The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Change the exposed password immediately on the service’s official website or app, make the replacement unique, and change every other account that uses the same or a similar password. Then enable multi-factor authentication (MFA), review active sessions and account settings for changes you did not make, and use only the provider’s official recovery process if you are locked out.
Do not trust an unexpected warning email’s links. Open the service yourself and verify the alert there. For Google-saved passwords, Google’s Password Checkup instructions explain how to confirm unsafe credentials.
What should I do first?
Work in this order: confirm the warning, replace the password, contain reuse, add MFA, and inspect the account. Speed matters because a stolen password can be tried against other services, but an alert alone does not prove that someone signed in. Treat it as a reason to secure the account and investigate.
- Verify the alert through the service itself. Do not click a surprising password-warning link. Type the provider’s address yourself, open its app, or use a known bookmark. Check the security or password area there. Google recommends going directly to Password Checkup to verify warnings about saved passwords.
- Change the affected password now. Use the official site or app, not a link in an unsolicited message. Create a long, difficult-to-guess password that has never been used on another account.
- Change reused or similar passwords elsewhere. “Similar” includes a predictable variation such as adding a number, changing one character, or appending a year. The Federal Trade Commission (FTC) says, “If you reused the same password, or a similar one, on other services, change it there, too.” Read the FTC’s password guidance for its consumer checklist.
- Turn on MFA. Add a second factor immediately after setting the new password wherever the service supports it.
- Review access and settings. Sign out other devices, inspect recent activity, and verify recovery details, forwarding rules, and other security settings.
If the account controls your email, phone number, password manager, finances, or other recovery channels, secure it before lower-risk accounts. A compromised email account can receive password-reset messages for many other services.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
How to contain password reuse
Password reuse turns one exposed credential into a chain of potential account takeovers. Make an inventory before assuming you have found every copy. Search your password manager, browser-saved passwords, notes, and memory for the old password and close variants.
Prioritize accounts that can unlock others
- Primary email: It commonly receives reset links and security notifications.
- Financial and payment accounts: Check for transactions and newly added payment or payout details after changing the password.
- Mobile-carrier or identity accounts: These can affect recovery codes, phone numbers, and device access.
- Social, shopping, gaming, and streaming accounts: Change reused credentials and check for messages, purchases, profile changes, or unfamiliar devices.
CISA specifically recommends MFA for email, financial, social, online-store, gaming, and streaming accounts in its More than a Password guidance. The recommendation does not mean every service offers the same MFA choices; check each provider’s current security settings.
Use a different password for every account
A replacement is not safer if it is a minor edit of the exposed one. Use a distinct password for each service. A password manager can generate and store unique credentials so you do not have to remember every one; protect the manager itself with a unique master password and MFA if available.
Which MFA method should I choose?
MFA requires more than the password alone. CISA describes it as an additional layer when a password has been compromised and identifies FIDO-based methods as phishing-resistant where supported. Availability depends on the account, device, browser, and region.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
| Method | Phishing resistance | Support and setup | If you lose access |
|---|---|---|---|
| FIDO2 security key or device passkey | Strongest option among the methods listed here; designed to block common phishing attempts. | Requires a compatible service and device. Register the key or passkey in the account’s security settings. | Keep a second registered key or another approved recovery method. A lost, unregistered key can lock you out. |
| Authenticator app code or approval | Better than a password alone, but a code can still be relayed during some phishing attacks. | Usually available on phones; scan a setup code and confirm a generated code or approval. | Save the service’s recovery codes securely and enroll a backup device when allowed. |
| Text message or voice code | Adds a barrier but is less resistant to phishing and phone-number attacks than FIDO or an authenticator app. | Works on services that can send codes to your registered number. | Keep your phone number current and retain the provider’s backup recovery options. |
Choose the strongest method the account and your devices support, then register a backup factor and store recovery codes offline where practical. A physical FIDO2 security key is optional, not a requirement; confirm compatibility before buying one because support varies by service and device.
How to tell whether someone accessed the account
Changing a password stops use of the old credential, but it does not explain what may already have happened. After the change, inspect the account methodically.
End unknown sessions
Open the provider’s “Your devices,” “Where you’re signed in,” or equivalent page. Sign out every device, browser, or location you do not recognize. If the service offers “sign out of all other sessions,” use it, then sign back in only on devices you control.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Check recovery and security details
- Confirm the recovery email address and phone number are yours.
- Remove unfamiliar authenticator devices, passkeys, security keys, or backup codes.
- Check whether the password, username, two-step settings, or security questions changed.
- Review connected apps, third-party access, and forwarding rules.
- Inspect recent sign-in history for unfamiliar times, locations, browsers, or IP information where the provider displays it.
For email and social accounts, look for sent or deleted messages, new automatic replies, changed profile information, and posts you did not create. The FTC’s recovery guidance, How To Recover Your Hacked Email or Social Media Account, recommends checking these areas and warning contacts if messages may have been sent in your name.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Protect people and services connected to the account
If an attacker may have messaged your contacts, tell them through a separate channel not to open links or requests that appear to come from you. If the account is used for business, notify the relevant administrator so they can review logs, revoke sessions, and protect shared resources.
What if I am locked out?
Do not keep guessing passwords; repeated attempts can trigger additional locks and provide no proof of ownership. Start the provider’s account-recovery process from its official website or app. Type the address yourself or use a trusted bookmark rather than a link in a warning message.
- Choose the provider’s “Forgot password,” “Can’t access your account,” or equivalent recovery option.
- Use a recovery email address, phone number, backup code, or previously registered factor that you recognize.
- Follow every identity-verification step and record the case or recovery reference if the provider supplies one.
- After regaining access, set a new unique password, revoke unknown sessions and connected apps, restore your recovery details, and enable MFA.
If the recovery email or phone number was changed, tell the provider that the account may have been compromised and provide the requested ownership information. Never pay a person who contacts you unexpectedly claiming they can restore the account; use only the provider’s published support route.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesWhen should I scan my device for malware?
An exposed password does not by itself prove that your computer or phone is infected. Consider a device scan when you entered the password into a suspicious page, installed an untrusted program, noticed browser redirects, or see other signs of malware.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
For a potentially compromised Microsoft account, Microsoft’s account-recovery instructions tell users to update their protection and run a full scan before changing the password. Follow that sequence when malware is a realistic concern so a malicious program cannot immediately capture the replacement password. The same instructions also direct users to review connected accounts, email forwarding, and automatic replies after recovery.
For other providers, use their own recovery instructions and your device maker’s security tools. Keep the malware advice scoped to a suspected infection; most password exposures result from a breach, phishing, or reuse rather than proof that every device is infected.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to verify that the fix worked
Complete a short verification pass after securing the account:
- Sign in with the new password from a device you control.
- Confirm MFA prompts or security-key/passkey checks appear as expected.
- Verify the recovery email, phone number, and backup methods.
- Confirm unfamiliar sessions and third-party connections are gone.
- Check recent account activity, messages, orders, subscriptions, and payment details for changes you did not make.
- Repeat the password inventory for other services and confirm none still uses the exposed or similar password.
Keep monitoring security notifications for several days. A later alert can indicate another reused credential, a still-active session, or a separate compromise; handle it through the same official channels rather than replying to the alert.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Common mistakes that make the situation worse
Clicking the warning email
Attackers imitate breach notices to steal the new password or MFA code. Verify inside the service first, and never disclose a one-time code to someone who contacted you unexpectedly.
Changing only the exact old password
Attackers try predictable variations. Replace every reused or similar password with a genuinely unique one, not a version with a new year or punctuation mark.
Stopping after the password change
A new password does not remove unknown sessions, forwarding rules, recovery addresses, connected apps, or fraudulent messages. Inspect those settings before considering the account secure.
Relying on one recovery method
A lost phone or security key can leave you locked out. Register an allowed backup factor and store recovery codes safely while you still control the account.
A repeatable response plan
Save this sequence for future alerts: verify the notice in the official app or site; change the exposed password; change all reused or similar passwords; sign out unknown sessions; check recovery details, connected apps, forwarding, and activity; enable the strongest available MFA; scan a device only when malware is plausible; and notify contacts if the account may have acted in your name. This plan addresses both immediate access and the settings an intruder could use to return.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
