Account Security

Use a unique password, enable an additional sign-in factor when available, secure the email account used for recovery, and never share one-time codes. Store recovery details somewhere private and accessible to you.

A strong account setup covers more than the password. Use a password manager or another private method to avoid reusing credentials, and check that the account's recovery email and phone are still yours. If a service offers two-factor authentication, follow its current setup and recovery instructions.

Treat unexpected login alerts, password-reset notices, and requests for codes as signals to verify through the service's official site. A message that uses a familiar logo is not proof that it came from support. Open the known address yourself instead of following an unsolicited link.

If you suspect access by someone else, use the provider's account-security flow to change credentials, revoke sessions or tokens where that option exists, and review recent activity. The exact controls differ by service, so do not assume one account's steps apply to another.

Review these controls

• Unique password not reused elsewhere
• Recovery email and phone are current and protected
• Additional sign-in factor and recovery method reviewed
• Recent sessions and security alerts checked through the official service

Avoid these mistakes

• Never disclose passwords, seed phrases, or one-time codes
• Do not install account-recovery software from unsolicited messages
• Do not assume a security feature exists until it appears in the provider's current settings

Open the account's security settings directly and check recovery access, active sessions, and available sign-in protections.