How to Delete an Old Account You Cannot Log Into
You do not need to sign in to get an account deleted. The data-protection route works without access, and here is how to use it properly.
7 min read
Passwords, Two-Factor Codes and Account Recovery
Two-factor authentication is the single most effective thing you can turn on, and also the most common way people lock themselves out of their own accounts permanently. The difference between those two outcomes is entirely about what you set up before anything goes wrong. These guides cover the setup that survives a lost phone, the recovery routes that still work when it is already too late, and how to tell which of your accounts is the one holding all the others up.
Accounts guides(14)
What an SSH Key Is and When You Actually Need One
SSH keys replace a password with a key pair your computer holds. What they do, why your host asked for one, and why most people never need to make one.
7 min read
How to Change Every Important Password in the Right Order
Changing passwords in the wrong order locks you out halfway through. The sequence that works, starting with the account that controls all the others.
8 min read
Where to Store Your Recovery Codes Safely
Recovery codes are the only guaranteed way back into a locked account. Here is where to keep them, and why the obvious places all fail at the moment you need them.
7 min read
How to Safely Share a Password With Family
Texting a password puts it in two message histories and two cloud backups forever. The better routes, and which accounts you should never share at all.
7 min read
How to See Every Device Signed Into Your Account
Find the device list on Google, Apple and Microsoft, work out which entries are genuinely suspicious, and revoke the access a password change leaves behind.
8 min read
What Passkeys Are and Whether to Switch
Passkeys replace the password with a key your device holds and a site cannot leak. Here is the mechanism, the lock-out risk, and how to keep a way back in.
8 min read
How to Create Passwords You Can Actually Remember
Length beats symbols, and the substitutions you were taught add almost nothing. The passphrase method, plus what to do when the rules forbid it.
7 min read
Password Manager vs Saving Passwords in Your Browser
Browser password saving is better than people claim and worse than a dedicated manager in four specific ways. Here is which of those actually affect you.
7 min read
How to Recover Your Account Without the Authenticator App
The supported recovery routes for Google, Apple and Microsoft, what each one asks for, and how to tell quickly when an account is genuinely gone.
9 min read
Authenticator App vs SMS Codes: Which to Use
SMS codes are the one second factor attackers defeat routinely. Here is the mechanism, what you give up by switching, and when SMS is still the right call.
7 min read
What Happens If You Lose the Phone With Your 2FA Codes
Which accounts you get back depends entirely on what you set up before the phone disappeared. Here is what still works, and what to do today.
8 min read
How to Use Google Authenticator Without Losing Access
Set up Google Authenticator properly, understand what cloud sync does and does not cover, and move your codes to a new phone without being locked out.
8 min read
What Two-Factor Authentication Is and Which Type Is Safest
The four kinds of second factor, ranked by how easily each one is defeated, and the setup step that decides whether you ever get locked out.
8 min read
Topics in Accounts
Accounts questions
Which type of two-factor authentication is safest?
A hardware key or passkey, then an authenticator app, then SMS last. SMS codes can be intercepted by taking over your phone number, which is why it is the only form attackers routinely defeat at scale.
What happens to my codes if I lose my phone?
That depends entirely on whether you saved the recovery codes or enabled cloud backup when you set the app up. Without either, each account has to be recovered individually through its own support process, which can take weeks.
Are password managers safe?
Yes, and considerably safer than the alternative of reusing passwords. The vault is encrypted with a key derived from your master password, which the provider never receives, so a breach of their servers does not expose your passwords.