Start with a single list of what you actually have
The first step is to write down every online account you use. Not the ones you think you have — the ones you actually log into. This includes email, banking, social media, shopping sites, utility companies, insurance portals, government benefits portals, subscription services, and anything else that requires a password.
Go through your email inbox and search for password reset emails, welcome messages, or receipts. These show you accounts you may have forgotten about. Check your credit card statements for recurring charges — each one is likely tied to an account. Look at your phone's app folder; every app that requires login is an account you need to track.
Write this list somewhere you can access it later. A spreadsheet, a notebook, or a document on your computer works. The goal is to know what exists before you try to organize it.
Key Takeaways
- Create one master list of all your accounts by searching your email for password resets and checking credit card statements for recurring charges.
- Use a password manager to store passwords securely instead of writing them down or reusing the same password across sites.
- Set up two-factor authentication on accounts that hold money or personal information, starting with email and banking.
- Group accounts by purpose — financial, health, shopping, entertainment — so you know where to look when you need something.
- Check your accounts monthly for suspicious activity and update passwords on financial accounts at least once a year.
Use a password manager to stop reusing passwords
Reusing the same password across multiple sites is the fastest way to lose control of all your accounts at once. If one site gets hacked, someone with your password can try it on your email, your bank, your insurance portal, and everything else. A password manager solves this by storing unique passwords for each site in one encrypted place.
Common password managers include Bitwarden, 1Password, LastPass, and Dashlane. Most have free versions that work for personal use. You create one strong master password to unlock the manager, and it remembers every other password for you. When you need to log in to a site, the manager fills in your username and password automatically.
Start by moving your most important accounts into the password manager first: email, banking, and any account tied to money. Then add the rest over time. The manager can also generate new strong passwords for you when you change old ones.
Turn on two-factor authentication for accounts that matter
Two-factor authentication (often called 2FA) means you need two things to log in: your password and a second proof that you are really you. This second proof is usually a code sent to your phone, a code generated by an app, or a fingerprint scan. Even if someone steals your password, they cannot get in without that second factor.
Start with your email account. If someone gets into your email, they can reset passwords on every other account you own. Email is the master key. After email, turn on two-factor authentication for your bank, investment accounts, insurance portals, and any government benefits site you use.
For the second factor, a code sent by text message (SMS) is better than nothing but not the strongest option. An authenticator app like Google Authenticator, Microsoft Authenticator, or Authy is more secure because it generates codes on your phone that cannot be intercepted. Use an authenticator app if the site offers it.
Organize accounts by what they do
Group your accounts into categories so you know where to look when you need something. Common groups are: financial (bank, credit cards, investment accounts), government (tax portals, benefits, Social Security), health (insurance, doctor portals, pharmacy), utilities (electric, water, internet), shopping (Amazon, eBay, stores you use often), and entertainment (streaming services, social media).
In your master list or spreadsheet, add a column for the category. When you need to check on a bill or look up a statement, you can scan your list by category instead of scrolling through everything. This also helps you spot accounts you have forgotten about or no longer use.
Some people keep their list in a spreadsheet with columns for: account name, website, username, category, and the date they last changed the password. Others use a notebook organized by category. The format does not matter as long as you can find what you need quickly.
Keep your master list secure
Your master list is valuable — it tells someone which sites to target if they want to break into your accounts. Store it somewhere secure, not on a sticky note on your monitor or in an email to yourself.
If you use a password manager, you do not need to write down passwords at all — the manager stores them encrypted. You only need to remember your master password for the manager itself. If you keep a list on paper, store it in a locked drawer or safe. If you keep it on your computer, use a password-protected document or a locked folder.
Never email your passwords to yourself or store them in a regular document on your desktop. If your email gets hacked or your computer gets stolen, anyone with access can see them.
Check your accounts regularly for signs of trouble
Once a month, spend 15 minutes checking your most important accounts for suspicious activity. Log into your bank and look at recent transactions. Check your email account's login history to see if anyone else has accessed it. Look at your credit card statements for charges you do not recognize.
Most banks and email providers show you where and when your account was last accessed. If you see a login from a city you were not in or a device you do not own, change your password immediately and contact the company.
For accounts that hold money or personal information, change your password at least once a year. For accounts you use less often, change the password every two years. If you hear about a data breach at a company where you have an account, change that password right away even if you have not changed it recently.
Delete accounts you no longer use
Old accounts you stopped using are still sitting on company servers with your personal information attached. If that company gets hacked, your data is exposed even though you have not logged in for years. Go through your master list and identify accounts you have not used in the past year.
Contact the company and ask how to delete your account. Some sites have a delete option in account settings. Others require you to email support. A few make deletion difficult on purpose, but most will do it if you ask. Once an account is deleted, remove it from your master list.
If you are not sure whether you still need an account, leave it for now. But if you know you will never use it again — an old shopping site, a service you switched away from, a social media account you abandoned — delete it and reduce the number of places your information is stored.
Frequently Asked Questions
What should I do if I forget my master password for my password manager?
Most password managers let you set up account recovery options when you first sign up — usually a recovery email or backup codes. If you set these up, you can use them to regain access. If you did not set up recovery and you forget the master password, you will lose access to all your stored passwords. Write down your master password or store it somewhere very secure, or use the recovery options your manager offers.
Is it safe to use the same password manager on my phone and computer?
Yes, that is the whole point of a password manager — it syncs across your devices so you have the same passwords everywhere. Make sure your phone and computer both have strong security (a PIN or fingerprint lock on your phone, a password on your computer) so that if one device is lost or stolen, the thief cannot access your password manager.
What if a website does not let me use a strong password?
Some older websites have strange password rules — they might not allow special characters or might limit password length. Use the strongest password that site will accept, and store it in your password manager. When you next have the chance to change it, try again with a stronger one. If the site still refuses, at least you know it is not your fault.
How do I know if one of my accounts has been hacked?
Check your email for password reset requests you did not make, or login notifications from places you were not. Look at your bank and credit card statements for charges you do not recognize. You can also visit haveibeenpwned.com and enter your email address to see if it appeared in any known data breaches. If you find evidence of a breach, change your password immediately and contact the company.
Should I write down my passwords on paper as a backup?
A password manager is more secure than writing passwords down, but if you do not trust technology, a written list in a locked safe is better than reusing passwords or forgetting them. Never leave written passwords where someone else can find them. If you choose to write them down, keep the list updated whenever you change a password, and store it somewhere only you can access.