Recommended Free Tools
If a service says your password was exposed, change it promptly on that service and anywhere else you reused or closely copied it. Then secure your email and other important accounts with unique passwords and the strongest multifactor authentication (MFA) they support. A breach notice alone does not mean your device is infected or that every account you own was accessed; the right next steps depend on what information was exposed and whether you see signs of account takeover.
What should you do first after a data breach?
- Read the notice carefully. Identify which service was affected, what information it says was exposed, and whether it recommends specific action. A notification does not establish that all your accounts were accessed.
- Change the exposed password. Sign in through the service’s official website or app and replace the password with a unique one. The FTC advises changing it right away if a company says it lost your password in a breach: FTC password guidance.
- Change reused or similar passwords elsewhere. Update each account where you used the same password or a close variation. An unrelated account does not need a password change solely because another company reported a breach, unless that account shows suspicious activity.
- Secure your email and other high-impact accounts. Your inbox can receive password-reset links, so someone who controls it may be able to reset access to other services. Start with email, then consider banking, credit-card, social-media, tax-filing, and payment accounts. The FTC recommends enabling MFA on these kinds of accounts: FTC MFA guidance.
- Review recovery settings. Check that the recovery email and phone number on important accounts are yours and that you can access them. If a service offers recovery codes or a recovery contact, set them up or store the codes as the provider instructs.
A password manager is optional, but it can help create and keep track of distinct, complex passwords rather than reusing one. The FTC suggests considering one in its data-breach guidance.
As an Amazon Associate I earn from qualifying purchases.
Which MFA method should you choose?
MFA asks for another proof of identity in addition to your password. Use the strongest method the account supports, while considering whether you can keep a backup and how you would recover access if you lose the device or key. The FTC’s general guidance prefers authenticator apps or security keys over text or email codes when available, and describes a security key as the strongest common two-factor method it discusses. Availability and compatibility depend on the service and your device.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match| Method | What to know |
|---|---|
| Security key | A physical second factor; the FTC identifies it as the strongest common method in its guidance. Use only if the account supports it, and check device compatibility and the provider’s backup and recovery options. |
| Authenticator app | The FTC recommends choosing an authenticator app over text or email codes when the service offers it. Check how the provider handles a lost or replaced phone and configure an available backup method. |
| Text or email code | These can add a second step when stronger options are unavailable. The FTC advises preferring an authenticator app or security key if the service supports one. |
For account-specific setup and recovery instructions, use the affected service’s official help pages; the supported methods are not identical across services.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What if you reused the breached password?
Change it anywhere it was reused, including accounts where you made only a small variation. Give each account its own password. Prioritize email and other accounts that can expose sensitive information or help reset access elsewhere. Do not assume that every account was accessed, but check for unfamiliar sign-ins or changes to account settings and act if you find them.
How do you secure an email account after a breach?
Change the email password if it was exposed or reused, then enable the strongest MFA the provider offers. Confirm that recovery details belong to you. If you suspect someone has already accessed the inbox, look for forwarding rules you did not create, unfamiliar messages in sent or deleted folders, and other changes you do not recognize. If suspicious messages were sent from your account, alert the people who received them.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
What if you are locked out or the account was taken over?
Use the provider’s official account-recovery process rather than links or phone numbers in an unexpected message. Providers may offer different recovery routes; not every service supports every method. NIST’s SP 800-63B-4 (July 2025) describes recovery methods such as identity proofing again, a prearranged recovery contact, recovery codes, or an authenticator still linked to the account. It also notes that recovery can take longer than routine sign-in and that a recovery event generates subscriber notifications. These are standards-level descriptions, not a guarantee about a particular service’s process.
Free tools Windows power users keep installed
One-click scans. No signup required.
After you regain access, take these steps:
- Change the password to a unique one.
- Sign out of other devices or sessions using the provider’s account controls.
- Turn on MFA and verify your recovery email and phone number.
- Inspect forwarding rules, sent and deleted folders, and other account settings for changes you do not recognize.
- Tell contacts if the account sent suspicious messages.
The FTC also advises updating computer security software and running a scan as part of hacked-account recovery. That advice is relevant if you suspect device compromise; a breach notification by itself does not show that your device is infected. See the FTC hacked-account recovery guidance.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
What should you do if personal information—not just a password—was exposed?
Follow the breach notice’s advice for the specific information involved. If your personal information is being used, the FTC directs consumers to IdentityTheft.gov for help. The appropriate response depends on what was exposed and what is happening; no single extra measure applies to every breach.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How should you handle security questions and recovery codes?
If a service requires security-question answers, choose answers that only you can provide and that are not easy to guess or find online or in public records. Treat each answer like a password: make it unique rather than reusing a personal fact from elsewhere. Store recovery codes securely and follow the provider’s instructions for using them; they can be important if you lose access to your usual second factor.
Quick Recap
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitches
