Personal data sells well on criminal markets. With automated password-guessing, AI-written phishing and data breaches exposing huge numbers of records every year, staying safe online can feel like a losing battle.
You don't need to go offline or become a security expert, though. A handful of habits and tools cuts your risk a lot.
Most attackers go for the easiest targets. Covering the basics below puts you ahead of most people, and opportunistic attackers and bots will usually move on.
1. Minimize the Personal Information You Share
Every piece of personal data you publish online—your hometown, pet's name, birthdate, or graduation year—can be harvested by social engineers or used to guess security questions. Share as little as you can: skip optional profile fields, and avoid social media quizzes that ask about your first pet or your childhood street.
2. Use Long, Unique Passwords with a Dedicated Password Manager
Reused passwords are one of the most common ways accounts get taken over. When a fitness app or small forum is breached, attackers try the leaked email and password on banking, email and shopping sites.
Use a reputable password manager (such as Bitwarden, 1Password or KeePassXC) to create a random password of 16 or more characters for every site. You only have to remember one strong master passphrase.
3. Turn On Two-Factor Authentication (2FA) and Passkeys
Two-factor authentication protects an account even if your password leaks. Some methods are stronger than others:
- Avoid SMS 2FA when possible: SMS text messages are vulnerable to SIM swapping attacks and mobile network interception.
- Use Authenticator Apps (TOTP): Apps like Aegis, 2FAS, or Google Authenticator generate time-based codes locally on your device.
- Adopt FIDO2 Hardware Keys & Passkeys: Hardware security keys (such as YubiKeys) and passkeys only work on the real site, so a phishing page can't capture them.
4. Use Disposable Email for Non-Essential Signups
One of the easiest ways to protect yourself is to keep your real email away from sites you don't trust or won't use again. As explained in our article on why companies want your email address, your inbox is used as a universal tracking key across advertising networks.
When registering for whitepapers, test accounts, public forums, or short-term trials, use a throwaway address from TempoEmails. You get the verification code or download link, and the spam and leaks that follow go to an address you've abandoned.
5. Use Encrypted DNS, and a VPN on Untrusted Networks
Your internet provider can see every unencrypted DNS lookup you make, which shows which sites you visit. Turn on DNS-over-HTTPS (DoH) or DNS-over-TLS (DoT) with a resolver such as Cloudflare (1.1.1.1) or Quad9 (9.9.9.9). Away from home, a VPN from a provider that has been independently audited adds another layer.
6. Audit Social Media Privacy Settings & Restrict Visibility
Social media platforms change their defaults often, sometimes opting you into new tracking or AI-training features. Periodically review your settings on platforms like Facebook, Instagram, LinkedIn, and X:
- Set personal profiles to private so only confirmed connections can view your posts and friend lists.
- Disable search engine indexing of your social profiles.
- Turn off location tagging on photos and posts.
7. Regularly Monitor Data Breach Notification Services
Even if you do everything right, a company you used years ago can be breached. Check Have I Been Pwned to see whether your email or phone number appears in known leaks. If it does, change the password on that service and sign out of other sessions.
8. Be Careful on Public Wi-Fi
Open Wi-Fi in cafes, airports and hotels is easy to abuse. Someone on the same network can set up a fake hotspot with the same name or intercept unencrypted traffic. Use a VPN on public networks and turn off auto-connect on your phone.
9. Review and Revoke Unnecessary App & Browser Permissions
Apps and browser extensions often ask for more access than they need, like a flashlight app that wants your contacts. Every few months, check your phone and browser:
- Revoke background location access and camera/microphone permissions for apps that don't need them.
- Delete outdated browser extensions; compromised extensions are a frequent vector for session token hijacking.
- Remove third-party "Sign in with Google/Apple" authorizations for apps you no longer use.
10. Keep Everything Updated
Updates fix security holes that attackers are already using. Enable automatic updates on your mobile operating systems (iOS / Android), computer operating systems (macOS, Windows, Linux), browsers, and home Wi-Fi routers.
Next Steps
Protecting your identity is an ongoing habit. Once you have strong passwords and two-factor authentication in place, organizing your accounts helps you keep it that way. Read our guide on best practices for managing multiple online accounts or learn how modern data privacy regulations protect your rights.