because you are vigilant, but because the cryptography does not match.

If you decide to use physical keys, buy two. Apple explicitly requires this: to protect an Apple account with security keys, "at least two FIDO Certified keys are needed." One you carry with you, the other stays at home as a backup.

CISA: "The only widely available phishing-resistant authentication is FIDO/WebAuthn authentication." In a blog post by the then-director of CISA from October 18, 2022: "FIDO is the gold standard. Go for the gold." And the most important sentence from this text: "The reason FIDO is so valuable is because even when this happens, the attack will still fail" – even if you are tricked, the attack will still not succeed.

Table: Second Factor Methods

Method	Phishing Resistance	What Happens When You Lose Your Phone	For Whom
SMS Code	None. Also vulnerable to SIM swap and interception in the operator's network. CISA: "last resort".	The number can be transferred to a new SIM card with the carrier. Usually the easiest method to recover, and this is also its weakness.	People for whom this is the only available option, and low-value accounts. Always better than nothing.
Authenticator App (codes every 30 seconds)	None, but resistant to SIM swap and network eavesdropping.	Without a backup or backup codes, you lose access to all accounts at once. With backup enabled – you recover on a new phone.	The default choice for most people. Requires a one-time backup setup.
Push Notification	None. The version without number matching is additionally susceptible to fatigue attacks.	Depends on the service. Usually, you have to go through the account recovery procedure.	People who find entering codes bothersome. Choose the version with number matching.
Hardware Key or Passkey (FIDO/WebAuthn)	Yes. The only widely available phishing-resistant method.	The synchronized passkey can be restored on a new phone from the account. The physical key continues to work because it is not on the phone. That is why two keys are purchased.	Email, banking, accounts with money, particularly vulnerable individuals: journalists, activists, entrepreneurs.

Backup Codes and Where to Store Them

Backup codes (recovery codes) are one-time strings of characters provided by the service when enabling the second factor. Each works once and replaces the second factor. This is the only thing that separates "I lost my phone" from "I lost my account.".

NIST, section 4.2.1.1: "Saved recovery codes are intended to be maintained offline (e.g., printed or written down) and stored securely by the subscriber for future use." CERT Polska: "It is advisable to print it out or write it down on an external medium and store it in a safe place.".

Where to keep them:

• Printed or written down, together with documents at home.
• A second set with a trusted person or in another location – in case of fire or flooding.
• In a password manager, but only if the manager is not secured with the same second factor that these codes pertain to. Otherwise, you lock the key in a box that this key opens.

Where not to keep them: in an email to yourself, in notes synced without a password, in a photo in the phone gallery.

What to Do When Changing Phones

This is the most common moment when people lock themselves out of their accounts. The order matters.

1. Before parting with your old phone, enable backup in the authenticator app or export the codes.
2. Transfer the authenticator app to the new phone and check if the codes work by logging into one account.
3. Only then clear the old phone.
4. If you are using a hardware key, you don’t have to do anything – the key is not in the phone.

Backup methods vary between apps. CERT Polska describes them for several popular ones: in Google Authenticator, codes sync with a Google account; in Microsoft Authenticator, backup is enabled in the app settings and saved to a Microsoft account; in 2FAS, you can sync with Google Drive or export manually; in Aegis, you choose to save on an SD card or in the cloud.

How Not to Lock Yourself Out

The rule that saves the most often: always have two independent ways to access your account.

Practically, this means: an authenticator app plus printed backup codes. Or two hardware keys, one in your wallet, the other in a drawer. Or a passkey on your phone plus a passkey on your computer.

Never leave your account in a state where "the only way in is on this one phone.".

Passkeys Explained in Simple Terms

A passkey is a key stored on your phone or computer that you use to log in just like you unlock your device – with a fingerprint, face, or PIN – instead of typing a password.

This is how the FIDO Alliance, the organization that created this standard, defines it: "A passkey is a FIDO authentication credential based on FIDO standards, that allows a user to sign in to apps and websites with the same process that they use to unlock their device (biometrics, PIN, or pattern).".

In Polish versions of systems, it appears as "access key" (Apple, Google). It is the same thing.

How It Differs from a Password

A password is one secret that you know and the service knows. It must be transmitted to work. It can be intercepted, phished, and stolen from a database.

A passkey is a pair of linked keys. The private key never leaves your device. The public key resides with the service provider and is useless by itself. When logging in, the device signs a one-time challenge from the service. Microsoft: "The private keys can only be used after they’re unlocked by the user using the Windows Hello unlock factor (biometrics or PIN).".

Three consequences:

1. There is nothing to steal from the server. A database leak reveals nothing that can be used to log in.
2. It cannot be phished. The passkey is tied to a specific website address. It will not work on a counterfeit.
3. It cannot be reused on another service, because there is a separate one for each service.

Does Your Fingerprint Go to the Service?

No. Biometrics are only used to unlock the key on your device. Microsoft: "any biometric information used in the authentication process remains on the user's device and isn’t transmitted across the network or to the service.".

Where Are Passkeys Stored?

In one of three places:

• In the cloud of the system manufacturer, synchronized between your devices – the iCloud keychain at Apple, Google password manager on Android and in Chrome, Microsoft account in Windows.
• In a password manager, if it supports passkeys.
• In a hardware key, with no synchronization.

NIST refers to the first two cases as "syncable authenticators" and sets requirements for them in Appendix B: keys sent to the cloud must be encrypted, and access to that cloud must be protected by two-factor authentication – "User access to authentication keys in the sync fabric SHALL be protected by AAL2-equivalent MFA.".

A practical conclusion for you: the account where your passkeys are synchronized – an Apple, Google, or Microsoft account – is now the most important account you have. Secure it as strongly as possible.

NIST also notes a limitation of synchronization: "syncing violates the non-exportability requirements of AAL3." For institutions with the highest requirements, synchronized passkeys are insufficient – hardware keys are needed. For the average user, synchronization is an advantage, not a disadvantage.

What Happens When You Lose Your Phone?

If passkeys are synchronized: you log into your Apple, Google, or Microsoft account on the new device, and the passkeys return. You lose nothing – provided you haven’t lost access to that account.

If the passkey was only on that one device without synchronization: it is gone. You still have other login methods for that service, including the old password and backup codes.

That is why the principle from the previous section applies here as well: two independent ways to access.

How It Works on a Computer and on Someone Else's Device

On your own computer, the passkey is usually already synchronized, and logging in looks like unlocking the system.

On someone else's computer – in a hotel, at a friend's, at work – the site shows a QR code. You scan it with your phone, the phone asks for a fingerprint, and confirms the login. The passkey is not copied to the foreign computer; the phone and computer additionally communicate via Bluetooth, which confirms that they are physically close to each other. After closing the browser on the foreign computer, nothing remains.

This is a significant advantage while traveling: you do not enter your password on equipment you do not know.

Do You Need to Delete the Old Password?

Usually, you cannot and should not. Most services allow you to have a passkey alongside a password: the passkey becomes the more convenient way, while the password remains as a backup. As long as you have the passkey only on one device, deleting the password increases the risk of locking yourself out.

A sensible order: add passkeys on two devices, use them for a few weeks, check that recovery works – only then consider deleting the password if the service offers it.

Note: adding a passkey does not disable the old password. If it was weak or repeated, it is still a way in. Change it to a strong one, even if you are no longer using it.

Where Passkeys Already Work

Systems: iOS, iPadOS, and macOS (Apple refers to them as "keys"), Android and Chrome, Windows via Windows Hello. They are supported by major browsers.

Services: Google, Apple, and Microsoft accounts, some large social media services, stores, and banks. The list changes quickly enough that it does not make sense to rewrite it – check the security settings of the given service to see if there is an entry about access keys.

Only in Poland: logging into banks in Poland is subject to strong authentication regulations (PSD2), and banks implement them with their own mechanisms – mobile apps, codes, tokens. CERT Polska: "Since the PSD2 directive requirements came into effect in 2019, some service providers (especially in the banking sector) are required to demand two-factor authentication when logging in on an unknown device." You do not need to enable anything at the bank – it is already in place. However, check if your banking app is up to date and if you authorize transactions in the app, not via SMS, if the bank gives you a choice.

How to Enable Two-Factor Authentication for Major Services

Before you start making any changes: download and print backup codes for each service where you enable it. Without this, one lost phone can cut you off from everything.

Screen layouts and button names change several times a year, which is why we describe the steps functionally and provide the official help page for each service, where the provider keeps the current version of the instructions.

Google Account and Gmail

Go to the security settings of your Google account and enable two-step verification. Then add a method – an authenticator app, security key, or passkey – and finally download the backup codes.

• Enabling two-step verification: https://support.google.com/accounts/answer/185839?hl=en
• Passkey instead of a password: https://support.google.com/accounts/answer/13548313?hl=en
• Security key: https://support.google.com/accounts/answer/6103523?hl=en
• Backup codes: https://support.google.com/accounts/answer/1187538?hl=en
• Overview of all security settings: https://myaccount.google.com/security-checkup
• Google Password Manager: https://passwords.google.com/

For individuals particularly at risk, Google runs the Advanced Protection Program – a mode where a passkey or security key is required for login: https://landing.google.com/advancedprotection/, and frequently asked questions in English: https://support.google.com/accounts/answer/7539956?hl=en

A minor detail that may surprise you: Google warns that "it may take up to 7 days for a newly added security key to be available for login." So do not plan to add a key the day before a trip.

Apple Account

Be cautious with the terminology: the Polish version of Apple’s pages refers to "two-level authentication" (not two-factor), passkey is simply called "key," and Legacy Contact is referred to as "account guardian."

Two-level authentication is now the default for new Apple accounts. Check if you have it enabled, and while you’re at it, review the list of trusted phone numbers – that’s where the six-digit codes go. Apple notes that this protection can only be disabled within two weeks of being enabled.

• Two-level authentication for Apple account: https://support.apple.com/en-us/102660
• Trusted phone numbers and trusted devices: https://support.apple.com/en-us/122621
• Passkeys on iPhone: https://support.apple.com/en-us/guide/iphone/iphf538ea8d0/ios
• Logging in with a key on Mac: https://support.apple.com/en-us/guide/passwords/mchl4af65d1a/mac
• Security of passkeys: https://support.apple.com/en-us/102195
• Security keys for Apple account (at least two required): https://support.apple.com/en-us/102637
• Setting up iCloud Keychain: https://support.apple.com/en-us/109016
• Password app on Apple devices: https://support.apple.com/en-us/120758
• Recovery contact (a person who can help you regain access to your account): https://support.apple.com/en-us/102641
• Recovery key: https://support.apple.com/en-us/109345

There are two important things to know about the recovery key before you enable it. It is a 28-character code, and enabling it disables the standard account recovery procedure – Apple warns: "If you cannot provide the recovery key, the account will remain permanently locked." Apple also advises against storing it in the Password app, in iCloud Photos, in Notes, or on iCloud Drive. Print it out and store it safely.

Microsoft Account

In the security settings of your Microsoft account (https://account.microsoft.com/security), find the section for managing sign-in methods, enable two-step verification, and add the Microsoft Authenticator app or a passkey.

• Two-step verification for Microsoft account: https://support.microsoft.com/en-us/account-billing/how-to-use-two-step-verification-with-your-microsoft-account-c7910146-672f-01e9-50a0-93b4585e7eb4
• Creating and saving a passkey: https://support.microsoft.com/en-us/account-billing/create-and-save-a-passkey-e92cd3e0-11fa-4630-a5ea-3ccc0396b3d9
• Downloading and installing Microsoft Authenticator: https://support.microsoft.com/en-us/account-billing/download-and-install-the-microsoft-authenticator-app-351498fc-850a-45da-b7b6-27e523b8702a
• Passkeys in Windows: https://support.microsoft.com/en-us/windows/passkeys-in-windows-301c8944-5ea2-452b-9886-97e4d2ef4422

Two things from Microsoft’s materials are worth noting. The company is announcing the phasing out of SMS as a method of authentication and recovery for personal Microsoft accounts. And in a post from May 1, 2025, it announced: "Brand new Microsoft accounts will now be 'passwordless by default'" – new accounts will not have a password by default, and existing users can remove theirs themselves. Passwords in existing accounts do not disappear automatically. Polish addresses for some articles about passkeys serve English content.

Facebook

Facebook settings are now part of the Meta account center, shared between Facebook and Instagram. Go to account settings, then to the account center, then to the passwords and security section, select two-factor authentication, and specify the account in question.

You can choose from three methods: security key, external authenticator app, or SMS. Facebook also allows you to generate ten backup login codes – do this right away.

• How two-factor authentication works on Facebook: https://www.facebook.com/help/148233965247823

Instagram

Instagram uses the same Meta account center as Facebook, so the path is identical: settings, account center, password and security, two-factor authentication, selecting the Instagram account. If both accounts are linked in the account center, you can enable security for both from one place.

• Two-factor authentication on Instagram: https://help.instagram.com/566810106808145

Note: the content of this page loads only in the browser, so it could not be read or confirmed automatically – only its topic is confirmed. If the address does not work, use the Facebook description above; it applies to both services.

WhatsApp

WhatsApp calls this two-step verification and it works differently than in other services. You set a six-digit PIN, which the app asks for when registering your number on a new device. This security is specifically against number takeover.

Provide an email address as well. Without it, if you forget your PIN, you will not be able to recover your account.

• Managing two-step verification in WhatsApp: https://faq.whatsapp.com/1920866721452534

Bank

Only Poland: banks operating in Poland are required to implement strong authentication and do so themselves. Instead of enabling a second factor, do three other things. First, check in your banking settings whether you authorize transactions in the mobile app (mobile authorization) rather than via SMS – if the bank gives you a choice, the app is safer. Second, set notifications for every login and every transaction. Third, set reasonable transfer limits so that one bad day doesn’t cost everything.

Only USA: in American banks, the second factor usually needs to be enabled manually – in the security settings of the account in the app or on the bank's website. Look for options named "two-factor authentication," "two-step verification," or "security key." If the bank offers an authenticator app or security key, choose them instead of SMS. Also, set transaction alerts. General information for consumers is provided by the Consumer Financial Protection Bureau: https://www.consumerfinance.gov/consumer-tools/fraud/

In both countries, the same rule applies: the bank never calls for your password or code. We discuss what such calls look like in Poland in the guide Bank and Internet Fraud in Poland.

Account Review Step by Step

Where to Start: Email Inbox

Email is the key to everything else because password reset links go there. The FTC summarizes it in one sentence: "If a hacker takes over your email account, they can get password reset links for your other accounts. Then they can change the passwords and take over those accounts, too."

Start with email, even if you think the bank is more important. The bank is only more important after the email.

Order of Securing Accounts

1. Main email inbox – new long password, second factor, backup codes, review of recovery addresses and mail forwarding rules.
2. Account ecosystem – Apple, Google, or Microsoft, especially if your passwords and passkeys are synchronized there.
3. Bank and payment apps.
4. Services with saved payment card – stores, carriers, food providers.
5. Social media and messaging apps – where someone could impersonate you to your family.
6. The rest.

How to Conduct an Account Review

Don’t do everything at once. Tackle the first two points today, and spread the rest over several evenings.

• List the accounts you remember.
• Search your inbox for the words "welcome," "confirm registration," "welcome," "verify your email." This will pull up accounts you may have forgotten.
• Check what your browser and phone have saved in the password manager – there’s usually more than you expect.
• Delete accounts you don’t use instead of fixing them. An account that doesn’t exist cannot leak.
• For the accounts that remain, check the list of logged-in devices and log out those you don’t recognize.

How to Check if Your Address Has Leaked

Use the service haveibeenpwned.com, run by security researcher Troy Hunt. Enter your email address and see a list of known leaks in which it has appeared. There is also a separate Pwned Passwords feature to check the password itself and "Notify me," which provides notifications about future leaks.

Three things to know honestly:

• The service does not show your passwords. The author explains: "no corresponding passwords are loaded with them," and when checking passwords, "every password is SHA-1 hashed." If any site promises to show you your leaked password, it is a scam.
• No result proves anything. The database contains only publicly known leaks that have been added to it. Unreported leaks, sold privately, or fresh ones do not appear in it.
• Some leaks are marked as sensitive and cannot be searched publicly – results are visible only after confirming that you own the address.

Many browsers and password managers have this feature built-in and warn automatically. This is more convenient as it works in the background.

What to Do After a Leak

FTC: "If a company or website tells you it lost your password in a data breach, change your password right away."

Order:

1. Change your password on the service that leaked.
2. Change it everywhere it was the same or similar. This is the proper response after a leak, not the first point.
3. Log out all devices in those services.
4. Enable the second factor where it wasn’t already.
5. Check if there’s a mail forwarding rule to a foreign address in your inbox and if the recovery phone number has changed.

If you suspect someone has already accessed your account, do not read further in this text, but go to the emergency guide: Someone took over my email, Facebook, or Instagram. What to do in the first hour. There is a step-by-step recovery procedure there. This guide is about preventing that one from being necessary.

How to Change Your Password Safely

• Go to the login page from a bookmark or by typing the address manually, never from a link in an email or SMS.
• Change the password on your device, not on someone else's and not on public Wi-Fi unless necessary.
• Immediately save the new password in the manager.
• After changing, find the option to log out all sessions in the settings.
• Check if the change worked by logging in again.

Security Questions

Security questions ("mother's maiden name," "first pet's name") are a relic but still encountered. NIST prohibits their use on the service side, section 3.1.1.2: "Verifiers and CSPs SHALL NOT prompt subscribers to use knowledge-based authentication (KBA) (e.g., 'What was the name of your first pet?') or security questions when choosing passwords."

The problem is that real answers can be found. Birth city, mother's maiden name, dog's name – all of this is in birthday posts, photo descriptions, and public records. The FTC warns against questions "with answers that someone could find online or in public records – like your zip code, birthplace, or mother's maiden name."

Solution: do not answer truthfully. Treat the security question like another password – enter a random string from the password manager and save it in a note with that account. The FTC advises the same: "treat them like a password and use random and long answers. Just be sure you can remember your answers."

This is especially important with a public profile on social media. We discuss the collection of such data in the guide Vacation Photos in the Hands of a Scammer.

What to Do Immediately

If you have twenty minutes today and nothing more, do this:

1. Change the password to your main email inbox to a new, long one (14–16 characters or more) that you do not use anywhere else.
2. Enable the second factor on that inbox. Authenticator app instead of SMS, if you have a choice.
3. Download and print backup codes for that inbox. Store them with your documents.
4. Check in the mail settings for any foreign forwarding address and ensure the recovery phone number is yours.
5. Log out all devices in the mail settings.
6. Check your address on haveibeenpwned.com and list services where the password was the same as the leaked one.

If you have another twenty minutes, repeat points 1–5 for your bank account and for your Apple, Google, or Microsoft account.

Emergency Plan for Losing Your Phone

This plan needs to be prepared before the phone goes missing. After that, it’s too late.

Preparation in Advance

• Printed backup codes for email, bank, and ecosystem account, stored at home.
• Backup enabled in the authenticator app.
• A second device with access – tablet, old phone, computer – where you are logged into email.
• Location and remote wipe features enabled (Find My iPhone, Find My Device).
• Emergency number for the carrier saved elsewhere to block the SIM card.
• Screen lock with a PIN longer than four digits and disabled preview of SMS content on the locked screen – so that the bank code is not visible without unlocking.

When the Phone Has Already Disappeared

1. Block the SIM card with the carrier. This cuts off SMS with codes and makes it harder to take over the number.
2. Log out the device remotely from the settings of your Apple, Google, or Microsoft account and, if possible, wipe it remotely.
3. Log out all sessions in email, bank, and social media from another device.
4. Log in with a backup code where the second factor was the app from the lost phone, and switch the second factor to a new device.
5. Report the theft to the police if it was theft – this will be needed for claims.
6. Once you regain your peace of mind: generate new backup codes, as some of the old ones have already been used.

Only Poland: consider blocking your PESEL number if documents or access to banking were lost along with the phone. We describe the procedure in a separate guide: How to Block Your PESEL Number Step by Step.

Only USA: if you suspect someone will use your data to incur obligations, consider freezing your credit report at the three bureaus. We describe this in the guide How to Freeze Your Credit Report at Experian, Equifax, and TransUnion.

For Seniors and Those Helping Parents

Overarching Principle

The best security is one that the person actually uses. A perfect solution that the mother does not understand is worse than a simple one that works.

When Someone Does Not Want an App

This is very common and completely understandable. A lot can be done without installing anything new.

• Leave SMS as a second factor. Yes, it is the weakest. But SMS is still a huge improvement over just a password, and it is understandable without explanation.
• Write down passwords in a notebook, one specific one, kept at home with documents. Not in a wallet.
• Use what is already on the phone. iPhone and Android have built-in password managers and biometrics. Enabling fingerprint recognition is one change in settings, not a new app to learn.
• Set one very good password for email and let the rest be saved in the phone.

What to Set Up for Someone Who Asks

Do this together with that person, not behind their back, and write down the changes on a piece of paper as you make them.

• A long, unique password for email.
• A second factor for email, with a phone number that this person definitely has access to.
• Backup codes printed and hidden in an agreed location.
• A trusted phone number and a trusted email address for recovery – preferably yours, if you are the one helping.
• Bank notifications for every transaction, so someone notices a problem within hours, not weeks.
• A note by the phone with one sentence: "The bank and police never ask for your password or code. Always hang up and call me".

Separate guides on scams targeting seniors: Scams involving grandchildren and police – how to remotely protect parents in Poland and How to protect seniors from online scams.

What Not to Do

• Do not enable a second factor on a phone number that the person does not control. This is the simplest way to cut them off from their own account.
• Do not change all passwords in one evening without recording the new ones.
• Do not take away access if someone does not want it. It is their account.

Emergency Access for Loved Ones

This is a part that almost no one thinks about until it is too late. If you secure accounts perfectly and leave no way in for anyone, your family will lose photos, correspondence, and access to bills at the worst possible moment.

Recovery Contact and Account Guardian

Major providers have ready mechanisms for this. Apple has two separate tools:

• Recovery Contact – a person who will help you regain access to your account when you forget your password: https://support.apple.com/pl-pl/102641
• Account Guardian (in English, Legacy Contact) – a person who can access part of your account data after your death. Apple describes it as: "Adding an account guardian is the easiest and safest way to grant a trusted person access to the data stored on your Apple account after your death. This data may include photos, messages, notes, files, device backups, and other content". This is set up on the iPhone in Settings: tap your name, then Sign In & Security, and then Account Guardian. Instructions: https://support.apple.com/pl-pl/102631

An important limitation that Apple states explicitly: the account guardian does not gain access to data from the iCloud keychain, meaning passwords and access keys. A person who is to inherit photos will not inherit passwords this way.

NIST provides a similar mechanism on the service side and calls it recovery contacts (section 4.2.1.3), even recommending that providers remind users to review this list once a year. It is worth doing the same on your end.

What to Save in Case of Illness or Death

The simplest solution that actually works is one sealed envelope.

It should contain:

• The master password for the password manager and its recovery key.
• The PIN for the phone.
• The password for the main email account.
• Printed backup codes for the most important accounts.
• A short list: where the money is, where the insurance is, what subscriptions need to be canceled.
• One sentence about what you wish regarding photos and social media accounts.

Keep the envelope where the birth certificates and policies are. Tell one or two people where it is. Update it once a year – easiest during tax season, as you are already going through documents then.

If your password manager has an emergency access feature (a designated person requests access, you get a notification and have a few days to deny it, and if you do not respond, access is granted), enable it. This solves the same problem without paper.

Only Poland: regarding what happens to bank accounts after the death of a loved one and how to prepare for it, we discuss it in the guide Bank account after the death of a spouse.

Most Common Mistakes

• One password for everything. The biggest single mistake. One leak opens everything.
• Variations of one password. Kasia1, Kasia2, Kasia! are considered one password by password cracking software. Rules modifying words are a standard feature of tools.
• Enabling a second factor without obtaining backup codes. The most common cause of losing access to one’s own account.
• Keeping backup codes in email. If someone takes over your email, they have both the codes and everything else.
• Giving a one-time code to someone who calls. The code is meant to not be shared with anyone.
• Clicking on the "change password" link from an email. Always go to the site from a bookmark.
• Changing just the password after a leak, without logging out of sessions. A stolen session cookie continues to work.
• Real answers to security questions, when the same facts are in a public profile.
• Saving a password on someone else's computer.
• Putting off the password manager for "someday". Just start with one account – email.
• Setting account recovery to an address you no longer have access to. Check old addresses from work and school.
• Treating passkeys as the only way. Until you have it on two devices, keep the password and backup codes.

Myths and Facts

Password Myth	What the Source Says	What to Do Instead
You need to change your password every 30 days	NIST SP 800-63B-4, section 3.1.1.2: "SHALL NOT require subscribers to change passwords periodically. However, verifiers SHALL force a change if there is evidence that the authenticator has been compromised"	Change your password when there is a reason: a leak, suspicion that someone knows it, use on someone else's device
A strong password must have a capital letter, a number, and a special character	NIST, section 3.1.1.2: "SHALL NOT impose other composition rules (e.g., requiring mixtures of different character types)"	Focus on length and uniqueness. 14–16 characters or more
"P@ssw0rd!" is safe because it has symbols	NIST, Appendix A: a user who would choose "password", "would be relatively likely to choose »Password1«… or »Password1!«	A few unrelated words: CISA suggests "a memorable phrase of 4–7 unrelated words"
Writing down passwords is always unsafe	NIST mandates services: "Verifiers SHALL allow the use of password managers and autofill functionality"	Use a password manager. A written notebook at home is also better than one password everywhere
A browser manager does not count	CERT Poland: "We recommend password managers. Those in browsers or phones perform their function well"	Start with the built-in one. Consider a separate app when using multiple ecosystems
SMS as a second factor is enough	CISA: SMS "Vulnerable to phishing, SS7, and SIM swap attacks", "should only be used as a last resort MFA option". FTC: "the least secure type of two-factor authentication"	Choose an authentication app or key. Leave SMS where there is nothing else
Since I have 2FA, phishing does not concern me	NIST, section 3.1.4: "OTP authentication is not phishing-resistant". CISA describes ready "MFA bypass toolkits"	For the most important accounts, use a passkey or hardware key. CISA: "The only widely available phishing-resistant authentication is FIDO/WebAuthn"
A passkey is just a fingerprint instead of a password	Microsoft: biometrics "remains on the user's device and isn't transmitted across the network or to the service"	Understand that a passkey is a cryptographic key, and the fingerprint only unlocks it on your device
Passkeys are unrecoverable, so it's not worth it	NIST, Appendix B, allows synchronized keys while maintaining requirements, including "AAL2-equivalent MFA" for access to synchronization cloud	Use synchronized passkeys and secure the account on which they synchronize
Security questions increase security	NIST, section 3.1.1.2: "SHALL NOT prompt subscribers to use knowledge-based authentication (KBA)… or security questions"	Enter random answers and save them in the password manager
No result on haveibeenpwned means I am safe	The service only includes publicly known leaks and those added to it; some are marked as sensitive and cannot be searched publicly	Treat the result as a signal, not a guarantee. Regardless of the result, use unique passwords
My account is not interesting to criminals	CISA: "Malicious cyber actors are increasingly capable of phishing or harvesting passwords… They take advantage of passwords you reused on other systems"	Attacks are automated and do not select targets. What matters is that the password fits, not who you are

Where to Report Fraud or an Incident

Only Poland

• CERT Poland, incident reporting: https://incydent.cert.pl/ – here you report fake websites, phishing, hacked accounts, and other incidents. The team operates within NASK as CSIRT NASK.
• Suspicious SMS: forward it to the number 8080. CERT Poland: "We have launched a new, easy-to-remember number for reporting suspicious SMS messages: 8080".
• Suspicious email: cert.pl accepts email reports at the address provided in the footer of their website.
• Police: if you have lost money, file a crime report at the nearest station. Emergency number 112.
• Bank: immediately, by phone, using the number from the back of the card or from the official bank website – never from an SMS.
• UODO: if the leak concerns your personal data and the administrator has not contacted you, information and hotline can be found at https://uodo.gov.pl/

Only USA

• Identity theft: https://www.identitytheft.gov/ – a government FTC service that creates an individual recovery plan.
• Fraud: https://reportfraud.ftc.gov/
• Internet crime: https://www.ic3.gov/ – Internet Crime Complaint Center run by the FBI.
• Bank or card issuer: immediately, using the number from the back of the card.
• State or local police: a report may be needed for claims.

In both countries, the same principle applies: report, even if you do not recover your money. Reports build a picture of the phenomenon and allow blocking further campaigns.

Related topics for which guides are in preparation: fake online stores, money transfers to Poland, fake charity collections.

Key Principles

1. Length over complexity. 14–16 characters or more. A few unrelated words instead of exclamation marks and numbers.
2. Unique password for each service. This is more important than its complexity.
3. Do not change your password according to a calendar. Change it when there is a reason.
4. Start with email. It is the key to all other accounts.
5. Enable a second factor wherever possible. Even SMS is better than nothing.
6. Authentication app instead of SMS, if you have a choice.
7. Passkey or hardware key for the most important accounts. This is the only phishing-resistant method.
8. Print and hide backup codes before changing anything.
9. Always have two independent ways to access your account.
10. Password manager, even the one built into the browser. Better than memory and better than repeating passwords.
11. Answer security questions falsely and save the answers.
12. No one ever has the right to ask you for your password or one-time code.
13. Secure the account where your passwords and passkeys synchronize the most.
14. Leave loved ones an emergency way in. A sealed envelope or account guardian.

Checklist

Account Security Review in 30 Minutes

Minutes 0–10: email

• New password for the main inbox, 14–16 characters or longer, not used anywhere else
• Second factor enabled (authentication app, if available)
• Backup codes downloaded and printed
• Checked recovery email address and phone number – are they still yours
• Checked email forwarding rules – is there a foreign address
• Logged out of all devices

Minutes 10–18: ecosystem account (Apple, Google, Microsoft)

• New unique password
• Second factor enabled
• Backup codes downloaded
• Reviewed list of logged-in devices
• Set recovery contact

Minutes 18–24: bank and money

• Checked if transaction authorization goes through the app, not SMS
• Enabled login and transaction notifications
• Set transfer limits
• Checked list of trusted recipients

Minutes 24–30: the rest and cleanup

• Email checked on haveibeenpwned.com
• List of services where the password was reused – to change in the coming days
• Password manager installed or enabled
• Backup codes hidden with documents
• Agreed with a close person where the emergency envelope is

To do in the coming days

• Changed passwords on services with reused passwords
• Deleted accounts you do not use
• Improved security questions with random answers
• Added passkeys where the service supports them
• Enabled backup in the authentication app

Frequently Asked Questions

Is a password manager safe?

Yes, in the sense that it is safer than the real alternative, which is repeating one password. NIST mandates that services allow password managers and justifies this with research: "Password managers have been shown to increase the likelihood that subscribers will choose stronger passwords." The risk exists and is real – everything is in one place – but it is mitigated by a strong master password, a second factor on the manager's account, and an up-to-date system. No solution provides complete security.

How many characters should a good password have?

It depends on whom you ask, and the differences are instructive. NIST requires a minimum of 15 characters for a password that is the sole login component. CERT Polska recommends at least 14 characters and raised this threshold from 12 in June 2025. CISA mentions at least 16 characters. The reasonable conclusion for an average user: 14–16 characters is a sensible threshold, and each additional character helps.

Do I really not need to change my password every month?

No, you do not need to and should not. NIST has recorded this as a prohibition for service providers: periodic changes cannot be enforced, but a change must be enforced when there is evidence of compromise. CERT Polska explains why: enforced new passwords are usually predictable variations of previous ones. In Poland, the regulation mandating periodic changes in systems processing personal data was repealed on February 6, 2019.

What happens if I forget the master password for my password manager?

It depends on the solution, and you need to check this before you start using it, not later. Some managers are designed so that the provider does not know your password and cannot reset it – in that case, losing the master password means losing the entire database. Others offer a recovery key to print or recovery through a system account. Generate and store the recovery key on the day you set up the manager.

Is the password manager built into the browser sufficient?

For most people, yes. CERT Polska assesses this unequivocally: "Those in browsers or phones perform their function well." A separate application has an advantage when you use different ecosystems at the same time – for example, an iPhone plus a Windows computer – or when you need features such as sharing passwords with family and emergency access.

Is SMS as a second factor already outdated?

It is the weakest of the available methods, but it is not useless. CISA classifies SMS as vulnerable to phishing, SS7 attacks, and SIM swaps, stating that it "should only be used as a last resort MFA option." The FTC calls it the least secure type of two-factor login. At the same time, CISA reiterates that any second factor is better than none. If SMS is the only option for a given service, enable it.

What is a SIM swap and how can I defend against it?

It is a situation where a criminal convinces the mobile operator to transfer your number to a SIM card they control. From that point on, SMS codes go to them. Defense: set an additional password or PIN with your operator for account management, do not use SMS as a second factor in the most important services, and react immediately if your phone suddenly loses signal for no reason.

Does a passkey replace both the password and the second factor at the same time?

In practice, yes. A passkey combines "something you have" (a device with a private key) with "something you are" or "something you know" (a fingerprint, face, or PIN unlocking the key). Therefore, many services do not ask for anything more when logging in with a passkey. Your fingerprint does not go anywhere – Microsoft confirms that biometric information remains on the device and is not transmitted over the network or to the service; the service only receives a cryptographic signature. This does not mean you can immediately delete your password – as long as you have the passkey only on one device, the password and backup codes are your emergency route.

What happens to my passkeys if I lose my phone?

If they are synchronized through an Apple, Google, or Microsoft account, they will return to a new device after logging into that account. If the passkey was saved only locally on the lost device, it is lost, and you must use another login method for that service. Therefore, the account where your passkeys synchronize should be secured the most strongly of all.

Where should I keep backup codes?

Printed or written down, at home, together with documents – as recommended by NIST ("maintained offline, e.g., printed or written down") and CERT Polska. You can leave a second set with a trusted person. Do not keep them in your email inbox or as a photo on your phone. If you want to keep them in a password manager, ensure that the manager is not secured with the same second factor that these codes pertain to.

Is it worth checking my address on haveibeenpwned.com?

Yes, because it is a quick way to find out in which known breaches you have appeared. However, you need to know what this result does not mean. The service only includes publicly disclosed breaches that have been added to it, and some of them are marked as sensitive and are not publicly searchable. Therefore, a lack of hits does not prove that your data has not leaked anywhere. The service also does not show passwords.

I entered my password on a fake site. What now?

Act immediately and in this order: change your password on the real service by going to it from a bookmark, not from a link; change that password everywhere it was the same; log out of all sessions; check recovery settings and mail forwarding rules; enable a second factor if it was not there. If you also provided a one-time code, assume that someone has already accessed the account, and refer to the guide on compromised accounts.

How to secure my parents' account who do not want to install any applications?

Leave SMS as a second factor, as it is understandable and still greatly improves the situation compared to just the password. Set one very good password for email and let the phone or browser remember the rest. Enable fingerprint unlocking for the phone – this is a change in settings, not a new application. Print the backup codes and hide them in an agreed location. And set up bank notifications for every transaction together.

What to do to ensure my family has access to my accounts after my death?

Utilize ready-made mechanisms where they exist – Apple has an account guardian who, after your death, gains access to photos, messages, and files (but not to passwords from the iCloud keychain), and some password managers have an emergency access feature. Regardless, prepare a sealed envelope with the master password, phone PIN, email password, and backup codes, hide it where you keep assets and policies, and tell one or two people where it is located.

Sources

Access date for all sources: 2026-07-27.

1. National Institute of Standards and Technology (NIST), USA – "Digital Identity Guidelines: Authentication and Authenticator Management", publication NIST SP 800-63B-4, final version from July 31, 2025, replaces SP 800-63B from 2020. https://pages.nist.gov/800-63-4/sp800-63b.html – key sections for this guide: 3.1.1 (passwords, "Passwords are not phishing-resistant"), 3.1.1.2 (requirements for password verifiers: minimum 15 characters, maximum at least 64, ban on complexity rules, ban on enforcing periodic changes, ban on security questions, obligation to compare with leaked password lists, obligation to allow password managers), 3.1.3 (out-of-band authentication, including SMS), 3.1.3.3 (PSTN network limitations), 3.1.4 (one-time codes), 3.2.2 (limiting the number of attempts), 4.2.1.1 (recovery codes), 4.2.1.3 (recovery contacts), Appendix A (justification: password strength), Appendix B (synchronized authenticators, i.e., passkeys).
2. NIST, publication catalog page – designation, status, and publication date of SP 800-63B-4. https://csrc.nist.gov/pubs/sp/800/63/b/4/final – confirms that the document is final and what it replaces.
3. CISA (Cybersecurity and Infrastructure Security Agency), USA – "More than a Password". https://www.cisa.gov/MFA – explains what multi-factor authentication is and states that the only widely available phishing-resistant method is FIDO/WebAuthn. The page is marked by CISA as archival material.
4. CISA – "Implementing Phishing-Resistant MFA", fact sheet from October 2022. https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf – includes a table of login methods from strongest to weakest and describes attacks: phishing, push bombing, SS7, SIM swap.
5. CISA – "Use Strong Passwords" (Secure Our World campaign). https://www.cisa.gov/secure-our-world/use-strong-passwords – recommends passwords of at least 16 characters, random and unique, and using a password manager. The page is marked as archival material.
6. CISA – "Turn On MFA" (Secure Our World campaign). https://www.cisa.gov/secure-our-world/turn-mfa – general instructions for enabling a second factor, regardless of the service. The page is marked as archival material.
7. CISA – "Next Level MFA: FIDO Authentication", blog post by CISA Director from October 18, 2022. https://www.cisa.gov/news-events/news/next-level-mfa-fido-authentication – explains why FIDO is called the gold standard and why phishing attacks fail even when the user is tricked.
8. CERT Polska (CSIRT NASK) – "Comprehensive Guide to Passwords", January 10, 2022, with updated recommendations in June 2025. https://cert.pl/posts/2022/01/kompleksowo-o-haslach/ – Polish recommendations: minimum 14 characters, no enforced periodic changes, no complexity criteria, full sentence method, examples of seemingly strong passwords.
9. CERT Polska – "What Data Breaches Say About Passwords", January 10, 2022. https://cert.pl/posts/2022/01/co-wycieki-danych-mowia-o-haslach/ – analysis of passwords from breaches, including Polish ones: over half are not longer than 8 characters, a list of the fifty most popular passwords.
10. CERT Polska – "Passwords" (compendium, aggregate page). https://cert.pl/hasla/ – starting point for all Polish materials on passwords, including posters and a dictionary of Polish passwords from breaches.
11. CERT Polska – "Ensure Secure Passwords and Logins". https://cert.pl/bezpieczne-hasla – three user principles: minimum 14 characters, different passwords for different services, two-step verification; recommendation for password managers built into browsers and phones.
12. CERT Polska – "Enable Two-Step Verification". https://cert.pl/2etapy/ – explanation of the second factor in Polish and instructions for backing up in popular authentication apps.
13. CERT Polska – "Fake SMS – A Plague of Recent Months". https://cert.pl/baza-wiedzy/falszywe-smsy – description of smishing and confirmation of the number 8080 for reporting suspicious SMS messages.
14. CERT Polska – incident reporting form. https://incydent.cert.pl/ – channel for reporting phishing, fake websites, and compromised accounts in Poland.
15. FIDO Alliance – "Passkeys". https://fidoalliance.org/passkeys/ – official definition of a passkey and description of the FIDO2/WebAuthn standard. The page blocks automatic downloads, content confirmed in the Wayback Machine archive (copy from July 26, 2026).
16. passkeys.dev – resource maintained by members of the W3C Web Identity & Credentials Adoption CG and FIDO Alliance. https://passkeys.dev/ – materials explaining passkeys for implementers.
17. Federal Trade Commission (FTC), USA – "Creating Strong Passwords and Other Ways To Protect Your Accounts", November 2024. https://consumer.ftc.gov/articles/creating-strong-passwords-and-other-ways-protect-your-accounts – consumer tips: at least 12 characters, protecting email inbox, SMS as the weakest second factor, how to answer security questions.
18. FTC – IdentityTheft.gov. https://www.identitytheft.gov/ – government service for reporting identity theft in the USA and creating a recovery plan.
19. FTC – ReportFraud.ftc.gov. https://reportfraud.ftc.gov/ – reporting fraud in the USA.
20. FBI – Internet Crime Complaint Center (IC3). https://www.ic3.gov/ – reporting internet crimes in the USA.
21. Consumer Financial Protection Bureau (CFPB), USA – "Fraud and scams". https://www.consumerfinance.gov/consumer-tools/fraud/ – information for consumers about financial fraud in the USA.
22. Have I Been Pwned – homepage and FAQ and "Who, What & Why" sections. https://haveibeenpwned.com/ , https://haveibeenpwned.com/FAQs , https://haveibeenpwned.com/About – service run by Troy Hunt; explains that passwords are not stored alongside addresses, that Pwned Passwords uses SHA-1 hashes, and that some breaches are marked as sensitive.
23. Google – "Enabling two-step verification". https://support.google.com/accounts/answer/185839?hl=pl – official instructions for enabling the second factor on a Google account.
24. Google – "Signing in with a passkey instead of a password". https://support.google.com/accounts/answer/13548313?hl=pl – passkeys on a Google account.
25. Google – "Two-step verification using a security key". https://support.google.com/accounts/answer/6103523?hl=pl – hardware keys on a Google account.
26. Google – "Signing in with backup codes". https://support.google.com/accounts/answer/1187538?hl=pl – backup codes for a Google account.
27. Google – Advanced Protection Program. https://landing.google.com/advancedprotection/ – enhanced account protection mode for particularly vulnerable individuals.
28. Apple – "Two-step authentication for Apple ID". https://support.apple.com/pl-pl/102660 – official description of the second factor on an Apple account.
29. Apple – "Using keys to sign in to websites and apps on iPhone". https://support.apple.com/pl-pl/guide/iphone/iphf538ea8d0/ios – passkeys on iPhone.
30. Apple – "Key security". https://support.apple.com/pl-pl/102195 – how Apple secures access keys.
31. Apple – "Information on securing your Apple ID with security keys". https://support.apple.com/pl-pl/102637 – hardware keys for an Apple account.
32. Apple – "Setting up iCloud Keychain". https://support.apple.com/pl-pl/109016 – synchronizing passwords and access keys in the Apple ecosystem.
33. Apple – "Using the Passwords app to create, manage, and share passwords and keys on Apple devices". https://support.apple.com/pl-pl/120758 – built-in password manager by Apple.
34. Apple – "Setting up a recovery contact for your Apple ID". https://support.apple.com/pl-pl/102641 – a person who helps regain access to your account.
35. Apple – "How to add an account guardian for your Apple ID". https://support.apple.com/pl-pl/102631 – access for loved ones to account data after the owner's death; the page also lists data that the guardian will not receive, including passwords and access keys from iCloud Keychain.
36. Google – "Frequently asked questions about Advanced Protection". https://support.google.com/accounts/answer/7539956?hl=pl – Polish explanation of what Advanced Protection is and what it requires.
37. Apple – "Trusted phone numbers and trusted devices on your Apple ID". https://support.apple.com/pl-pl/122621 – where verification codes go and how to manage trusted numbers.
38. Apple – "Setting up a recovery key for your Apple ID". https://support.apple.com/pl-pl/109345 – 28-character recovery key, warning about permanent account lockout if lost, and a list of places where Apple advises against storing it.
39. Apple – "Logging into your account on Mac using a key". https://support.apple.com/pl-pl/guide/passwords/mchl4af65d1a/mac – practical instructions for logging in with a passkey on Mac.
40. Microsoft – "How to use two-step verification with your Microsoft account". https://support.microsoft.com/pl-pl/account-billing/jak-u%C5%BCywa%C4%87-weryfikacji-dwuetapowej-z-kontem-microsoft-c7910146-672f-01e9-50a0-93b4585e7eb4 – enabling the second factor on a Microsoft account; the page includes an announcement of the gradual phasing out of SMS as an authentication and recovery method for personal accounts.
41. Microsoft – "Signing in with a passkey". https://support.microsoft.com/en-us/account-billing/signing-in-with-a-passkey-09a49a86-ca47-406c-8acc-ed0e3c852c6d – signing in with a passkey to a Microsoft account.
42. Microsoft – "Create and save a passkey". https://support.microsoft.com/en-us/account-billing/create-and-save-a-passkey-e92cd3e0-11fa-4630-a5ea-3ccc0396b3d9 – creating a passkey.
43. Microsoft – "Manage your saved passkeys". https://support.microsoft.com/en-us/account-billing/manage-your-saved-passkeys-6a70599a-25e1-4461-86be-d67d1023c69f – reviewing and deleting saved passkeys.
44. Microsoft – "Download and install the Microsoft Authenticator app". https://support.microsoft.com/en-us/account-billing/download-and-install-the-microsoft-authenticator-app-351498fc-850a-45da-b7b6-27e523b8702a – installing the authenticator app.
45. Microsoft – "Add accounts to Microsoft Authenticator". https://support.microsoft.com/en-us/account-billing/add-accounts-to-microsoft-authenticator-43a73ab5-b4e8-446d-9e54-2a4cb8e4e93c – adding accounts to the app.
46. Microsoft – "Passkeys in Windows". https://support.microsoft.com/en-us/windows/passkeys-in-windows-301c8944-5ea2-452b-9886-97e4d2ef4422 – passkeys in Windows from the user's perspective.
47. Microsoft – "How to go passwordless with your Microsoft account". https://support.microsoft.com/en-us/account-billing/how-to-go-passwordless-with-your-microsoft-account-674ce301-3574-4387-a93d-916751764c43 – removing the password from a Microsoft account.
48. Microsoft Security Blog – "Pushing passkeys forward: Microsoft's latest updates for simpler, safer sign-ins", May 1, 2025, authors Vasu Jakkal and Joy Chik. https://www.microsoft.com/en-us/security/blog/2025/05/01/pushing-passkeys-forward-microsofts-latest-updates-for-simpler-safer-sign-ins/ – official announcement: "Brand new Microsoft accounts will now be 'passwordless by default'". This applies to new accounts; existing users can remove their passwords themselves.
49. Microsoft – "Support for passkeys in Windows" (technical documentation). https://learn.microsoft.com/en-us/windows/security/identity-protection/passkeys/ – description of how passkeys work, including information that biometric data does not leave the device.
50. Microsoft – "Configure Windows Hello". https://support.microsoft.com/en-us/windows/sign-in-to-your-microsoft-account-with-windows-hello-or-a-security-key-800a8c01-6b61-49f5-0660-c2159bea4d84 – signing in with face, fingerprint, or PIN in Windows.
51. Meta (Facebook) – "How two-factor authentication works on Facebook". https://www.facebook.com/help/148233965247823 – path to settings in the Accounts Center, three available methods for the second factor, and ten backup login codes. These settings also include Instagram accounts linked in the Accounts Center.
52. Meta (Instagram) – "Two-factor authentication". https://help.instagram.com/566810106808145 – Instagram help page on two-factor authentication. The topic confirmed based on the page's metadata; the content could not be read automatically as it loads only in the browser.
53. WhatsApp – "How to manage two-step verification settings". https://faq.whatsapp.com/1920866721452534 – six-digit PIN protecting the registration of the number and the role of the email address in recovery. Title confirmed; content loads on the browser side.
54. Personal Data Protection Office (UODO), Poland – homepage of the office with a hotline for citizens. https://uodo.gov.pl/ – information on personal data protection and contact regarding breaches.