Start with the password manager
The problem is not that your passwords are weak. It is that they are shared. One breached forum from years ago hands an attacker a password you still use, and credential stuffing does the rest automatically, at scale, against every service worth trying.
A password manager fixes this properly: one strong password you memorise, and a unique generated password for everything else that you never see or type. Any reputable manager is a vast improvement over reuse, and arguing about which is best is a good way to spend a year doing nothing.
- Make the master password long rather than complicated. A phrase of several unrelated words you can actually recall beats a short string of symbols you will forget.
- Protect the manager itself with your strongest second factor. It is now the most valuable account you own.
- Do not put your seed phrase in it. Covered in seed phrase security, and worth repeating here.
- Store recovery codes for your accounts in it, which is exactly what it is for.
The second factor, ranked
Not all two factor authentication is equal, and the gap between the top and bottom of this list is enormous.
Best: passkeys and hardware security keys
Both use the same underlying idea. Your device or key holds a private key and proves your identity to the genuine site by signing a challenge. Critically, the exchange is bound to the exact domain that created it, so a convincing fake page simply cannot obtain a valid response.
That is the property nothing else on this list has. A perfect replica of your exchange's login page, served over a real time proxy, defeats passwords, defeats SMS codes and defeats authenticator apps. It does not defeat a passkey or a hardware key, because the browser will not hand over a signature to the wrong domain.
Use one of these on your primary email, your password manager, and every exchange account. If you buy a physical key, buy two and register both, keeping the spare somewhere safe. Losing your only key is a self-inflicted lockout.
Good: an authenticator app
Time based codes generated on your device, with no dependence on your phone number and therefore no exposure to SIM swapping. Universally supported, free, and the sensible default for every account that does not offer something stronger.
Its limitation is honest: you can still be persuaded to read a code aloud, or type it into a convincing fake page. It stops interception, not deception.
When you set one up, save the recovery codes the service gives you. People lock themselves out of accounts by replacing a phone without thinking, and those codes are the way back in.
Last resort: SMS
Better than nothing, and genuinely effective against bulk automated attacks. Useless against the targeted attack this site is concerned with, because the entire method rests on your SIM.
Where a service offers nothing better, use it, and remove your phone number as a recovery option anywhere a stronger method already exists.
Primary email first, then your password manager, then anything holding money. Those three, secured with the strongest factor each supports, remove most of the remote attack surface against an individual. The rest can migrate gradually.
What none of this fixes
Authentication protects the account. It does nothing about a transaction you approve yourself because a convincing person asked you to, which is why phishing is a separate discipline. It also does nothing for Bitcoin held in self-custody, where there is no account and no login, only the keys.