In most families, digital security rests on one person who “is good with computers.” They remember where the router password is written down, help grandma recover access to her email, and clean up the mess when someone clicks a link from a message. That setup works fine, right up until something goes wrong. Below is a plan that moves a family, in a single evening, from ad-hoc fixes to a clear system: a password manager, two-factor authentication, and backup codes.
We won't name specific apps: the choice depends on your devices, and there are solid free and paid options on the market. What matters more is understanding the principles and setting things up correctly.
Where to start: mapping your most important accounts
Don't try to secure everything at once. Start with the accounts that can grant access to everything else, or to money. If an attacker takes over your main email, they can use the “forgot password” option to reset passwords on almost every service linked to it.
| Priority | Account | Why it matters |
|---|---|---|
| 1 | Primary email | Used to recover access to other services |
| 2 | Banking apps | Direct access to money |
| 3 | Gosuslugi | Personal data, documents, the ability to request services in your name |
| 4 | Phone account (smartphone cloud) | Photos, contacts, backups, device tracking |
| 5 | Messaging apps | Scammers message relatives through a hacked account and ask for money |
| 6 | Marketplaces and services with a saved card | Purchases on your dime |
| 7 | Social media | Reputation and access to private messages |
Sit down together and make a list like this for every family member. For a teenager, messaging apps and gaming accounts will top the list; for older parents, it'll be Gosuslugi and the bank. That's your plan for the evening.
While you're at it, check which emails and phone numbers these accounts are registered to. It often turns out a parent's bank account is linked to an old number nobody uses anymore, or a kid's Gosuslugi account is tied to an email whose password no one remembers. Fix these “dangling” links first: they're exactly what turns a simple lost phone into weeks of recovering access.
Password manager: one strong password instead of a hundred weak ones
The main cause of hacks is reused or simple passwords. When one site's database leaks, attackers try that same login-password pair on email, banking, and social media. A password manager solves this: it generates a long, unique password for every service and fills it in for you. You only need to remember one, the master password.
How to choose and set it up
- Family plan or shared vaults. It's convenient when everyone has their own private vault plus a shared folder for passwords to the router, home internet, and utility services.
- On-device encryption. Data should be encrypted before it's sent to the server, so even the company that makes the app can't see your passwords.
- Works on all the family's devices: phones, computers, browsers.
- Emergency access. A feature that lets a trusted person access the vault if something happens to you.
It's best to make the master password a phrase of four or five random words: easy to remember, hard to guess. Never use it anywhere else. It's fine to write the phrase on paper and keep it somewhere secure at home: stealing a piece of paper from your closet is far harder than guessing a password over the internet.
Shared family passwords
Every household has passwords several people need: Wi-Fi, the provider's account, a streaming service, the management company, a kid's school platform. Put them in a shared folder in the manager, and the “what's our password for…” question disappears. If a family member stops using a shared service, you can revoke their access to the folder with one click, without changing the password for everyone else.
Families get hacked not through the most careful person, but through the most trusting one. That's why you need to protect everyone at once, starting with the email that everything else is tied to.
Two-factor authentication: a second lock on the door
Two-factor authentication, or 2FA, requires not just a password but a second confirmation when you log in. Even if the password leaks, there's no getting in without the second factor. The methods vary in how reliable they are.
| Method | Security | Convenience | Comment |
|---|---|---|---|
| SMS code | Low-medium | High | Vulnerable to SIM swaps and interception, but better than nothing |
| Authenticator app | High | High | Codes are generated on the phone with no network needed |
| Push confirmation | High | Very high | Risky if you tap “yes” without looking |
| Passkey | Very high | High | Sign in with a fingerprint or face, resistant to phishing |
| Hardware key | Very high | Medium | Requires a physical device, good for your most important accounts |
For email and your phone's cloud account, turn on an authenticator app or passkeys, if the service supports them. For banks, use whatever the bank itself offers. If a service only supports SMS, turn that on at least: even that second factor blocks most mass attacks.
Protect the phone number itself
Since many services send codes by SMS, the phone number itself is worth protecting too. Mobile carriers usually let you set a code word or block SIM reissuance by proxy without the owner present in person. This closes off a popular scam where fraudsters get a duplicate SIM card and, with it, all the SMS codes. Check with your carrier what protection options it offers, and turn them on for every number in the family, especially for parents.
Backup codes: what to do if you lose your phone
The most common headache with two-factor authentication: a lost or broken phone that had the authenticator on it. Without a fallback, you can lose access to your email for good. That's why, when you turn on 2FA, services offer to save backup codes, one-time combinations for emergency sign-in.
- Save the backup codes for every important account in your password manager.
- Print a copy of the codes for your main email and password manager and keep them with your documents.
- Turn on cloud sync in the authenticator app, or add a second device.
- Check that every account has an up-to-date phone number and backup email on file.
- Once a year, check that the codes are still there and that you remember how to use them.
Rules for kids and older parents
Technical measures only work if the whole family understands a few simple rules. The most vulnerable people here are usually kids, who happily install games from sketchy sites, and older parents, who get calls “from the bank” or “from the police.”
- Never share codes from SMS or push notifications with anyone, even if the caller claims to be “from the bank,” “from support,” or “from the boss.”
- If someone asks for money over a messaging app claiming to be a relative, call that relative back through a regular line.
- Don't click links in unexpected messages: go to the site or app on your own.
- Only install apps from official app stores.
- Agree on a family code word that only your own people know: it can be asked for if someone calls from an unknown number asking for urgent help.
With older relatives, it's worth running a one-time “drill”: act out a scam call and show them how to respond correctly. Make a large-print cheat sheet with three rules and a number to call you on if something feels off. Explain to kids why they shouldn't give their game password to even their best friend.
A regular check-up: 30 minutes every six months
Security isn't a one-time setup. Every six months, set aside half an hour: look at the password manager's report on weak and reused passwords, check the list of devices connected to your email and cloud, and update the operating systems and apps on every device in the family. If someone in the family changes their phone number, update it in the main accounts right away, rather than waiting for the first login problem.
An evening like this costs nothing and requires no special knowledge. But the next time someone close to you gets a call “from the bank's security department,” the family will have not just a password, but an understanding of what to do.
FAQ
Is it safe to keep all your passwords in one app?
With a strong master password and two-factor authentication turned on, it's significantly safer than reusing passwords or keeping a notebook of passwords on your desk. The vault is encrypted, and without the master password its contents are useless.
What should you do if an account has already been hacked?
Try to recover access right away through the service's official form, change the password, and sign out of all sessions. If it's a bank, call the number on the back of your card and block it. Warn your family and friends that scammers may message them pretending to be you.
Should you turn on two-factor authentication for every service?
Yes, definitely for email, banks, Gosuslugi, your phone's cloud account, and messaging apps. For other services it's a good idea too, especially anywhere with a saved bank card or private messages.
This article is for informational purposes only and does not replace professional advice. Prices are approximate and current as of the review date. Found an error? Let the editors know via the contact page.
