In short. Your email unlocks almost every other account: that is where password resets go. So it deserves better protection than anything else. The essentials: a long, unique password, a second factor (ideally a security key or a passkey), and caution with emails that ask you to sign in through a link.
Six steps that protect your email
1. A long, unique password
Length matters more than complexity. NIST requires services to accept passwords of at least 15 characters when a password is an account’s only protection, and forbids them from forcing mixes of letters, digits and symbols [1]. An easy way to make one: three random words [2]. Your email password should not repeat the password of any other service. A password manager makes this easy.
2. A second factor
Even if your password leaks, a second factor keeps an attacker out [3]. From weaker to stronger:
- an SMS code: better than nothing, but NIST classes verification over the phone network as restricted [1];
- a code from an authenticator app: does not depend on your mobile carrier;
- a security key or passkey: the strongest option, because it cannot be entered on a fake site.
3. Recovery methods
Keep your backup codes or recovery phrase somewhere safe, ideally not on the same device. Check that your recovery address and phone number, if you set them, are still yours.
4. Breach checks
Check your address on Have I Been Pwned: it shows which known breaches it appeared in [4]. Check the address only: there is no need to type your password into checking sites. If your email password was the same as one for a breached service, change it.
5. Caution with emails
Many email account takeovers start with a message asking you to “confirm your sign-in” or “verify your account” through a link. Don’t enter your password through links in emails: open your mail yourself, from a bookmark or the app. How to recognize such messages is covered in How to spot a phishing email.
6. Updates
Keep your system, browser and email app up to date: updates close the holes used to steal passwords and sessions [5].
Signs your email has been hacked
- you get sign-in alerts for sign-ins you did not make;
- your sent folder has messages you did not write, or friends ask about strange emails from you;
- messages disappear, or filters and forwarding you never set up appear;
- your recovery address, phone number or password has changed.
If your email has been hacked
Go step by step [5]:
- Get back in. If you cannot sign in, use your email provider’s account recovery.
- Change the password to a new, long, unique one. Do it from a device you trust.
- Sign out of every device and session still signed in to the account.
- Turn on a second factor if you did not have one.
- Check your settings: filters, forwarding rules, recovery address, phone number, signature. Attackers often set up hidden forwarding so they keep receiving your mail after a password change [5].
- Change passwords on other services that used the same password or sign in through this email.
- Warn your contacts: scam messages may have been sent from your address.
- Check your bank and shopping accounts for activity you don’t recognize.
Sources
- NIST SP 800-63B, revision 4 (2025): Authentication and Authenticator Management. https://pages.nist.gov/800-63-4/sp800-63b.html
- NCSC (UK): Three random words. https://www.ncsc.gov.uk/collection/top-tips-for-staying-secure-online/three-random-words
- CISA: Turn On MFA. https://www.cisa.gov/secure-our-world/turn-mfa
- Have I Been Pwned. https://haveibeenpwned.com/
- NCSC (UK): Recovering a hacked account. https://www.ncsc.gov.uk/guidance/recovering-a-hacked-account