Safewords.io / English complete guide / Content reviewed 2026-10-24
Weekend security checkup: complete guide
English guide. Includes all 14 core actions, recovery exercises, definitions, and optional U.S. identity and software-tool checks. No personal progress or account information is included.
Start while you still have access. Check your recovery options before replacing a phone or removing an old sign-in method.
Protect your way in
Start with your primary email and password manager. They often unlock everything else.
Give every important account its own password
Use a password manager, replace reused passwords, and protect the vault itself.
- Start with email, your password manager, financial accounts, your device account, and your mobile carrier.
- Generate long, unique passwords wherever passwords are still needed. Prioritize reused, weak, or exposed passwords.
- Protect the password manager with its supported strong sign-in method and keep its recovery instructions somewhere you can reach without opening that vault.
Done when: Your priority accounts have unique passwords, and you know how to regain access to the vault.
CISA: password managers
https://www.cisa.gov/secure-our-world/use-strong-passwords
Set up passkeys where supported
Use phishing-resistant sign-in and find out where each passkey lives.
- Create a passkey from the account's own security settings on a device you control.
- Check whether it syncs through a credential provider or stays on one device or security key.
- Keep an independent way back in if that device or the account that syncs your passkeys becomes unavailable.
Done when: You can sign in with a passkey and explain what happens if its device is lost.
FIDO Alliance: passkeys
https://fidoalliance.org/passkeys/
Register a spare security key if you use one
A spare only helps after you register it with each account that needs it.
- Consider a FIDO security key for important accounts that support it. A hardware key can hold passkeys or act as a second factor.
- Register and test a second key where supported. Keep it securely apart from the everyday key.
- Check the service's recovery rules before enabling a setup that requires physical keys.
Done when: Your spare is registered and reachable, or you have reviewed a different supported backup method.
FIDO Alliance: security keys and passkeys
https://fidoalliance.org/passkeys/
Turn on a second factor where needed
For password sign-ins, add the strongest supported authentication you can maintain.
- Prefer phishing-resistant options such as FIDO security keys when available. Authenticator codes are another option; SMS adds protection when stronger options are unavailable.
- Check how you would restore an authenticator after replacing your phone.
- Never approve an unexpected sign-in prompt or give a caller a one-time code. Authenticator codes can still be phished.
Done when: Password-based priority accounts have a second factor and a documented fallback.
CISA: multifactor authentication
https://www.cisa.gov/secure-our-world/turn-mfa
Keep a way back in
An old phone number or unreachable inbox can turn a lost phone into a lost account.
Check recovery emails and phone numbers
Open security settings on your oldest, most important accounts. Check the actual details.
- Confirm that you still control each recovery number and can access each recovery inbox. Check old work, school, and provider addresses.
- Add and verify a current replacement before removing an old method where possible. Follow the provider's waiting periods and confirmation steps.
- Check recovery contacts, trusted devices, and official recovery instructions. Available options differ by service.
Done when: Each priority account has current, verified recovery information and a known official recovery route.
Google: recovery options and waiting periods
https://support.google.com/accounts/answer/183723
Save recovery codes somewhere reachable
Keep a secure copy outside the phone or account it is meant to recover.
- Generate backup codes when offered and follow that service's storage instructions. A protected offline copy can avoid a device dependency.
- Check whether codes are single-use and whether generating a new set invalidates the previous set.
- Treat codes as secrets. Enter them only into the service's official recovery or sign-in flow, never in this checklist or a message to someone who contacts you.
Done when: You know where the current codes are and can reach them without the missing device.
Google: how backup codes work
https://support.google.com/accounts/answer/1187538
Check for a circular recovery path
Your backup cannot depend entirely on the thing you are trying to recover.
- Trace the path for email, the password vault, and the account that syncs your passkeys: what does each require if your phone disappears?
- Watch for email that needs the vault while the vault needs that same email, or backup codes stored only inside the locked account.
- Keep an independently reachable method permitted by the provider. Walk through the instructions while still signed in; do not erase devices or remove your only working method to test them.
Done when: You can describe a recovery route that does not rely solely on the unavailable device or account.
Google: recovery dependencies
https://support.google.com/accounts/answer/183723
Close the everyday gaps
Review the devices, phone number, and connected services that can reach your accounts.
Update devices, browsers, and apps
Install supported updates from official settings and turn on automatic updates where practical.
- Include computers, phones, browsers, apps, and your home router. Check whether older devices still receive security updates.
- Remove software and browser extensions you no longer use. Keep a screen lock on devices that can open accounts.
Done when: Your everyday devices are updated, with an update plan for anything still outstanding.
CISA: software updates
https://www.cisa.gov/secure-our-world/update-software
Protect your phone number at the carrier
Review the carrier account PIN and SIM-change or number-transfer protections.
- Use your carrier's official app or support channel to enable available account and port-out protections.
- A SIM PIN locks use of the SIM; it is different from a carrier account PIN and does not stop a carrier-side SIM swap. Follow carrier instructions before changing it.
- Prefer a non-SMS sign-in factor on important accounts when available.
Done when: You have reviewed your carrier's protections and know which PIN protects which part of the account.
FTC: SIM-swap protection
https://consumer.ftc.gov/consumer-alerts/2019/10/sim-swap-scams-how-protect-yourself
Review who and what can access your accounts
Check signed-in devices, connected apps, forwarding rules, and security alerts.
- Review recent activity in your email, financial, cloud, and social accounts through their official settings.
- Revoke access you no longer need. Investigate unfamiliar email-forwarding rules and sign-ins.
- If you find evidence of compromise, follow the provider's compromised-account process; changing a password alone may leave other access in place.
Done when: You recognize the access on priority accounts and have addressed unfamiliar activity.
Google: secure a compromised account
https://support.google.com/accounts/answer/6294825
Prepare the people around you
Make the plan usable when a device, a connection, or a person is unavailable.
Agree on safewords and a callback plan
Practice verifying an unexpected request before sending money or sensitive information.
- Agree on separate safewords offline with your trusted group. Do not reuse an account password, PIN, or recovery code.
- For an urgent or unusual request, pause and call back using a number you already trust. Do not rely on a familiar voice or caller ID alone.
- If the safewords are wrong, exposed, or forgotten, stop and verify another way. Knowing safewords does not automatically authorize a payment.
Done when: Everyone knows the verification plan and has practiced a callback.
FTC: AI impersonation scams
https://consumer.ftc.gov/consumer-alerts/2023/03/scammers-use-ai-enhance-their-family-emergency-schemes
Restore one file from your backup
Check that important files have a separate backup you can actually use.
- Choose a backup that will remain available if your everyday device is lost or damaged.
- Restore a harmless sample file to a separate location and open it. Confirm that you can reach any encryption key or account needed for recovery.
- Review the backup after replacing a device or changing accounts.
Done when: A restored sample opens successfully, and you can reach the backup without the original device.
CISA: ransomware and backups
https://www.cisa.gov/stopransomware/ransomware-guide
Keep the essentials available offline
Prepare important contacts, documents, and basic supplies for an interruption.
- Keep emergency contacts and essential document copies in a secure place your household knows about. Keep secret recovery material protected separately.
- Check water, shelf-stable food, needed medication, a flashlight, some cash, and a way to charge essential devices.
- Use your local emergency-management guidance for supplies and safe backup power. Revisit the plan when your household changes.
Done when: Someone else can find the offline plan and the essential supplies.
Ready Iowa: emergency supplies
https://ready.iowa.gov/be-prepared/build-kit
Recovery exercises
Walk through a situation before it happens. Keep your working sessions and sign-in methods in place.
My phone is gone
Can you access your main email without that phone, its texts, or its authenticator?
- A registered spare key or another accessible sign-in method
- Current recovery codes kept outside the missing phone
- A way to reach the account that syncs your passkeys
Watch for this: A screenshot of backup codes on the missing phone is not an independent backup.
Before a phone is lost, locate a supported alternative and check its instructions. If it is already missing, use the provider's official recovery and lost-device process.
My email is locked
Can you recover it without receiving a message in that same inbox?
- A recovery email you can open independently
- A current recovery number or supported recovery contact
- Recovery instructions and vault access outside the locked inbox
Watch for this: Email restores the vault, but the vault holds the only way into email: neither gets you started.
While you still have access, add and verify an independent recovery option. Account providers may impose waiting periods; do not remove your only working method.
I cannot help
Can your trusted person find what they need without pretending to be you?
- Their own authorized access to essential shared information
- A known location for emergency contacts and instructions
- Recovery or legacy contacts set up under the service's rules
Watch for this: Knowing your phone unlock code is not the same as having an agreed emergency-access plan.
Walk through the plan together. Check that permissions match your intentions; a recovery contact and a legacy contact serve different purposes.
Definitions
- Passkey
- A phishing-resistant credential for an account. It may sync or stay on one device. Related check
- Security key
- A physical device that can hold a passkey or provide a second factor. Register the spare. Related check
- Recovery method
- Codes, current contacts, or another provider-approved route when normal sign-in fails. Related check
- Safewords
- Private words agreed with people you trust. They help check a person, not unlock an account. Related check
Optional: U.S. identity protection
Review U.S. credit-freeze options
Place a free freeze with each of the three nationwide credit bureaus if appropriate.
- Contact Equifax, Experian, and TransUnion separately through their official sites. A security freeze is free to place and lift.
- Keep a way to manage each freeze when you apply for credit. A freeze limits access to your credit report; it does not protect existing accounts from every kind of fraud.
Done when: You have reviewed all three bureaus and can manage any freezes you place.
CFPB: credit freezes
https://www.consumerfinance.gov/ask-cfpb/what-is-a-credit-freeze-or-security-freeze-on-my-credit-report-en-1341/
Consider an IRS Identity Protection PIN
Check eligibility and the current process directly with the IRS.
- An IP PIN helps prevent someone else from filing a federal tax return using your identifying information.
- Keep it secure and follow IRS instructions for obtaining the current year's PIN and using it when filing.
Done when: You have reviewed the IRS option and know how to retrieve the PIN if enrolled.
IRS: get an IP PIN
https://www.irs.gov/identity-theft-fraud-scams/get-an-identity-protection-pin
Optional: software and AI tools
Review software and AI-tool access
Update supported tools and dependencies, review permissions, and check changes before running them.
- Use trusted dependency and secret scanners. Verify findings and fixes; an AI review is a lead, not proof that a project is secure.
- Give tools only the repositories, credentials, and permissions their task requires. Review generated code and commands before applying them.
- Use existing, narrowly scoped automation for recurring checks. Do not give a general-purpose agent unrestricted access just to run an audit.
Done when: Your tools are supported, access is scoped, and security findings have been reviewed.
OWASP: agentic AI security
https://genai.owasp.org/resource/agentic-ai-threats-and-mitigations/