The only 5 security habits you really need

Security advice is overwhelming — most of it isn't for you. The truth is that five simple habits stop the overwhelming majority of real-world attacks. Master these and you'll be safer than most people on the internet.

1. Use a password manager

This single habit does more than everything else combined. A password manager generates and stores a unique, random password for every site, so you only ever need to remember one master password.

• Why it matters: the #1 way accounts get hacked is credential stuffing — attackers take a password leaked from one site and try it everywhere. Reused passwords are the vulnerability.
• Tools: Bitwarden (free, open-source), 1Password (paid), KeePassXC (free, offline).
• The habit: every new account gets a generated password. Every old account gets one too, starting with email and banking.

Start with the most important accounts: your email (the master key to everything) and your bank. Fixing those two first gives you the biggest win.

2. Turn on two-factor authentication

A password is one thing an attacker must have. 2FA adds a second: a code, an authenticator app, or a hardware key. Even if your password leaks, the account stays locked.

• Priority: email, bank, social media, GitHub, and your password manager itself.
• Best method: an authenticator app (Google Authenticator, Aegis, 2FAS) or a hardware key (YubiKey).
• Avoid: SMS codes where possible — SIM-swapping attacks can intercept them. App-based is strictly better.

When you set it up, save the recovery codes somewhere safe. They're your backup if you lose your phone.

3. Update everything, regularly

Most successful attacks don't break fancy security — they exploit known vulnerabilities that were already patched. Updates close those doors.

• Enable automatic updates for your OS and browser. These two matter most.
• Don't ignore app updates — especially browsers, phone apps, and anything that touches the internet.
• Reboot occasionally — updates often finish applying on restart.

The "updates are annoying" tax is tiny. The "I got hacked because I skipped updates" tax is enormous. It's the cheapest insurance you'll ever buy.

4. Back up what you can't lose

Ransomware, a dead drive, a stolen laptop — these don't care about your security habits. Backups turn a disaster into an inconvenience.

Follow the 3-2-1 rule:

• 3 copies of your important data,
• on 2 different types of media (internal + external, say),
• with 1 copy off-site (cloud or a friend's house).

Back up your documents, photos, and settings — not your operating system. Use whatever works: Time Machine, rsync, a cloud drive, or a dedicated tool like Borg/Restic. The best backup is the one you actually run.

5. Practice healthy skepticism

The weakest link in every security setup is a human moment of trust. The attacks that work today aren't technical — they're social.

• Urgency is the red flag. "Your account is compromised, act now!" — take a breath and verify separately.
• Verify the sender. A fake email from "PayPal" is one character away from the real address. Check, don't click.
• Never install something "to fix a problem" someone messages you about. Scammers love remote-access tools.
• Hover before you click — the visible link text may not match the real URL.
• If a deal is too good to be true, it's a phishing hook.

What you can skip

For the record, things that get way too much attention: fancy VPNs for "security" (they're for privacy — fine, but not the priority), changing passwords every month (a strong unique password beats a changed weak one), and panic about "hackers" in general. The five habits above are the actual defense.

The priority order

Do FIRST, this week:
  1. Password manager on your email + bank
  2. 2FA on email, bank, password manager

Do NEXT, this month:
  3. Turn on automatic updates everywhere
  4. Set up your first backup (even a simple one)

Keep forever:
  5. Skepticism — slow down before you trust

Do these five and you've handled the vast majority of realistic threats. Security isn't about gadgets — it's about a handful of habits that take minutes to set up and save you everything.