Is one weekend enough to finish every step here?

Most of it, yes. The password and two-factor phases usually take a few hours; email hardening and device checks take the rest. Spread it across two days if the account list is long — nothing here is time-sensitive except acting fast on any breach the first step finds.

What if some accounts still only offer SMS for two-factor authentication?

Use it anyway — SMS-based two-factor is weaker than an app but still far better than a password alone. Set a carrier PIN so a SIM-swap attempt cannot silently take over that phone number, and switch to an app-based code the moment the account supports it.

Which password manager is the right choice?

Any manager that syncs across phone, computer and browser and generates unique passwords works. Bitwarden and 1Password are common picks; the password manager built into a browser or phone OS is an acceptable start if switching later feels like too much.

Is it safe to store the recovery plan and backup codes on paper?

Yes, provided the paper is kept somewhere physically secure and reachable without the primary device — with a passport or other important documents, for example, not taped to the laptop it is meant to replace.

EN2 versionsRepeats Yearly

Lock down your digital life in a weekend

Every important account protected by a strong unique password and two-factor auth, backups running, your key accounts hardened against recovery attacks, and a written plan for the day a device is lost.

Fby Finito HQEchipa Finito

Created 3 months agoUpdated 15 hours ago

Free preview: 4 of 25 steps

Work through them in the real run view, exactly as a buyer does. No account, no payment, nothing saved.

Try it free

Free

3 free unlocks per month — yours to keep forever

Refined across 2 versionsUpdated Oct 2026

Start for free

Try 4 of 25 steps free

No account needed — nothing is saved.

Included with every copy

Your own copy — keep it forever
Gets better over time — free updates included
Run it on web and mobile
Invite a partner to go through it with you — you share the same progress
Make it your own — a private copy you can edit to fit your situation
3 knowledge checks to test what you've learned
The playbook's community — ask questions, get additions, and see how other buyers improve it, right on the step

Save

Who it's for

Anyone who reuses passwords across sites, has never turned on two-factor authentication, has no backup of their phone or computer, and would not know what to do first if their email or phone were compromised today.

About this playbook

A practical, no-jargon security build for a normal weekend: install a password manager and put every critical account on a unique password, switch on app-based two-factor authentication with saved recovery codes, lock down your primary email and its recovery paths, encrypt and lock your devices, get automatic backups running and prove they work, then write a short recovery plan for the day a phone or laptop is lost or stolen. Ordered so the highest-damage risks — a compromised email, a reused password, a backup that doesn't exist — get fixed first.

What you'll do, step by stepFree preview

7 phases · 25 steps

Only a sample is open: 4 of 25 steps can be read in full. The rest unlock when you buy.

Phase 1: Take stock and plan the weekend
3 steps
Phase 2: Get a password manager and unique passwords
5 steps
Phase 3: Turn on two-factor authentication
3 steps
Phase 4: Lock down email and recovery paths
6 steps
Phase 5: Secure your devices
3 steps
Phase 6: Get backups running and prove they work
2 steps
Phase 7: Write your lost-device recovery plan
3 steps

Try 4 of 25 steps free

Unlock all 25 stepsFree

Details

Estimated duration18 hours 45 min

Steps25

Estimated budget0–60 USD (a paid password manager or extra cloud backup storage is optional)

What you need first

A smartphone and a computer you use regularly, access to your email accounts and your mobile carrier account online or by phone, and roughly 6-10 hours of focused time across a weekend. No technical background required.

Common questions

Glossary

Two-factor authentication: A second proof of identity beyond a password — a code from an app, a hardware key or a text message — required to log in.
Password manager: An app that generates, stores and auto-fills a unique strong password per site, unlocked by one master password.
Master password: The single password that unlocks a password manager. It is never stored anywhere and cannot be recovered if lost, so it must be memorable or written down somewhere safe.
Full-disk encryption: Scrambles everything stored on a device so it is unreadable without the login password, even if the drive is removed. FileVault on Mac, BitLocker or Device Encryption on Windows.
3-2-1 backup rule: Keep at least 3 copies of important data, on 2 different types of media, with at least 1 copy stored somewhere other than the original device.
SIM swap: An attacker convinces a mobile carrier to move your phone number to their SIM card, letting them intercept SMS codes and calls meant for you.
Recovery codes: One-time-use backup codes generated when 2FA is enabled, used to log in if the authenticator app or device is lost.
Data breach: An incident where a service's user data — often including emails and passwords — is stolen and later leaked or sold.