8PWDA password checklist you can finish in an evening
October is Cybersecurity Awareness Month. You do not need a month — ten steps, roughly one evening, in order of how much each one protects.
The ten steps
- 1
Start with email. It resets every other account. Give it a long unique password and two-factor authentication before anything else.
- 2
Find the reused ones. A reused password turns one leak into ten. 8PWD's Security tab lists reused and weak passwords and scores the vault; fix the accounts that hold money or identity first.
- 3
Turn on two-factor for banking, your Apple Account, Google, and the social accounts that could impersonate you. Keep the codes with the passwords or in a separate app — just somewhere backed up.
- 4
Move passwords out of the browser. A browser's saved passwords open with the device passcode on many phones. Import them into a password manager with AutoFill, then turn off the browser's own saving.
- 5
Make the master password long, not clever. Four or five unrelated words beat a short string of symbols. In 8PWD, turn on anti-theft encryption so the vault needs that password or Face ID even if the phone's passcode is known.
- 6
Write the recovery phrase on paper. Not in a note on the same phone. Keep it where you keep your passport.
- 7
Make a backup you can find. Export an encrypted
.8pwdfile to a place you control and let the scheduled backups run; a password manager without a backup is a single point of failure. - 8
Close what you don't use. Old accounts with old passwords are the easiest way in. Delete them rather than leaving a weak login alive.
- 9
Protect the lock screen. A six-digit passcode, Face ID or Touch ID, and auto-lock after a minute. The phone is the key to everything on it.
- 10
Set a reminder to repeat. Once a quarter is plenty. 8PWD can remind you to rotate passwords that have not changed in a long time.
What this list does not do
It does not make you unbreakable, and nothing does. It removes the easy ways in — reused passwords, no second factor, secrets in the browser, no backup — which is where almost every real-world account takeover starts.
Download on the App Store
Free for ten passwords, every feature included. One purchase for iPhone, iPad and Mac.
