Lock and Login

Practical online privacy and account security guides

Blog

  • How to Freeze Your Credit: A Step-by-Step Guide

    How to Freeze Your Credit: A Step-by-Step Guide

    A credit freeze is one of the most effective, low-effort steps you can take against new-account identity theft. When your credit file is frozen, most lenders cannot pull your credit report, which makes it much harder for someone using your stolen information to open a credit card or loan in your name.

    This guide explains how a credit freeze works in the United States, how to place and lift one and how it compares with other options. Rules and processes can change, so confirm the current steps with each bureau and with the Federal Trade Commission.

    What a Credit Freeze Does

    A freeze restricts access to your credit report. Since most lenders check credit before approving new accounts, a freeze blocks many fraudulent applications. Under federal law, placing and lifting a freeze with the nationwide credit bureaus is free.

    What It Does Not Do

    • It does not affect your credit score
    • It does not stop you from using existing cards and accounts
    • It does not prevent existing creditors from reviewing your account
    • It does not stop all types of fraud, such as misuse of existing accounts, tax fraud or medical identity theft
    • It does not stop prescreened offers by itself; opting out of those is a separate step

    The Three Nationwide Bureaus

    You need to freeze your credit separately with each of the three nationwide credit bureaus: Equifax, Experian and TransUnion. Freezing at only one leaves the others open, and lenders may use any of them.

    How to Place a Freeze

    1. Go to each bureau’s official website, typing the address yourself rather than clicking links in emails
    2. Create an account or use the freeze request process
    3. Verify your identity with personal details
    4. Request the freeze
    5. Save any PIN, password or confirmation the bureau provides in your password manager

    Freezes can also typically be requested by phone or mail. Online requests are often processed quickly.

    How to Lift a Freeze

    When you apply for credit, such as a mortgage, car loan, credit card or sometimes a new phone plan or apartment, you need to lift the freeze temporarily.

    1. Ask the lender which bureau it will use
    2. Log in to that bureau’s account
    3. Lift the freeze temporarily for a date range, or permanently remove it
    4. Re-freeze afterward if the lift does not end automatically

    Planning ahead avoids delays during applications. Keep bureau logins in your password manager. See the password manager guide.

    Freezing Credit for Children

    Children usually have no credit file, which can make them targets for synthetic identity fraud that goes unnoticed for years. Parents and guardians can request freezes for minors at each bureau, typically by mail with documentation. Check each bureau’s current requirements.

    Freezes for Other Family Members

    Guardians, conservators and people with power of attorney may be able to place freezes for adults in their care. Requirements vary.

    Freeze vs. Fraud Alert vs. Lock

    Option What it does Cost Notes
    Credit freeze Restricts access to your report Free by law Set at each bureau
    Fraud alert Asks lenders to verify identity Free One bureau notifies the others
    Credit lock Similar to freeze Varies Governed by bureau agreements, sometimes part of paid products

    A fraud alert can be a useful extra step, particularly after a known breach or identity theft. Extended fraud alerts are available to identity theft victims.

    Other Steps That Pair Well

    • Check your credit reports regularly through the official free annual credit report program
    • Opt out of prescreened credit offers if you prefer
    • Turn on account alerts at your bank and card issuers
    • Use two-factor authentication. See two-factor authentication setup.
    • Consider freezes with other specialty reporting agencies relevant to you

    If Your Identity Is Already Stolen

    A freeze helps prevent new accounts but does not fix existing fraud. See identity theft recovery steps.

    Common Mistakes

    • Freezing at only one bureau
    • Losing the PIN or login
    • Forgetting to lift before an application
    • Clicking bureau links in suspicious emails

    A Note on Specialty Reporting Agencies

    Beyond the three nationwide credit bureaus, other consumer reporting agencies track things like bank account history, phone and utility accounts, and check-writing history. Some allow security freezes too. If you are concerned about fraudulent bank or phone accounts, research which specialty agencies apply to you and whether a freeze makes sense.

    Planning for Applications

    Before applying for a mortgage, car loan, apartment or new card, write down which bureaus you need to unfreeze and when. Lift the freeze a day or two early to avoid delays. Many bureaus let you set a temporary lift that ends automatically, which removes the risk of forgetting to re-freeze.

    Final Freeze Checklist

    • Freeze placed at Equifax
    • Freeze placed at Experian
    • Freeze placed at TransUnion
    • Logins and PINs saved in a password manager
    • Children’s freezes considered

    A Note on Phone and Mail Requests

    If you cannot use the bureaus online, you can typically request freezes by phone or mail. Mail requests take longer and usually require copies of identity documents. Keep copies of everything you send.

    Frequently Asked Questions

    Does freezing my credit hurt my score?

    No.

    Is a credit freeze free?

    Yes, at the nationwide bureaus under federal law.

    How long does a freeze last?

    Until you lift or remove it.

    Can I still use my credit cards?

    Yes. A freeze does not affect existing accounts.

    Should I freeze my child’s credit?

    Many parents consider it a sensible precaution. Check bureau requirements.

    The Bottom Line

    A credit freeze is free, does not affect your score and blocks many types of new-account fraud. Freeze at all three bureaus, store your logins safely, lift temporarily when needed and pair it with good account security.

    Editorial note: Lock and Login is independent and reader-supported. This guide is based on research into manufacturer documentation, published specifications and widely accepted best practices; we have not been paid to mention any product. If we add affiliate links in the future, they will be clearly disclosed per our Affiliate Disclosure.

  • Do You Need a VPN at Home? What a VPN Does and Does Not Do

    Do You Need a VPN at Home? What a VPN Does and Does Not Do

    VPN advertising can make it sound as though every home internet connection is dangerous without one. The reality is more nuanced. A virtual private network can be a useful tool in specific situations, but it is not a complete security or privacy solution, and many people at home may not need one for everyday browsing.

    This guide explains what a VPN actually does, when it helps, when it does not and how to evaluate a provider if you decide to use one. We are not recommending or ranking specific services.

    What a VPN Does

    A VPN creates an encrypted tunnel between your device and a server operated by the VPN provider. Your internet traffic travels through that tunnel before reaching the wider internet. Two main things change:

    • Your internet service provider and others on your local network see that you are connected to a VPN, but not the specific sites you visit
    • Websites see the VPN server’s IP address instead of your home IP address

    In effect, you are shifting trust. Instead of your internet provider seeing which sites you connect to, the VPN provider is in a position to see it. That makes choosing a trustworthy provider essential.

    What a VPN Does Not Do

    • It does not stop phishing emails or fake websites
    • It does not protect you from malware you download
    • It does not make you anonymous; logged-in accounts, cookies and browser fingerprinting still identify you
    • It does not protect accounts with weak or reused passwords
    • It does not fix an insecure home router

    Much of the web already uses encrypted connections, so the content of your pages, passwords and card numbers is generally encrypted between your browser and the site even without a VPN. That is one reason a VPN adds less at home than marketing may suggest.

    When a VPN Can Help

    Public and Untrusted Wi-Fi

    On hotel, airport or coffee shop networks, you do not control who else is connected or how the network is configured. A VPN adds a layer of protection for your traffic on networks you do not trust.

    Hiding Browsing Activity from Your Internet Provider

    If you prefer that your internet provider not see which sites you visit, a VPN shifts that visibility to the VPN provider.

    Travel

    Some travelers use VPNs to access home services while abroad. Be aware that VPN use is restricted in some countries, and streaming services may have terms about location. Check local laws and service terms.

    Work Requirements

    Many employers require a company VPN to reach internal systems. That is a different product with a different purpose, managed by your employer.

    When You May Not Need One

    If you mostly browse at home on your own secured Wi-Fi, use well-known sites and are comfortable with your internet provider’s privacy policy, a VPN may add limited value. Time and money might be better spent on a password manager, two-factor authentication, router updates and a credit freeze. See home Wi-Fi security.

    How to Evaluate a VPN Provider

    Question Why it matters
    What is the logging policy? Determines what the provider keeps about your activity
    Has it been independently audited? Audits test whether claims hold up
    Where is the company based? Affects legal obligations
    How does it make money? Free services may rely on data or ads
    Which protocols does it use? Modern, well-reviewed protocols are preferable
    Does it offer a kill switch? Blocks traffic if the VPN drops
    Is pricing and cancellation clear? Avoids surprise renewals

    Be cautious with free VPNs. Running servers costs money, and some free services have been criticized for collecting or selling data. Read privacy policies carefully.

    Router-Level VPNs

    Some routers can run a VPN for every device on the network. This covers smart TVs and gadgets that cannot run VPN apps, but it can slow the whole network and complicate troubleshooting. It is a more advanced setup.

    Common Mistakes

    • Treating a VPN as antivirus or phishing protection
    • Using an unknown free VPN without reading its policy
    • Assuming a VPN makes you anonymous
    • Forgetting the VPN is on when a site behaves strangely

    A Note on Speed and Reliability

    VPNs add an extra hop for your traffic, which can reduce speed or add delay, especially when connecting to distant servers. Some websites and banks also flag or block VPN traffic, which can trigger extra verification. If a site behaves oddly, try disconnecting the VPN to see whether it is the cause.

    Questions to Ask Before You Subscribe

    • What problem am I trying to solve?
    • Would a password manager or router update address it better?
    • Does the provider offer a trial or refund period?
    • How easy is cancellation?

    Starting Small

    If you are curious, try a reputable provider’s trial on your next trip and use it on hotel and airport Wi-Fi before committing to a long subscription.

    Frequently Asked Questions

    Do I need a VPN on my home Wi-Fi?

    Not necessarily. It depends on your privacy preferences and whether you trust your internet provider.

    Does a VPN protect my passwords?

    Most sites already encrypt logins. Strong unique passwords and two-factor authentication matter more. See the password manager guide.

    Is a VPN useful on public Wi-Fi?

    It can add a useful layer of protection on untrusted networks.

    Will a VPN slow my internet?

    It can, depending on the provider, server distance and protocol.

    Are free VPNs safe?

    Some are, but many have business models that raise privacy concerns. Read policies carefully.

    The Bottom Line

    A VPN is a tool for specific situations, such as public Wi-Fi and limiting what your internet provider sees. It is not a complete security solution. Prioritize strong passwords, two-factor authentication and a secure home network, and choose any VPN provider carefully.

    Editorial note: Lock and Login is independent and reader-supported. This guide is based on research into manufacturer documentation, published specifications and widely accepted best practices; we have not been paid to mention any product. If we add affiliate links in the future, they will be clearly disclosed per our Affiliate Disclosure.

  • Password Manager Guide: How They Work and How to Choose One

    Password Manager Guide: How They Work and How to Choose One

    Most people have far more online accounts than they can remember strong, unique passwords for. The result is predictable: reused passwords, small variations of the same password, or notes on paper and in phone apps. When one site is breached, reused passwords let attackers try the same login elsewhere, a technique often called credential stuffing.

    A password manager solves this by generating and storing a unique password for every account, so you only need to remember one strong master password. This guide explains how password managers work, what to compare and how to switch without locking yourself out. We have not tested or ranked specific products here; instead, this is a framework for making your own choice.

    How Password Managers Work

    A password manager is an encrypted vault. You unlock it with a master password, and sometimes with a device biometric or a hardware key. Inside, it stores logins, and often notes, card details and other sensitive information.

    Many reputable managers use what is called a zero-knowledge design. That means your vault is encrypted on your device before it syncs, and the company does not hold the key needed to decrypt it. If the company’s servers were breached, attackers would get encrypted data rather than readable passwords. The strength of that protection depends heavily on your master password, which is why it matters so much.

    Autofill

    Most managers offer browser extensions and mobile apps that fill logins automatically. Autofill is also a security feature: a manager usually fills credentials only on the website address they were saved for, which can help you notice a lookalike phishing site. If your manager does not offer to fill on a page where you expect it to, stop and check the address. See phishing red flags.

    Password Generation

    A good generator creates long, random passwords. Since you never type them, length costs you nothing. For the few passwords you do type, such as the master password, a long passphrase is easier. See strong passphrases.

    Types of Password Managers

    Standalone Managers

    Dedicated apps that work across browsers and operating systems. They often include features such as secure sharing, breach alerts, emergency access and support for passkeys.

    Browser and Operating System Managers

    Major browsers and phone operating systems include built-in password managers. They are convenient and free, and for many people they are a big improvement over reuse. Their limitations can show up if you use several browsers or switch between ecosystems, such as a Windows computer and an iPhone.

    Self-Hosted and Offline Options

    Some people prefer managers that store the vault in a file they control or on a server they run. These give more control but require more technical care, especially for backups.

    Features to Compare

    Feature Why it matters
    Cross-platform apps Works on every device you use
    Encryption design Whether the company can read your vault
    Two-factor support Protects the vault account itself
    Secure sharing Share logins with family without texting them
    Emergency access Lets a trusted person reach the vault if needed
    Breach alerts Flags reused or exposed passwords
    Passkey support Stores modern passwordless logins
    Export options Lets you leave without losing data
    Security audits Independent review of the company’s claims

    When reviewing a company, look for published security documentation, independent audits and a clear account of any past incidents and how they were handled. A company’s response to a problem tells you a lot.

    Choosing a Master Password

    Your master password should be long, unique and memorable to you. A passphrase made of several random words works well. Never reuse it anywhere else, and do not store it inside the vault it protects. Many people write it down once and keep it somewhere physically secure at home until it is memorized.

    Turn on two-factor authentication for the password manager account. See two-factor authentication setup.

    Recovery Planning

    Because of zero-knowledge design, many companies cannot reset your master password for you. Before you rely on a manager, set up whatever recovery options it provides, such as a recovery code, a trusted device or emergency contacts. Store recovery codes offline in a safe place.

    How to Switch to a Password Manager

    1. Pick a manager and install it on your main computer and phone
    2. Create a strong master password and turn on two-factor authentication
    3. Import passwords saved in your browser, if the manager supports it
    4. Delete the old saved passwords from the browser once the import is verified, so they are not stored in two places
    5. Start with your most important accounts: email, banking, phone carrier and the password manager itself
    6. Change reused passwords to unique generated ones as you go
    7. Over the next few weeks, update other accounts as you log in to them

    Your email account deserves special attention, because it can be used to reset other passwords.

    Family and Shared Use

    Family plans and shared vaults let households share streaming, utility and Wi-Fi logins without texting passwords. They also make it easier for a trusted person to help in an emergency. See password sharing for families.

    Common Mistakes

    • Using a weak or reused master password
    • Skipping two-factor authentication on the vault
    • Not saving recovery codes
    • Leaving old passwords stored in the browser and the manager
    • Never updating reused passwords after importing them

    Frequently Asked Questions

    Is it safe to keep all my passwords in one place?

    For most people, a reputable manager with a strong master password and two-factor authentication is much safer than reusing passwords. The risk is concentrated, so protect the vault well.

    Are built-in browser password managers good enough?

    They can be a solid step up from reuse, especially if you use one ecosystem. Standalone managers may suit people who use several browsers or devices.

    What happens if I forget my master password?

    It depends on the manager. Many cannot reset it, so set up recovery options early.

    Should I store credit cards in my password manager?

    Many people do for convenience. Consider your comfort level and use two-factor authentication.

    Do password managers support passkeys?

    Many now do. See passkeys explained.

    The Bottom Line

    A password manager lets you use a unique, strong password everywhere while remembering only one. Choose one that works on all your devices, protect it with a long passphrase and two-factor authentication, plan for recovery and update your most important accounts first.

    Editorial note: Lock and Login is independent and reader-supported. This guide is based on research into manufacturer documentation, published specifications and widely accepted best practices; we have not been paid to mention any product. If we add affiliate links in the future, they will be clearly disclosed per our Affiliate Disclosure.