OneTaskBy Tim King · Updated
Account Security Checklist
Protect Online Accounts With Two-Factor Login, Passkeys and Recovery Codes
OneTask is free, with no sign-up, and built by one person.
If this tool saved you time, a coffee helps keep new ones coming.
How the Account Security Checklist works
This account security checklist shows what to change to protect an online account, most important first. Choose the type of account and the second factor you use now, and it lists the steps in priority order with a short reason for each, so you can work down the list and tick them off.
How the account security checklist is ordered
Most account takeovers come from reused or phished passwords, weak recovery options and SIM swaps. The checklist puts the fixes for those first. Critical items include a unique password from a password manager and a second factor. If you use SMS codes, moving to an authenticator app or passkey is raised, because text messages can be intercepted or redirected.
High items cover recovery, which attackers target when the front door is locked. Check the recovery email and phone, save backup codes somewhere safe and review signed-in devices and connected apps. Medium items include login alerts and removing old sessions.
Each account type adds its own steps. Email gets forwarding rules and filters, since attackers hide there. Bank accounts get payment alerts and trusted payees. Social media covers admin roles on pages, and developer accounts cover tokens, SSH keys and deploy keys. Choose Any account for the general list.
Account security checklist formula
Actions = 7 core actions + the extra actions for the account type + second-factor actions
The second-factor actions are 2 with no two-factor login (turn it on, then add a passkey), 2 with SMS codes (replace SMS, add a passkey), 1 with an authenticator app (add a passkey) and 0 with a passkey or security key. Email and developer accounts add Critical extras, bank accounts add two, and the other types add one.
Worked example: an email account with no two-factor login
7 core actions, 1 email extra and 2 second-factor actions make 10, with 3 Critical. Start with turning on two-factor login, then check forwarding and filter rules.
Worked example: a developer account with a passkey
7 core actions and 2 developer extras make 9, with 3 Critical. The priorities are rotating access tokens and locking away the root or owner credentials.
Account security reference table
Actions and Critical items for each account type and current second factor.
| Account | Second factor now | Actions | Critical |
|---|---|---|---|
| Any account | None | 9 | 2 |
| Any account | SMS codes | 9 | 1 |
| Any account | Authenticator app | 8 | 1 |
| Any account | Passkey or security key | 7 | 1 |
| None | 10 | 3 | |
| SMS codes | 10 | 2 | |
| Authenticator app | 9 | 2 | |
| Passkey or security key | 8 | 2 | |
| Bank or payments | None | 11 | 2 |
| Bank or payments | SMS codes | 11 | 1 |
| Bank or payments | Authenticator app | 10 | 1 |
| Bank or payments | Passkey or security key | 9 | 1 |
| Social media | None | 10 | 2 |
| Social media | SMS codes | 10 | 1 |
| Social media | Authenticator app | 9 | 1 |
| Social media | Passkey or security key | 8 | 1 |
| Cloud storage | None | 10 | 2 |
| Cloud storage | SMS codes | 10 | 1 |
| Cloud storage | Authenticator app | 9 | 1 |
| Cloud storage | Passkey or security key | 8 | 1 |
| Work account | None | 10 | 2 |
| Work account | SMS codes | 10 | 1 |
| Work account | Authenticator app | 9 | 1 |
| Work account | Passkey or security key | 8 | 1 |
| Developer (GitHub, cloud console) | None | 11 | 4 |
| Developer (GitHub, cloud console) | SMS codes | 11 | 3 |
| Developer (GitHub, cloud console) | Authenticator app | 10 | 3 |
| Developer (GitHub, cloud console) | Passkey or security key | 9 | 3 |
Quick answers
- Two-factor login is the single most useful step for any account.
- SMS codes are better than nothing but can be stolen by SIM swapping.
- A passkey or security key resists phishing.
- Secure your email first, as it resets every other account.
- To see how many actions are left, pick your account and second factor above.
FAQ
Why is email the most important account?
Almost every other account can be reset through your email. Whoever controls the inbox can take over banking, shopping and social accounts, so it deserves the strongest protection you can give it.
Are SMS codes better than nothing?
Yes. They stop most password-only attacks. They are weaker than an app or passkey because a SIM swap or phishing page can capture them, so switch when the service allows it and keep SMS only as a backup.
What is a passkey?
A passkey is a sign-in key stored on your phone, computer or security key, unlocked with your fingerprint, face or PIN. It only works on the real site, so a phishing page cannot capture it.
How often should I review my accounts?
Check your most important accounts, such as email and banking, every few months, and straight away after a breach notice or suspicious login email. Review connected apps and devices at the same time.
See also: all Security & Identifiers tools, Dev Utilities, Formatters & Validators, Data & Encoding, SEO, Accessibility, AI.
Related tools
Password Strength Checker
Estimate a password's entropy, crack time and weak patterns.
Pwned Password Checker
Check a password against breach data without sending the password.
TOTP Generator
Live two-factor codes from a base32 secret, with a countdown.
Backup Code Generator
Random two-factor recovery codes, grouped for easy reading.
Incident Response Checklist
A step-by-step checklist for the security incident you are facing.