# The only 5 security habits you really need

> Passwords, two-factor authentication, updates, backups, and skepticism – the checklist that covers most risks.

*Source: https://velstech.net/security-habits · Updated: 2026-08-24 · Category: Security & Privacy · Tags: Basics, Passwords*

*Markdown version of [The only 5 security habits you really need](https://velstech.net/security-habits). [Read the full guide with interactive tools](https://velstech.net/security-habits).*
*Also as Markdown: [Hindi](https://velstech.net/security-habits.hi.md) · [Tamil](https://velstech.net/security-habits.ta.md).*

---

Security advice is overwhelming – most of it isn't for you. The truth is that five
simple habits stop the overwhelming majority of real-world attacks. Master these and
you'll be safer than most people on the internet.

## 1. Use a password manager

This single habit does more than everything else combined. A password manager
generates and stores a **unique, random password for every site**, so
you only ever need to remember one master password.

- Why it matters: the #1 way accounts get hacked is credential stuffing – attackers take a password leaked from one site and try it everywhere. Reused passwords are the vulnerability.

- Tools: Bitwarden (free, open-source), 1Password (paid), KeePassXC (free, offline).

- The habit: every new account gets a generated password. Every old account gets one too, starting with email and banking.

> Start with the most important accounts: your email (the master key to
> everything) and your bank. Fixing those two first gives you the
> biggest win.

## 2. Turn on two-factor authentication

A password is one thing an attacker must have. **2FA** adds a second:
a code, an authenticator app, or a hardware key. Even if your password leaks, the
account stays locked.

- Priority: email, bank, social media, GitHub, and your password manager itself.

- Best method: an authenticator app (Google Authenticator, Aegis, 2FAS) or a hardware key (YubiKey).

- Avoid: SMS codes where possible – SIM-swapping attacks can intercept them. App-based is strictly better.

When you set it up, save the **recovery codes** somewhere safe. They're
your backup if you lose your phone.

## 3. Update everything, regularly

Most successful attacks don't break fancy security – they exploit **known
vulnerabilities** that were already patched. Updates close those doors.

- Enable automatic updates for your OS and browser. These two matter most.

- Don't ignore app updates – especially browsers, phone apps, and anything that touches the internet.

- Reboot occasionally – updates often finish applying on restart.

The "updates are annoying" tax is tiny. The "I got hacked because I skipped updates"
tax is enormous. It's the cheapest insurance you'll ever buy.

## 4. Back up what you can't lose

Ransomware, a dead drive, a stolen laptop – these don't care about your security
habits. **Backups** turn a disaster into an inconvenience.

Follow the **3-2-1 rule**:

- 3 copies of your important data,

- on 2 different types of media (internal + external, say),

- with 1 copy off-site (cloud or a friend's house).

Back up your documents, photos, and settings – not your operating system. Use
whatever works: Time Machine, `rsync`, a cloud drive, or a dedicated tool
like Borg/Restic. The best backup is the one you actually run.

## 5. Practice healthy skepticism

The weakest link in every security setup is a human moment of trust. The attacks
that work today aren't technical – they're **social**.

- Urgency is the red flag. "Your account is compromised, act now!" – take a breath and verify separately.

- Verify the sender. A fake email from "PayPal" is one character away from the real address. Check, don't click.

- Never install something "to fix a problem" someone messages you about. Scammers love remote-access tools.

- Hover before you click – the visible link text may not match the real URL.

- If a deal is too good to be true, it's a phishing hook.

## What you can skip

For the record, things that get way too much attention: fancy VPNs for "security"
(they're for privacy – fine, but not the priority), changing passwords every month
(a strong unique password beats a changed weak one), and panic about "hackers" in
general. The five habits above are the actual defense.

## The priority order

```
Do FIRST, this week:
  1. Password manager on your email + bank
  2. 2FA on email, bank, password manager

Do NEXT, this month:
  3. Turn on automatic updates everywhere
  4. Set up your first backup (even a simple one)

Keep forever:
  5. Skepticism – slow down before you trust
```

Do these five and you've handled the vast majority of realistic threats. Security
isn't about gadgets – it's about a handful of habits that take minutes to set up and
save you everything.

🔑 Try the VelsTech JWT Decoder

Ever wondered what's actually inside that token in your login request? Decode and inspect it locally in seconds.

[Open tool →](https://velstech.net/jwt-decoder)

## FAQ

**What is the single most effective security habit?**

Use a password manager with unique passwords for every account, and turn on two-factor authentication everywhere it's available. That covers most real-world attacks.

**Is two-factor authentication really necessary?**

Yes. Even if a password leaks, a second factor like an authenticator app or security key stops most account takeovers cold.

---

*VelsTech – technology explained for everyone. Original: https://velstech.net/security-habits*