Email Security Basics

Most email compromises come down to a handful of avoidable habits. These basics apply no matter which email provider you use.

Use a strong, unique password

Reusing a password across multiple sites means one breach elsewhere can expose your email too. Use a password manager to generate and store a long, unique password for your email account specifically — it’s the single highest-impact security habit available.

Turn on two-factor authentication

Two-factor authentication (sometimes called two-step verification) requires a second code, usually sent to your phone or generated by an app, in addition to your password. Nearly every major provider offers this option in account security settings, and it should be one of the first things you enable on any email account.

Recognize phishing attempts

Phishing emails try to trick you into entering your password on a fake login page. Warning signs include urgent language (“your account will be suspended”), links that don’t match the real provider’s domain when you hover over them, and requests to “verify” your password by clicking a link rather than going to the site directly.

Keep recovery information current

Make sure your backup email address and phone number are up to date in your account settings. If you ever get locked out or need to recover a hacked account, outdated recovery information is one of the most common reasons people struggle to regain access.

Be careful on public Wi-Fi

Avoid logging into email on unsecured public Wi-Fi networks when possible, and never do so on a shared or public computer without logging out afterward and clearing saved passwords.