Skip to main content

    How to Keep Your Email Account Safe

    Your email account is the key to all your other accounts. Here's how to lock it down with a strong password, two-factor authentication, and smart habits.

    3 min read · 5 steps · Checked April 2026

    1. Step 1. Use a strong, unique email password

      Your email password should be different from every other password you use, and strong: at least 12 characters, mixing uppercase and lowercase letters, numbers, and symbols. Don't use your name, birthday, or any word from the dictionary. If your password is weak, change it today. Gmail: Google Account > Security > Password. Outlook: account.microsoft.com > Security.

    2. Step 2. Turn on two-step verification

      Two-step verification (also called 2FA) means logging in requires both your password AND a code from your phone. Even if someone steals your password, they can't access your email without the code. For Gmail: Google Account > Security > 2-Step Verification > Get Started. For Outlook: account.microsoft.com > Security > Advanced security > Two-step verification.

      Quick Tip

      Quick Tip: Choose the authenticator app method over SMS for better security — see our guide "How to Use Google Authenticator" for setup instructions.

    3. Step 3. Add a recovery phone and email

      Make sure your email account has your current phone number and a secondary email address as recovery options. This lets you regain access if you're ever locked out. Gmail: Google Account > Security > Ways we can verify it's you. Outlook: account.microsoft.com > Security > Update your security info.

    4. Step 4. Learn to recognize phishing emails

      Phishing emails look like they're from your bank, Amazon, PayPal, or another trusted sender, but they're actually designed to steal your login. Warning signs: urgent language ("Your account will be closed!"), requests to click a link and enter your password, email addresses that look slightly wrong (bank@amazon.support.xyz instead of @amazon.com). When in doubt, go directly to the website by typing the address — never follow a link from a suspicious email.

    5. Step 5. Review what apps have access to your email

      Third-party apps sometimes request access to your email (a travel app that reads your confirmations, for example). Periodically review and revoke access for apps you no longer use. Gmail: Google Account > Security > Third-party apps with account access. Remove anything unfamiliar or apps you no longer use.

      Warning

      If you believe your email was hacked: right away change your password, sign out all other sessions (Gmail: Security > Your devices > Sign out all other sessions), change passwords on your bank and other important sites, and notify your bank.

    Your email account deserves extra protection because it's the master key to everything else. When you forget a password to any website — Netflix, your bank, Amazon, social media — where does the reset link go? To your email. If a hacker gets into your email, they can use it to reset the passwords to every other account you have.

    Despite this, many people use weak email passwords and haven't turned on any extra security. This guide covers the most important steps to lock down your email — these apply to Gmail, Outlook/Hotmail, Yahoo, and any other provider.

    Official sources

    Still stuck?

    A real person can walk you through it over the phone.

    Get help from a person

    Related guides