Weekend security checkup

• Start with email, your password manager, financial accounts, your device account, and your mobile carrier.
• Generate long, unique passwords wherever passwords are still needed. Prioritize reused, weak, or exposed passwords.
• Protect the password manager with its supported strong sign-in method and keep its recovery instructions somewhere you can reach without opening that vault.

Reviewed when: Your priority accounts have unique passwords, and you know how to regain access to the vault.

• Create a passkey from the account's own security settings on a device you control.
• Check whether it syncs through a credential provider or stays on one device or security key.
• Keep an independent way back in if that device or the account that syncs your passkeys becomes unavailable.

Reviewed when: You can sign in with a passkey and explain what happens if its device is lost.

• Consider a FIDO security key for important accounts that support it. A hardware key can hold passkeys or act as a second factor.
• Register and test a second key where supported. Keep it securely apart from the everyday key.
• Check the service's recovery rules before enabling a setup that requires physical keys.

Reviewed when: Your spare is registered and reachable, or you have reviewed a different supported backup method.

• Prefer phishing-resistant options such as FIDO security keys when available. Authenticator codes are another option; SMS adds protection when stronger options are unavailable.
• Check how you would restore an authenticator after replacing your phone.
• Never approve an unexpected sign-in prompt or give a caller a one-time code. Authenticator codes can still be phished.

Reviewed when: Password-based priority accounts have a second factor and a documented fallback.

• Confirm that you still control each recovery number and can access each recovery inbox. Check old work, school, and provider addresses.
• Add and verify a current replacement before removing an old method where possible. Follow the provider's waiting periods and confirmation steps.
• Check recovery contacts, trusted devices, and official recovery instructions. Available options differ by service.

Reviewed when: Each priority account has current, verified recovery information and a known official recovery route.

• Generate backup codes when offered and follow that service's storage instructions. A protected offline copy can avoid a device dependency.
• Check whether codes are single-use and whether generating a new set invalidates the previous set.
• Treat codes as secrets. Enter them only into the service's official recovery or sign-in flow, never in this checklist or a message to someone who contacts you.

Reviewed when: You know where the current codes are and can reach them without the missing device.

• Trace the path for email, the password vault, and the account that syncs your passkeys: what does each require if your phone disappears?
• Watch for email that needs the vault while the vault needs that same email, or backup codes stored only inside the locked account.
• Keep an independently reachable method permitted by the provider. Walk through the instructions while still signed in; do not erase devices or remove your only working method to test them.

Reviewed when: You can describe a recovery route that does not rely solely on the unavailable device or account.

• Use supported shared vaults, delegated access, or emergency-access features for information someone else genuinely needs.
• Have the trusted person confirm they can use their own authorized access. Keep private accounts separate.
• Check recovery-contact and legacy-contact rules. Helping someone recover an account and accessing it after their death are different permissions.

Reviewed when: A trusted person knows the plan and has tested the access you intend them to have.

• Include computers, phones, browsers, apps, and your home router. Check whether older devices still receive security updates.
• Remove software and browser extensions you no longer use. Keep a screen lock on devices that can open accounts.

Reviewed when: Your everyday devices are updated, with an update plan for anything still outstanding.

• Use your carrier's official app or support channel to enable available account and port-out protections.
• A SIM PIN locks use of the SIM; it is different from a carrier account PIN and does not stop a carrier-side SIM swap. Follow carrier instructions before changing it.
• Prefer a non-SMS sign-in factor on important accounts when available.

Reviewed when: You have reviewed your carrier's protections and know which PIN protects which part of the account.

• Review recent activity in your email, financial, cloud, and social accounts through their official settings.
• Revoke access you no longer need. Investigate unfamiliar email-forwarding rules and sign-ins.
• If you find evidence of compromise, follow the provider's compromised-account process; changing a password alone may leave other access in place.

Reviewed when: You recognize the access on priority accounts and have addressed unfamiliar activity.

• Agree on a separate safeword offline with your trusted group. Do not reuse an account password, PIN, or recovery code.
• For an urgent or unusual request, pause and call back using a number you already trust. Do not rely on a familiar voice or caller ID alone.
• If the safeword is wrong, exposed, or forgotten, stop and verify another way. Knowing a safeword does not automatically authorize a payment.

Reviewed when: Everyone knows the verification plan and has practiced a callback.

• Choose a backup that will remain available if your everyday device is lost or damaged.
• Restore a harmless sample file to a separate location and open it. Confirm that you can reach any encryption key or account needed for recovery.
• Review the backup after replacing a device or changing accounts.

Reviewed when: A restored sample opens successfully, and you can reach the backup without the original device.

• Keep emergency contacts and essential document copies in a secure place your household knows about. Keep secret recovery material protected separately.
• Check water, shelf-stable food, needed medication, a flashlight, some cash, and a way to charge essential devices.
• Use your local emergency-management guidance for supplies and safe backup power. Revisit the plan when your household changes.

Reviewed when: Someone else can find the offline plan and the essential supplies.