Your Digital Footprint: Stay Safe Online

Why a password alone may not be enough

A stolen password can expose more than one service when it is reused. Two-factor authentication (2FA) adds proof from a different type of factor, such as a device you control. It reduces reliance on the password, but recovery settings and the way you respond to prompts still matter.

Recovery methods are spare keys

Recovery options help prove ownership when your usual sign-in method is unavailable. They deserve the same care as your main login. Account recovery restores access to a service, while a file backup helps recover its contents.

• A recovery email is another inbox you can still access if your main account is locked.
• A recovery phone number needs to stay current when you change numbers or providers.
• A backup code is an emergency credential. Availability, length and use vary by service.
• Keep a recovery route independent of the phone or account it is intended to recover.
• Before changing devices, check your fallback options. See the account recovery and safety codes guide.

What are passkeys?

A passkey is a digital sign-in credential linked to a particular service. Your device can authorise its use with a fingerprint, face check or PIN. The website receives cryptographic proof, not your fingerprint or device PIN. Passkeys resist phishing because they are bound to the genuine service.

1. A passkey replaces a typed password for supported sign-ins. It is not a six-digit authenticator code.
2. A synced passkey can be available through a provider on compatible devices.
3. A device-bound passkey remains on one device or security key, so another access route matters.
4. A biometric check authorises use of the passkey locally. The biometric itself is not the passkey.
5. Recovery depends on your provider and setup. Losing a device does not have the same outcome for everyone.

Practical guide: Set up and use passkeys. Choose the route for your device and retain a recovery option.

Password management: make remembering easier, not weaker

A password manager stores credentials in an encrypted vault and can generate a different password for each account. Browser and device managers can be suitable choices. A dedicated manager such as Bitwarden may suit people using several browsers or device types.

• A master password protects access to a vault. It should be long, unique and kept private.
• Autofill supplies saved credentials to matching sites or apps, reducing the need to copy them.
• A Bitwarden two-step recovery code disables its second-step requirement. It does not replace a forgotten master password.
• For vault creation, protection and everyday use, follow the Bitwarden step-by-step guide.

Before you clear cookies

Clearing cookies can sign you out and remove preferences. History, cached files and saved passwords are separate categories. The cookies and browser cleanup guide explains the practical choices for different devices.

Windows protection and Mac encryption

Windows Security brings together built-in security controls. On a Mac, FileVault protects access to stored data through disk encryption. Encryption helps protect confidentiality if a device is lost, but cannot replace a backup. For Apple computers, see the Mac security and care guide.

Browser extensions: less is safer

Extensions can read or change what you see in your browser. Install only extensions you genuinely need, from the official browser store, made by a recognisable publisher. Review and remove old extensions regularly. Never install an extension because a pop-up claims it will “fix” a problem.

Simple example: one ordinary afternoon online

The result: each action can add to your footprint. This does not mean every action is bad. It means it is worth being deliberate.

Create a positive footprint too

Your footprint can help you. A professional profile, helpful work, qualifications, respectful comments and accurate contact details can support jobs, education and business opportunities.

• Use a professional email address for applications and work.
• Keep LinkedIn and professional profiles accurate and up to date.
• Ask permission before posting photographs of other people.
• Do not forward embarrassing content about someone else.

How fake web addresses fool people

A web address contains a host name and may include a path to a particular page. A brand name can appear in a misleading subdomain or path. Compare the actual domain with the organisation’s known address. HTTPS protects the connection, not the honesty of its owner.

Simple rule: read the address from right to left. In the second example, the site belongs to secure-check.example, not PayPal. The examples above are shown for learning only and should not be visited.

Account security and privacy work together

1. Sign-in protection: a unique password, supported passkey or additional verification helps restrict access. Available methods differ between platforms.
2. Recovery: current contact details and supported backup options help if your normal sign-in method becomes unavailable.
3. Active sessions and connected apps: these show devices and services with access. An old browser or unused app may still be connected.
4. Audience and message controls: govern who can view posts, tag you or contact you. A private audience can still copy what you share.
5. Location and contacts: sharing settings can reveal your whereabouts or address book. Allow only what fits your intended use.

What banking protections do

• App locks: add an access check when someone can already use your phone.
• Transaction alerts: help you notice activity. They do not prevent every unauthorised payment.
• Approval prompts: may authorise a sign-in, new payee or payment. The action described matters.
• Independent verification: helps detect impersonation before you approve a request.
• Payment records: help you report a problem. Follow the banking app security guide for practical protection.