Most people we help have the same two password habits: one favorite password used nearly everywhere, and a memory that's expected to do the heavy lifting. It's completely understandable — and it's also the single easiest thing for a scammer to take advantage of. The good news is that your Mac, iPhone, and iPad already have everything you need to fix it, and you don't have to memorize a thing.
Why one password everywhere is the risk
When a company gets hacked, the stolen email-and-password lists end up for sale. Criminals then quietly try that same combination on other sites — your email, your bank, your Apple Account. If you've reused the password, one break-in becomes many. Using a different password for every site means a leak stays contained to that one site.
Let your devices do the remembering
Apple has a built-in password manager (in Passwords on recent versions of iPhone, iPad, and Mac — older versions call it Settings → Passwords or System Settings → Passwords). It stores your logins, syncs them across your devices through iCloud, and fills them in for you with Face ID or Touch ID.
- Open the Passwords app (or Settings → Passwords) and unlock it with Face ID, Touch ID, or your passcode.
- Look for the Security section — it flags any passwords that are reused, weak, or known to have appeared in a leak.
- Work through that list a few at a time. Tap a flagged account, choose Change Password on Website, and when the site asks for a new one, let Apple suggest a strong password and save it.
- Start with the accounts that matter most: your email, your Apple Account, your bank, and anything with a card saved.
You don't need to do all of them today. Your email account first — that's the one that can reset all the others.
Turn on two-factor authentication
Two-factor authentication means that even if someone has your password, they still can't get in without a code from your device. It's the strongest protection available to you, and on most accounts it's a single switch to turn on.
- Your Apple Account — open Settings, tap your name at the top, then Sign-In & Security. If two-factor isn't already on, turn it on here. (On most accounts it's on by default now — worth confirming.)
- Your email, bank, and anything financial — look in the account's security or sign-in settings for "two-factor," "two-step," or "verification code."
- Prefer an app or a prompt over text messages where a site offers the choice. Text codes are far better than nothing, but they can be intercepted.
A word about passkeys
You may start seeing sites offer a passkey instead of a password. It's worth saying yes. A passkey lets you sign in with Face ID or Touch ID, there's nothing to type, nothing to remember, and nothing for a scammer to trick out of you. Your devices sync them for you.
Three rules that cover almost everything
- Never reuse the password for your email account anywhere else.
- Nobody legitimate will ever call, text, or email asking you to read them a verification code. That's a scam, every single time.
- If you're not certain a login page is real, don't sign in from the link — go to the site or app yourself and sign in there.