Blog

  • Password Sharing for Families: How to Do It Safely

    Password Sharing for Families: How to Do It Safely

    Families share a lot of accounts: streaming services, utilities, Wi-Fi, insurance portals, school apps and more. Too often, passwords end up texted, written on sticky notes or reused so everyone can remember them. There are safer ways to share.

    This guide explains how families can share passwords securely, plan for emergencies and set up children’s accounts thoughtfully.

    Why Insecure Sharing Is Risky

    • Texts and chats can be read by anyone with access to the phone or account
    • Notes and spreadsheets can be lost or seen by visitors
    • Reusing a simple “family password” across accounts means one breach exposes many
    • Changing a shared password becomes hard when nobody knows where it is used

    Shared Vaults in Password Managers

    Many password managers offer family plans with shared folders or vaults. You choose which logins to share and with whom. When you update a password, everyone with access gets the new one automatically. See the password manager guide.

    Tips for Shared Vaults

    • Create shared folders by purpose, such as “Household” or “Streaming”
    • Keep personal accounts private
    • Review who has access periodically
    • Remove access when someone moves out or a relationship changes

    Accounts Families Often Share

    Account type Sharing approach
    Streaming Use family or profile features, follow service terms
    Wi-Fi Use a guest network for visitors. See home Wi-Fi security.
    Utilities and insurance Shared vault entry
    School portals Each parent’s own login if possible
    Banking Separate logins or official joint access features

    Where a service supports separate user accounts or authorized users, use those instead of sharing one login. That way, each person has their own credentials and activity can be tracked.

    Emergency Access

    If you were unavailable, could someone you trust reach important accounts? Many password managers offer emergency access features that let a designated person request access after a waiting period. Alternatively, store instructions and recovery codes in a secure place known to a trusted person. Consider including digital accounts in estate planning discussions with appropriate professionals.

    Kids’ Accounts

    • Use family features on phone platforms to manage children’s accounts
    • Teach kids to use passphrases. See strong passphrases.
    • Explain why they should not share passwords with friends
    • Turn on two-factor authentication for teens’ important accounts
    • Talk about phishing and scams. See phishing red flags.

    When Relationships Change

    When a household changes, review shared vaults, change passwords on shared accounts, remove devices from accounts and check recovery email addresses and phone numbers.

    Two-Factor Authentication with Shared Accounts

    Shared accounts with two-factor authentication can be tricky if codes go to one person’s phone. Some password managers can store authenticator codes in the shared entry, or the account owner can manage codes. Decide what works for your household. See two-factor authentication setup.

    Common Mistakes

    • Texting passwords
    • Using one password for every family account
    • Forgetting to remove access after changes
    • Having no emergency plan

    A Note on Older Relatives

    Helping older parents manage accounts is common. Rather than knowing their passwords, consider a shared vault where they share specific logins with you, or official features such as trusted contacts and authorized users at banks. This respects their independence while letting you help. Talk openly about scams, since older adults are frequent targets.

    A Note on Recovery Contacts

    Some services let you add a recovery contact who can help you regain access if you are locked out. Choose people you trust and keep the list current. Recovery contacts usually cannot see your data, only help verify your identity.

    Comparison Table

    Sharing method Security Convenience
    Texting passwords Low High
    Written notes Low to moderate Moderate
    Shared vault High High
    Separate accounts High Varies

    Questions to Ask as a Family

    • Which accounts do we all need?
    • Who manages each account?
    • How would we reach accounts in an emergency?
    • How will we handle changes when someone leaves?

    Starting Small

    Move your three most-shared logins, such as Wi-Fi, streaming and utilities, into a shared vault this week.

    A Note on Shared Devices at Home

    A family computer or tablet used by several people should have separate user profiles where possible. Avoid saving personal passwords in a shared browser profile. Lock the device when not in use, and teach kids to sign out of accounts on shared devices.

    Final Family Checklist

    • Shared vault created
    • Household logins moved in
    • Personal logins kept private
    • Emergency access set up
    • Kids’ accounts reviewed
    • Access reviewed after changes

    A Note on Digital Legacy Planning

    Some platforms offer legacy contact or inactive account features that let you decide what happens to an account if you pass away or stop using it. Setting these up, along with a password manager emergency access plan, makes things much easier for family. Store any instructions somewhere secure and tell a trusted person where to find them.

    Starting Small

    Start with one conversation at dinner about which accounts the household shares.

    Frequently Asked Questions

    What is the safest way to share passwords with family?

    A shared vault in a reputable password manager is a common approach.

    Is it okay to share streaming passwords?

    Follow each service’s terms; many offer family or household plans.

    How can my spouse access accounts if something happens to me?

    Use emergency access features or a secure written plan.

    Should kids use password managers?

    Older kids can benefit, especially with family plans.

    What should I do when a roommate moves out?

    Change shared passwords and remove their access.

    The Bottom Line

    Share passwords through a password manager’s shared vaults, use separate accounts where possible, plan emergency access, teach kids good habits and review access when life changes.


    Editorial note: Lock and Login is independent and reader-supported. This guide is based on research into manufacturer documentation, published specifications and widely accepted best practices; we have not been paid to mention any product. If we add affiliate links in the future, they will be clearly disclosed per our Affiliate Disclosure.

  • Privacy Settings Checkup: Phone, Browser and Social Media

    Privacy Settings Checkup: Phone, Browser and Social Media

    Your phone, browser and social accounts collect a lot of information by default. Much of it is used for advertising and personalization. Some of it may be more than you are comfortable sharing. A periodic privacy checkup lets you decide what to keep.

    This guide walks through common settings. Menus vary by device and app version, so look for similar options in your settings.

    Phone Privacy

    App Permissions

    Review which apps can access location, camera, microphone, contacts, photos and Bluetooth. Remove permissions apps do not need. Choose “while using the app” or approximate location where possible.

    Location History

    Phone operating systems and some apps can keep a history of places you have been. Review and pause or delete it if you prefer.

    Ad Tracking

    Both major mobile platforms offer settings to limit app tracking or reset advertising identifiers. Review them.

    Lock Screen

    Limit what notifications show on your lock screen, so private messages and codes are not visible to anyone nearby.

    Unused Apps

    Delete apps you no longer use. Fewer apps mean fewer permissions and less data collection.

    Browser Privacy

    • Review cookie settings and consider blocking third-party cookies
    • Review saved passwords and move them to a password manager. See the password manager guide.
    • Remove extensions you do not use; extensions can see a lot of browsing activity
    • Clear browsing data periodically if you like
    • Consider privacy-focused browsers or search engines

    Social Media Privacy

    • Review who can see your posts, friends list and profile details
    • Limit who can look you up by phone number or email
    • Remove your birthday, address and phone number from public view
    • Review tagged photos and tagging permissions
    • Check which third-party apps are connected and remove old ones
    • Review ad preferences

    Public details such as birthdays and pet names are used in security questions and by scammers. See phishing red flags.

    Google, Apple and Microsoft Account Dashboards

    Major account providers offer privacy dashboards that show activity history, ad personalization and connected apps. Walk through them and adjust settings.

    Smart Speakers and Devices

    • Review voice recording history and deletion settings
    • Use mute buttons when you want privacy
    • Check camera settings on doorbells and indoor cameras
    • Put smart devices on a separate network. See home Wi-Fi security.

    Email Privacy

    • Use email aliases for sign-ups
    • Unsubscribe from lists you do not want
    • Turn off automatic remote image loading if your email app allows, since images can be used for tracking

    A Simple Annual Routine

    Area What to review
    Phone Permissions, location history, ad tracking
    Browser Extensions, cookies, saved passwords
    Social media Visibility, tags, connected apps
    Accounts Privacy dashboards
    Smart devices Recordings, cameras
    Data brokers Listings. See the data broker removal guide.

    Common Mistakes

    • Granting every permission requested
    • Keeping unused apps and extensions
    • Sharing birthdays and addresses publicly
    • Never revisiting settings after updates

    A Note on Children’s Devices

    Phone platforms offer family features for managing children’s app downloads, screen time and content filters. Review location sharing, app permissions and in-app purchase settings on children’s devices. Talk with kids about what is safe to post, why location tagging can reveal where they are and how to report uncomfortable messages.

    A Note on Cars and Connected Devices

    Modern cars, TVs, fitness trackers and appliances may collect data and connect to apps. Review their privacy settings and companion apps, and turn off features you do not need. When selling a car or device, reset it and remove it from your accounts.

    A Note on Photos

    Photos can carry location data in their metadata. Many phones let you remove location before sharing. Social platforms often strip some metadata, but not every app does. Be mindful of what appears in the background of photos, such as house numbers or school names.

    Questions to Ask About Any App

    • Why does this app need this permission?
    • Does it work without it?
    • What does the privacy policy say about sharing data?

    Starting Small

    Pick one area, such as phone app permissions, and finish it in one sitting. Then move on to the next area another day.

    A Note on Browser Sync

    Browser sync saves bookmarks, history and sometimes passwords to your account so they appear on all your devices. That is convenient but means your account holds a lot of data. Protect it with two-factor authentication and review what is synced. See two-factor authentication setup.

    Final Checkup List

    • Phone permissions reviewed
    • Location history set as preferred
    • Browser extensions pruned
    • Social media visibility checked
    • Account dashboards reviewed
    • Smart device recordings checked

    A Note on Privacy Policies

    Privacy policies are long, but skimming the sections on data sharing, retention and your choices can be revealing. Look for whether the company sells or shares data with advertisers, how long it keeps data and how to request deletion. Some state privacy laws give residents specific rights to access or delete data.

    A Note on Search Engines

    Search engines can keep a history of your searches tied to your account. Review search history settings, pause or delete history if you prefer and consider whether you want to be signed in while searching.

    Frequently Asked Questions

    How often should I review privacy settings?

    At least once a year and after major updates.

    Does limiting ad tracking stop ads?

    No, but it can limit personalization based on tracking.

    Are browser extensions risky?

    Some are. Install only what you need from trusted developers.

    Should I delete location history?

    It is your choice; pausing or deleting it limits stored data.

    Do privacy settings protect against hackers?

    Partly, by limiting exposed information. Pair them with strong account security.

    The Bottom Line

    Review phone permissions, browser settings, social media visibility, account dashboards and smart devices regularly, and share only what you are comfortable sharing.


    Editorial note: Lock and Login is independent and reader-supported. This guide is based on research into manufacturer documentation, published specifications and widely accepted best practices; we have not been paid to mention any product. If we add affiliate links in the future, they will be clearly disclosed per our Affiliate Disclosure.

  • Identity Theft Recovery Steps: What to Do First

    Identity Theft Recovery Steps: What to Do First

    Discovering identity theft is stressful. You might spot an unfamiliar account on your credit report, receive a bill for something you did not buy, get a denial for credit you did not expect or receive a notice that a tax return was already filed in your name. Acting quickly and methodically limits the damage.

    This guide outlines common recovery steps in the United States. It is general information, not legal advice. For your specific situation, consult official resources such as the Federal Trade Commission’s IdentityTheft.gov and, if needed, a qualified professional.

    Step 1: Contact the Companies Involved

    Call the fraud department of each company where fraud occurred, such as a bank, card issuer or lender. Explain that someone stole your identity, ask them to close or freeze fraudulent accounts and change logins and PINs on your legitimate accounts. Write down who you spoke with and when.

    Step 2: Place a Fraud Alert

    Contact one of the three nationwide credit bureaus to place a fraud alert. That bureau must tell the other two. A fraud alert asks lenders to take extra steps to verify your identity. Identity theft victims may qualify for an extended fraud alert.

    Step 3: Freeze Your Credit

    A freeze offers stronger protection against new accounts. Freeze at all three bureaus. See how to freeze your credit.

    Step 4: Report to the FTC

    The FTC’s IdentityTheft.gov lets you report identity theft and get a personalized recovery plan. The report can serve as an Identity Theft Report, which helps when disputing fraudulent accounts with businesses and credit bureaus.

    Step 5: Consider a Police Report

    Some situations call for a police report, such as when you know the thief or a creditor requires one. Bring your FTC report and documentation.

    Step 6: Review Your Credit Reports

    Get your credit reports from all three bureaus through the official free annual report program. Look for accounts, inquiries and addresses you do not recognize. Dispute errors with the bureaus.

    Step 7: Secure Your Accounts

    • Change passwords on email, banking and other key accounts
    • Use a password manager to create unique passwords. See the password manager guide.
    • Turn on two-factor authentication. See two-factor authentication setup.
    • Check email forwarding rules and recovery options for changes you did not make
    • Ask your mobile carrier about account protections against SIM swapping

    Step 8: Address Specific Types of Fraud

    Type Where to start
    Tax identity theft The IRS
    Medical identity theft Your health insurer and providers
    Government benefits fraud The relevant agency
    Mail fraud or address change The postal service
    Child identity theft The credit bureaus

    Step 9: Keep Records

    Keep a log of calls, letters, dates and reference numbers. Save copies of reports and correspondence. Send important letters in a trackable way.

    Step 10: Monitor Going Forward

    • Review bank and card statements regularly
    • Set up account alerts
    • Check credit reports periodically
    • Watch for unexpected mail or bills

    Beware of Recovery Scams

    Scammers target identity theft victims, promising to fix problems for a fee or pretending to be government agencies. Government agencies generally do not call demanding payment. See phishing red flags.

    Emotional Toll

    Identity theft can be exhausting. Break the process into steps, keep notes and ask for help from trusted friends or family.

    Common Mistakes

    • Waiting to act
    • Not keeping records
    • Securing financial accounts but not email
    • Trusting unsolicited help offers

    A Note on Documentation

    Recovery often involves proving who you are and showing which accounts or charges are not yours. Keep copies of your ID, recent bills and statements in a secure place so you can provide them quickly. When disputing debts, send written disputes and keep copies. A simple folder, physical or digital, with dated notes saves time.

    A Note on Debt Collectors

    If a debt collector contacts you about a debt you did not incur, tell them in writing that you are an identity theft victim and the debt is not yours. Include a copy of your FTC report. Federal law gives you rights in disputing debts, and official consumer protection resources explain them.

    Questions to Ask Companies

    • Can you close or freeze the fraudulent account?
    • What documents do you need from me?
    • Can you send written confirmation the debt is not mine?
    • Can you flag my account for extra verification?

    Starting Small

    Break recovery into one call or task per day. Progress steadily rather than trying to fix everything at once.

    A Note on Children and Deceased Relatives

    Identity thieves sometimes target children’s and deceased relatives’ information because no one is watching their credit. Parents can request freezes for minors. Families settling an estate can notify the credit bureaus and relevant agencies of a death, following each organization’s process, to help prevent misuse.

    Final Recovery Checklist

    • Affected companies contacted
    • Fraud alert placed
    • Credit frozen at all three bureaus
    • FTC report filed
    • Credit reports reviewed and errors disputed
    • Email and key accounts secured
    • Records organized

    A Note on Getting Help

    Legal aid organizations and consumer protection offices may help with complex cases. Identity theft resources from the FTC list next steps for many specific situations.

    Frequently Asked Questions

    What should I do first?

    Contact companies where fraud occurred and place a fraud alert or freeze.

    Do I need a police report?

    Not always; the FTC report is often sufficient, but some situations require one.

    Will identity theft affect my credit score?

    Fraudulent accounts can, which is why disputing them matters.

    How long does recovery take?

    It varies widely.

    Should I buy identity theft protection?

    Some services help with monitoring and recovery. Many core steps are free.

    The Bottom Line

    Act quickly: contact affected companies, place a fraud alert and freeze, report to the FTC, review credit reports, secure email and key accounts and keep thorough records.


    Editorial note: Lock and Login is independent and reader-supported. This guide is based on research into manufacturer documentation, published specifications and widely accepted best practices; we have not been paid to mention any product. If we add affiliate links in the future, they will be clearly disclosed per our Affiliate Disclosure.

  • Home Wi-Fi Security: How to Lock Down Your Router

    Home Wi-Fi Security: How to Lock Down Your Router

    Your router is the front door to your home network. Every phone, laptop, smart TV, camera and doorbell connects through it. Yet many routers run for years with default settings, old firmware and weak passwords. A few changes can make your home network much more secure.

    This guide walks through practical steps. Router menus differ by brand and model, so use your router’s manual or app for exact steps.

    Step 1: Change the Admin Password

    Your router has an administrator login, separate from the Wi-Fi password, used to change settings. Older routers sometimes shipped with default admin credentials that are easy to look up. Change it to a strong, unique password and store it in your password manager. See the password manager guide.

    Step 2: Update Firmware

    Router firmware updates fix security vulnerabilities. Many newer routers update automatically; others require you to check in the admin page or app. Turn on automatic updates if available.

    If the manufacturer no longer releases updates for your model, it may be time to replace it.

    Step 3: Use Strong Encryption

    In wireless settings, choose WPA3 if all your devices support it, or WPA2/WPA3 mixed mode, or WPA2 if needed. Avoid older options like WEP or open networks.

    Step 4: Set a Strong Wi-Fi Password

    Use a long passphrase. Since you share it with guests and type it into devices, random words work well. See strong passphrases.

    Step 5: Set Up a Guest Network

    Many routers can create a separate guest network. Use it for visitors and, where possible, for smart home devices. This helps keep them separate from your main computers and phones.

    Step 6: Review Risky Features

    Feature What it does Suggested approach
    WPS Push-button or PIN pairing Consider disabling; PIN mode has had weaknesses
    Remote management Admin access from outside your home Disable unless needed
    UPnP Lets devices open ports automatically Consider disabling if you do not need it
    Default network name Can reveal router brand Change to something neutral

    Disabling some features can affect gaming consoles or other devices; test after changes.

    Step 7: Check Connected Devices

    Your router’s admin page or app shows connected devices. Review it occasionally and remove anything you do not recognize. Rename devices so you know what each one is.

    Step 8: Secure Smart Devices

    • Change default passwords on cameras and smart gadgets
    • Update device firmware
    • Disable features you do not use
    • Put devices on the guest or IoT network if available

    Router-Provided Security Features

    Some routers include built-in security features such as malicious site blocking, parental controls or automatic threat scanning. Some require subscriptions. Review what they do and their privacy policies.

    Mesh Systems

    Mesh systems use multiple units for better coverage and are often managed with an app that makes updates and settings easier.

    When to Replace Your Router

    • The manufacturer no longer provides updates
    • It only supports older encryption
    • Performance no longer meets your needs

    What About VPNs?

    A VPN does not replace router security. See do you need a VPN at home?.

    Common Mistakes

    • Never changing the admin password
    • Ignoring firmware updates
    • Using outdated encryption
    • Sharing the main Wi-Fi password with everyone and every device

    A Note on Internet Provider Equipment

    Many homes use a modem and router supplied by the internet provider. Some update automatically and are managed remotely by the provider, while others give you limited settings. Check what you can control through the provider’s app or admin page. If you use your own router, you take responsibility for its updates.

    A Note on Physical Security

    Anyone with physical access to your router can often reset it to factory defaults. Place it somewhere reasonably secure and out of reach of visitors where possible. After any reset, repeat your setup steps, since defaults return.

    Questions to Ask Before Buying a Router

    • How long will the manufacturer provide security updates?
    • Does it support WPA3?
    • Does it offer a guest or IoT network?
    • Is it managed through an app, and what data does the app collect?
    • Does it update automatically?

    Final Network Checklist

    • Admin password changed
    • Firmware current
    • Encryption set to WPA3 or WPA2
    • Guest network on
    • Remote management off
    • Device list reviewed

    A Note on Parental Controls

    Many routers include parental controls such as content filters, time limits and per-device pause buttons. These can help manage children’s screen time, though determined kids may find workarounds. Combine router controls with device-level family features and conversations about online safety.

    Starting Small

    You can do the most important steps in one sitting: log in to your router app or admin page, change the admin password, check for firmware updates and confirm encryption. Save guest network and advanced settings for another day.

    A Note on Old Devices

    Old smart plugs, cameras and printers may no longer receive updates. Remove devices you no longer use from your network, and consider replacing unsupported ones that stay online all the time.

    A Note on Wi-Fi Names

    Avoid including your name, address or apartment number in your network name.

    Frequently Asked Questions

    How often should I update my router?

    Turn on automatic updates or check periodically.

    Should I hide my network name?

    Hiding the network name provides little security and can cause connection issues.

    Is WPA3 necessary?

    It is stronger; use it if your devices support it.

    Should smart devices go on the guest network?

    It is a common approach for separating them.

    How do I know if someone is on my Wi-Fi?

    Check the connected devices list in your router app or admin page.

    The Bottom Line

    Change the admin password, update firmware, use modern encryption and strong passphrases, create a guest network, disable features you do not need and replace routers that no longer get updates.


    Editorial note: Lock and Login is independent and reader-supported. This guide is based on research into manufacturer documentation, published specifications and widely accepted best practices; we have not been paid to mention any product. If we add affiliate links in the future, they will be clearly disclosed per our Affiliate Disclosure.

  • Strong Passphrases: How to Create Passwords You Can Remember

    Strong Passphrases: How to Create Passwords You Can Remember

    Most of your passwords should be long, random strings generated and stored by a password manager. But a few passwords you must remember and type: your password manager’s master password, your computer login and perhaps your phone or email password. For these, a passphrase is often the best answer.

    A passphrase is a password made of several words. Done well, it is long, hard to guess and easier to remember than a jumble of symbols. This guide explains how to create one.

    Why Length Matters

    Password strength depends heavily on how many possible combinations an attacker must try. Length increases that number dramatically. A long passphrase of several random words can be stronger than a short password with symbols, and easier to remember.

    Current guidance from security organizations such as the National Institute of Standards and Technology emphasizes length and checking passwords against lists of known compromised passwords, rather than forcing frequent changes or complicated composition rules.

    The Key Is Randomness

    The words in a passphrase must be chosen randomly, not by you. Humans are bad at randomness: we pick song lyrics, quotes, names and patterns that attackers can guess. A phrase like a famous movie line is weak, even if long.

    Random Word Methods

    One well-known method uses dice and a numbered word list. You roll dice to pick each word, so the choice is truly random. Many password managers also include passphrase generators that pick random words for you.

    How to Create a Passphrase

    1. Use a generator or dice method to pick several random words
    2. Aim for more words for more important accounts, such as your master password
    3. Separate words with spaces, hyphens or another character if you like
    4. Do not rearrange words to make them more meaningful
    5. Practice typing it several times
    6. Write it down once and store it securely until memorized, then decide whether to keep the copy in a safe place

    Adding Numbers and Symbols

    Some sites require numbers, capitals or symbols. Add them in a simple way, such as capitalizing one word and adding a number between words. The randomness of the words provides most of the strength.

    Where to Use Passphrases

    • Password manager master password
    • Computer login
    • Phone backup and email account, if typed often
    • Wi-Fi network password. See home Wi-Fi security.

    For everything else, let your password manager generate random passwords. See the password manager guide.

    What to Avoid

    • Personal information: names, birthdays, pet names, addresses, sports teams
    • Common phrases, lyrics or quotes
    • Keyboard patterns
    • Reusing a passphrase on multiple sites
    • Small variations of an old password

    Do You Need to Change Passwords Regularly?

    Many experts now advise against forced periodic changes for strong, unique passwords, because frequent changes lead to weaker patterns. Change a password if a site is breached, if you suspect compromise or if you reused it.

    Checking for Breaches

    Many password managers and browsers alert you when saved passwords appear in known breaches. If a password is flagged, change it on that site and anywhere you reused it.

    Combine with Two-Factor Authentication

    Even a strong passphrase can be phished. Two-factor authentication adds protection. See two-factor authentication setup.

    Common Mistakes

    • Choosing words yourself instead of randomly
    • Using too few words
    • Reusing a passphrase
    • Storing the master password inside the vault it protects

    A Note on Password Hints and Security Questions

    Security questions are often weak because the answers, such as your first school or mother’s maiden name, can be found online. Where sites require them, treat answers like passwords: give random answers and store them in your password manager. Avoid password hints that reveal the password.

    A Note on Writing Things Down

    Security advice used to say never write passwords down. A more practical view is that a written note kept somewhere physically secure at home is far safer than a weak or reused password. The main risks with written passwords are people with physical access, so store any written record carefully.

    Questions to Ask Yourself

    • Which passwords do I actually type from memory?
    • Are any of them reused anywhere?
    • Is my master password long enough?
    • Do I have two-factor authentication on my most important accounts?

    Starting Small

    Start with your password manager master password and email password. Once those are strong, move on to the rest with generated passwords.

    A Note on Device PINs

    Your phone PIN protects everything on the device, including saved passwords, email and passkeys. Use a longer PIN or an alphanumeric passcode rather than a short, guessable one, and avoid patterns or birthdays. Biometrics are convenient, but the PIN is the fallback that matters.

    Comparison Table

    Password type Best for How to create
    Random passphrase Passwords you type Dice or generator
    Random string Everything else Password manager
    Device PIN Phone unlock Longer, non-patterned
    Security answers Account recovery Random, stored in manager

    Final Passphrase Checklist

    • Words chosen randomly
    • Enough words for the account’s importance
    • Not reused anywhere
    • Practiced until comfortable
    • Stored securely until memorized

    Frequently Asked Questions

    How many words should a passphrase have?

    More words mean more strength. For a master password, err on the longer side.

    Are spaces allowed?

    Many systems allow them; others require a different separator.

    Is a passphrase better than a random password?

    For passwords you must remember, often yes. For others, random generated passwords are fine.

    Should I write down my passphrase?

    Writing it down once and storing it securely can help until memorized.

    Can I use the same passphrase for my computer and password manager?

    It is better to use unique passphrases.

    The Bottom Line

    Use random-word passphrases for the few passwords you must remember, let a password manager handle the rest, avoid personal information and add two-factor authentication.


    Editorial note: Lock and Login is independent and reader-supported. This guide is based on research into manufacturer documentation, published specifications and widely accepted best practices; we have not been paid to mention any product. If we add affiliate links in the future, they will be clearly disclosed per our Affiliate Disclosure.

  • Data Broker Removal Guide: How to Opt Out of People-Search Sites

    Data Broker Removal Guide: How to Opt Out of People-Search Sites

    Search your name online and you may find sites listing your address, phone number, age, relatives and past addresses. These are data brokers and people-search sites, companies that collect information from public records, marketing data and other sources, then sell or display it. That information can fuel spam calls, scams, stalking and identity theft.

    Removing yourself is possible, though tedious. This guide explains how data brokers work, how to opt out and when a paid service may make sense. We have not tested any removal service, and we are not affiliated with any.

    What Data Brokers Collect

    Depending on the company, profiles may include:

    • Current and past addresses
    • Phone numbers and email addresses
    • Age and date of birth
    • Names of relatives and associates
    • Property records
    • Court records
    • Social media profiles
    • Estimated income or interests used for marketing

    Some brokers sell data mainly to marketers, while people-search sites show profiles to anyone who searches.

    Why Opting Out Matters

    Less information online makes it harder for scammers to impersonate you, guess security answers or target you with convincing phishing. It can also reduce unwanted calls and mail. For people concerned about personal safety, removing addresses can be especially important. People facing threats may want to contact local advocacy organizations for safety planning in addition to opt-outs.

    How to Find Your Listings

    1. Search your full name with your city and state in a search engine
    2. Try variations, including maiden names and nicknames
    3. Search your phone number and email address
    4. Note each site that lists you

    Keep a simple spreadsheet with the site, profile link, date of opt-out request and status.

    How to Opt Out

    Most sites have an opt-out or privacy page, often linked in the footer. The process usually involves:

    1. Finding your profile on the site
    2. Submitting the profile link through an opt-out form
    3. Confirming through an email link
    4. Waiting for the listing to be removed

    Protecting Yourself During Opt-Outs

    • Consider using a separate email address for opt-out confirmations
    • Provide only the information needed to identify your listing
    • Be cautious with sites that ask for ID documents; read what they do with them
    • Never pay a site claiming to charge for removal unless you have verified it is legitimate

    Recheck Regularly

    Profiles often reappear as brokers refresh data. Recheck every few months and resubmit requests. Many brokers share data, so removing yourself from larger sources can reduce listings elsewhere.

    State Privacy Rights

    Several U.S. states have consumer privacy laws that give residents rights to request access to or deletion of personal data from certain businesses. Some states also have data broker registries listing registered brokers. Check your state’s laws and attorney general resources to see what applies to you.

    Paid Removal Services

    Paid services submit opt-out requests on your behalf and recheck periodically.

    Consideration DIY Paid service
    Cost Free Subscription
    Time Significant Low
    Coverage What you find The service’s list
    Control Full You share data with the service
    Ongoing checks Manual Automated

    Before paying, read what sites the service covers, how often it rechecks and its own privacy policy. No service can remove everything, especially public records held by government offices.

    Reducing Future Data Collection

    • Use privacy settings on social media. See the privacy settings checkup.
    • Be selective with loyalty programs and contests
    • Use email aliases for sign-ups
    • Opt out of prescreened credit offers
    • Limit app permissions

    Pair with Other Protections

    Opt-outs reduce exposure but do not prevent identity theft on their own. Combine them with a credit freeze and two-factor authentication.

    Common Mistakes

    • Opting out once and never checking again
    • Using your main email for confirmations
    • Sharing more personal data than necessary
    • Expecting removal of government records

    A Note on Email Aliases

    An email alias is an alternate address that forwards to your main inbox. Several email providers and password managers offer alias features. Using a unique alias for each sign-up makes it easier to see which company shared your address and to shut down an alias that starts receiving spam. Aliases are especially handy for opt-out confirmations.

    A Note on Phone Numbers

    Your phone number is often the key that links your profiles together. Consider using a secondary number for shopping, loyalty programs and online forms, and keep your main number for close contacts and important accounts. Ask your mobile carrier about account protections.

    Final Opt-Out Checklist

    • Listings tracked in a spreadsheet
    • Separate email used for confirmations
    • Requests submitted and confirmed
    • Recheck reminder set
    • Future sign-ups using aliases

    Questions to Ask a Paid Removal Service

    • Which sites do you cover, and how is that list maintained?
    • How often do you recheck for new listings?
    • What personal data do you need from me, and how is it protected?
    • Can I cancel easily and have my data deleted?
    • Do you provide reports showing what was removed?

    Starting Small

    Begin with the few people-search sites that appear first when you search your name, since those are the ones most people see.

    Frequently Asked Questions

    Is it legal for data brokers to list my information?

    In many cases, yes, though state laws vary and some give you deletion rights.

    How long do opt-outs take?

    It varies by site.

    Will my information come back?

    Often, so recheck periodically.

    Are paid removal services worth it?

    They save time but cost money and cannot remove everything.

    Can I remove public records?

    Usually not through data brokers; records held by government offices follow their own rules.

    The Bottom Line

    Data broker removal takes persistence. Find your listings, opt out carefully, track requests, recheck regularly and limit future data sharing. Decide whether a paid service is worth it based on your time and comfort sharing data.


    Editorial note: Lock and Login is independent and reader-supported. This guide is based on research into manufacturer documentation, published specifications and widely accepted best practices; we have not been paid to mention any product. If we add affiliate links in the future, they will be clearly disclosed per our Affiliate Disclosure.