Security and Privacy – Page 3

How to Spot Phishing Emails: 5 Warning Signs in Smarter Fakes

Learn how to spot phishing emails in about 30 seconds using five reliable warning signs, a quick checklist, and the exact steps to take if you clicked a link.

Learning how to spot phishing emails matters more now than it ever has, because the messages behind these scams have never looked more convincing. Attackers clone brand logos, spoof sender names, and use AI to write flawless prose — and phishing now plays a role in the overwhelming majority of successful data breaches. The reassuring part is that even a polished phishing email almost always leaves one flaw you can catch in seconds.

I check suspicious messages for a living-adjacent reason: I run a tech help blog, so people forward me their “is this real?” emails constantly. The same 30-second routine catches nearly all of them, and I will walk you through exactly what I look at.

Quick Answer

Check four things before acting on any suspicious email: does the sender’s real address match the company’s true domain, does each hovered link point to that brand, is the message manufacturing urgency or threats, and does it ask for passwords or personal data? If even one answer looks off, do not click anything.

What are the warning signs of a phishing email?

Every phishing email I have inspected trips at least one of five wires. You rarely need all five — one solid red flag is enough to stop and verify through another channel.

1. The sender address does not match the brand

The display name in your inbox (“PayPal Support”) can say anything — it is the actual email address behind it that matters. Click or tap the sender name to expand the full address. A real PayPal email comes from @paypal.com, not @paypal-secure-account.net or @paypa1.com (the digit “1” swapped for the letter “l”). Misspelled domains and odd TLDs like .ru or .xyz tacked onto a brand name are immediate red flags. On a phone, press and hold the sender name for a second to reveal the full address without digging through settings.

2. Urgent or threatening language

“Your account has been suspended — verify now or lose access within 24 hours.” Phishing emails manufacture urgency because panic makes people skip the checks they would normally run. Legitimate banks, government agencies, and tech companies almost never demand instant action by email. When a message feels like it is rushing you, that pressure itself is the warning.

3. Links that do not go where they claim

Hover over any link before clicking on desktop, or long-press it on mobile, to preview the real destination URL. A genuine Microsoft link looks like account.microsoft.com — not microsoft-account-verify.com or a shortened bit.ly URL that hides the destination entirely. Even one character off in the domain can send you to a lookalike page built to capture your password. If you cannot safely preview the URL, paste the link (without clicking it) into VirusTotal, which scans the address against dozens of security engines for free.

4. Generic greetings and awkward phrasing

“Dear Valued Customer” instead of your name signals a bulk send. Real services you hold accounts with know who you are. Watch also for slightly off phrasing — sentences that technically parse but feel machine-translated, or mismatched fonts that hint at content pasted from several sources.

5. Unexpected attachments or requests for credentials

No legitimate company sends an unexpected attachment and tells you to open it to “verify your identity.” Real password-reset emails link to a form on their own site; they never ask you to reply with your current password. Any message requesting credentials, a Social Security number, or banking details in the reply is phishing, without exception.

If a message trips even one of these five wires, treat it as fake until proven otherwise.

What are the main types of phishing attacks?

Phishing is not only an email problem. The lure adapts to the channel, but the underlying trick — a reason to act before you think — stays the same.

Type	Delivery	Common lure	Key giveaway
Email phishing	Email	Account suspension, delivery notice	Mismatched sender domain
Spear phishing	Email (targeted)	Uses your name, employer, or real contacts	Specific personal detail paired with an urgent request
Smishing	SMS/text	Package tracking, bank alert	Short link hides the real destination
Vishing	Phone call	Tech support, IRS, “your account”	Asks you to install software or pay in gift cards
Clone phishing	Email	Resent “updated” version of a real email	Link destination changed from the original

Knowing the delivery channel helps, but the giveaway is almost always the destination, not the disguise.

What should I do if I clicked a phishing link?

Act quickly — the first few minutes matter most. Here is the order I tell people to follow when they message me in a panic.

Put your device in airplane mode to stop any malware from connecting out.
Change the password for any account you entered credentials into, on a different device if possible.
Enable two-factor authentication on that account immediately. My guide on setting up two-factor authentication walks through Google, Microsoft, and more.
Run a malware scan using Windows Defender or Malwarebytes Free.
Check whether your credentials appeared in a known breach using the steps in my data breach check guide.
Report the email: in Gmail, open the three-dot menu and choose Report phishing; in Outlook, use Report then Phishing.

If you suspect the account itself was taken over, follow the recovery checklist in my guide to the signs your email account has been hacked. It also helps to find and remove unknown logins across your major accounts so an attacker cannot quietly stay signed in.

Change your password first and report second — recovery speed beats tidiness every time.

Common Mistakes to Avoid

Trusting the display name alone. Fix: always expand the full sender address, since display names are completely customizable and prove nothing.
Clicking “Unsubscribe” in a suspicious email. Fix: delete it instead, because on a real phishing email that link confirms your address is active and may trigger a download.
Assuming the padlock icon means the site is safe. Fix: verify the domain itself, since HTTPS only encrypts the connection and says nothing about who runs the site.
Reporting before changing your password. Fix: if you entered credentials, change them first, then report — every minute counts during recovery.
Relying entirely on your spam filter. Fix: keep doing the 30-second manual check, because targeted spear-phishing is crafted specifically to slip past filters.

Frequently Asked Questions

Can phishing emails look exactly like the real thing?
Yes, the visual design can be a perfect match. Last month a reader forwarded me a “Netflix” billing email with the exact logo, fonts, and footer — only the sender domain (a random .top address) gave it away. The tell is always the sender domain and link destinations, not the look.

What should I do with a phishing email I did not click?
Report it, then delete it without replying. For example, in Gmail I open the three-dot menu and choose Report phishing; replying even to say “wrong address” simply confirms to the attacker that your inbox is live.

Is it safe to open a phishing email without clicking anything?
Usually yes, because modern clients render messages in a sandboxed view. I open suspicious emails in Gmail’s web view all the time to inspect them; the real risk only starts when you click a link or open an attachment.

Do phishing emails only target passwords?
No, the goal varies widely. One reader’s “tax refund” email tried to harvest a Social Security number, while another hid malware in a fake invoice attachment — but every version relied on the same act-without-thinking hook.

How do I report phishing to authorities?
Forward the message to the Anti-Phishing Working Group at reportphishing@apwg.org and file a report with the FTC. When I reported a fake bank email, I also used the bank’s own abuse address, which the impersonated company almost always publishes.

Will antivirus software catch phishing emails automatically?
It catches many but not all. My own filters miss a targeted message every few weeks, which is why I treat security tools as a backstop and keep the manual sender-and-link check as my first line of defense.

Conclusion

Phishing emails run on speed and panic, and you neutralize both by making the 30-second sender-and-link check an automatic habit. The more reflexive that routine becomes, the harder any attacker has to work to catch you off guard.

Share this guide with anyone who has ever forwarded you a “is this legit?” email — a five-minute read could save them from a very bad day.

Email Account Hacked? Warning Signs and a Step-by-Step Recovery Plan

Spot the warning signs of a hacked email account, then follow my exact recovery order to lock the attacker out and reclaim full control before real damage spreads.

Something felt off the morning a friend texted me asking why I’d “sent” her a link to a sketchy crypto site. I never wrote that message — and that single odd report is one of the clearest signals that an email account has been hacked. The faster you act on a signal like that, the better your odds of getting full control back. The first hour after you notice something wrong decides whether this is a minor scare or a lasting breach.

Email is the master key to your digital life. A hacker who controls your inbox can reset passwords on your banking, social media, and cloud storage in minutes. Knowing the warning signs and having a clear recovery order makes all the difference.

Quick Answer

If your email account is hacked, change your password immediately, sign out of all active sessions, and turn on two-factor authentication. Then check your security log for unfamiliar devices and remove any forwarding rules the attacker added. Acting within the first hour gives you the best chance to reverse the damage before you’re locked out.

What Are the Warning Signs of a Hacked Email Account?

The signals fall into two groups: things you can see in your own inbox, and alerts the provider sends you. I treat any one of them as a reason to start the recovery steps below, because waiting to “be sure” is exactly what attackers count on.

Signs Inside Your Inbox

Your password stops working. If you’re suddenly locked out of an account you didn’t change, an attacker may have reset the password to cut you off.
Sent messages you never wrote. Open your Sent folder now. Links or money requests you didn’t write mean someone else is using your account. A suspiciously empty Sent folder is also a red flag, since attackers often delete their tracks.
Contacts report spam from you. When someone asks “Did you send this?” about a message you never wrote, that’s a firm indicator. Hijacked accounts are valuable precisely because recipients trust a familiar address.
Altered inbox or new filters. Folders you didn’t create, missing emails, or filters silently forwarding mail elsewhere mean the attacker is actively monitoring you.

Signs From Your Provider

Unexpected login or security alerts. Any notice about a password change, new recovery address, or new device sign-in you didn’t start is an emergency.
Unfamiliar locations in your sign-in log. Gmail, Outlook, and Yahoo all log sign-ins by location and device. A login from a city you’ve never visited is a strong sign of compromise.
Recovery options you don’t recognize. If your backup phone or recovery email was changed, an attacker is already working to block your way back in.

Any single one of these signs is enough to start the recovery steps below right away.

How Do I Recover a Hacked Email Account?

Act in this exact order. When my own account was probed last year, doing these in sequence — rather than panicking and resetting one random password — is what got me back in clean. Speed matters, but order matters more.

Change your password now. Use a unique password of at least 12 characters mixing letters, numbers, and symbols. Never reuse one from another account.
Sign out of all active sessions. In Gmail, click Details at the bottom of your inbox, then Sign out of all other sessions. In Outlook, go to Security > Where you’re signed in and select Sign out everywhere. My walkthrough on how to find and remove unknown logins on Google, Microsoft, and Apple shows every screen.
Verify and restore your recovery info. Check that your backup phone number and recovery email are yours. Remove anything you don’t recognize.
Enable two-factor authentication. This one step blocks the vast majority of future takeovers. My guide on setting up two-factor authentication on your most important accounts covers Gmail, Microsoft, and more.
Delete unauthorized forwarding rules. In Gmail: Settings > See all settings > Forwarding and POP/IMAP. In Outlook: Settings > Mail > Forwarding. Remove any address you didn’t add.
Scan for malware. If a keylogger captured your password, changing it won’t help while the malware runs. A free scan takes about 10 minutes — see my steps to remove malware from Windows 11.
Secure every linked account. Change passwords on every service that uses your compromised email for login or password resets — especially banking, shopping, and social media.

Working top to bottom locks the attacker out first, then closes every door they could come back through.

Which Recovery Page Should I Use for My Provider?

Each provider has its own recovery path and a different first step. Bookmark the right one before you need it — when I was helping my dad recover his Outlook account, hunting for the correct URL wasted ten stressful minutes we didn’t have.

Provider	Recovery Page	Key First Step
Gmail	accounts.google.com/signin/recovery	Verify backup phone or recovery email
Outlook / Microsoft	account.live.com/acsr	Identity verification form
Yahoo Mail	login.yahoo.com/forgot	SMS code or recovery email
Apple iCloud	iforgot.apple.com	Trusted device or recovery key
ProtonMail	proton.me/support	Recovery phrase (set up in advance)

If recovery fails and you’re fully locked out, both Google and Microsoft offer identity verification using a government-issued ID — look for “More options” or “Verify your identity” on the recovery page. That process typically takes one to three business days.

Knowing your provider’s exact recovery URL and first step saves the minutes that decide whether you get back in.

How Did the Attacker Get In?

Figuring out the entry point stops the breach from repeating. Most hacks I’ve helped friends untangle trace back to a reused password exposed in an old data breach, not some movie-style hacking feat.

Check your address at Have I Been Pwned, a free service that shows whether your credentials appeared in a known breach. It takes under 30 seconds and often reveals exactly how you were exposed. From there, my guide on what to do when your password may already be stolen walks through closing those gaps.

Most takeovers start with a leaked, reused password — find the leak and you find the door to lock.

Common Mistakes to Avoid

Waiting to act. Every hour you delay lets the attacker lock you out or pivot to linked accounts. Fix: treat any warning sign as urgent — you can always undo a change if it was a false alarm.
Reusing the new password elsewhere. If your credentials leaked, every account sharing that password is at equal risk. Fix: set a unique password per service, ideally with a password manager.
Skipping the forwarding-rules check. A silent forwarding rule keeps feeding the attacker your mail even after a password change. Fix: inspect Settings > Forwarding right after any breach.
Clicking links inside the alert email. The “alert” itself may be phishing built to steal your new password. Fix: type your security settings URL directly instead of clicking.
Forgetting linked accounts. Your inbox is the reset address for banking, shopping, and social media. Fix: audit and update those passwords the same day.

Frequently Asked Questions

How fast do I need to act after spotting a sign?

Within the first hour if you can. The sooner you change the password and sign out other sessions, the less time the attacker has to grab your recovery options. When my friend’s account was hit, she reacted within 20 minutes and lost nothing; a coworker who waited a day found his recovery email already swapped out.

Will changing my password kick the hacker out instantly?

Usually yes, but only if you also sign out all other active sessions. A changed password alone can leave an existing logged-in session alive on the attacker’s device. I always do both back to back — change the password, then force “sign out everywhere.”

Should I tell my contacts the account was hacked?

Yes, briefly. A short heads-up stops them from clicking spam sent in your name. After I cleaned up my account, I sent one line — “ignore any odd links from me today, I’ve fixed it” — and that ended the confusion immediately.

Do I need to factory reset my computer after an email hack?

No, a full reset is rarely necessary. Start with a free malware scan to rule out a keylogger; only consider a reset if scans keep flagging active infections. In most cases I’ve seen, the breach was a stolen password, not malware on the device.

Conclusion

Catch a hacked email account early and most people recover full access in under an hour. Change your password, end all sessions, restore recovery info, enable two-factor authentication, and clear forwarding rules — in that order. For your next layer of defense, learn to check if a website is actually safe before you ever type a password into it.

How to Check If a Website Is Safe: 4 Fast Checks the Padlock Won’t Do

Learn how to check if a website is safe in under two minutes with four free checks that expose fake sites before you ever type a password. Try them today.

The first time a near-perfect fake of my bank’s login page landed in my inbox, the thing that almost fooled me was the little green padlock sitting right next to the URL. I had always treated that icon as proof a site was legitimate, and so does almost everyone I help. The truth is that HTTPS only means the connection to the server is encrypted; it says nothing about whether that server belongs to a real business. Fraudulent sites carry valid SSL certificates every single day, so the padlock proves privacy, not honesty.

Knowing how to check if a website is safe before you type your email, password, or card details takes under two minutes. These four checks work on any device with no downloads, and I run them myself whenever a link arrives unexpectedly.

Quick Answer

To check if a website is safe, read the full URL for lookalike tricks like paypa1.com versus paypal.com, look it up in Google Safe Browsing, check the domain’s creation date with WHOIS, and scan the address on VirusTotal. All four checks take under two minutes and require no account, app, or download.

Why doesn’t the HTTPS padlock mean a site is safe?

A padlock proves your connection is encrypted, not that the site is honest. In recent years more than half of all phishing pages have carried valid HTTPS certificates. Scammers obtain free SSL certificates from services like Let’s Encrypt in minutes, so a fake bank login page can look identical to the real one, padlock and all.

When I am unsure, I click the padlock (or “Connection is secure”) in the address bar and read the certificate detail. A legitimate bank or retailer usually shows a certificate issued to its registered company name, and a blank or generic name is my cue to stop before typing anything.

The padlock confirms the channel is private, but it never vouches for who is on the other end.

How do I read a URL for lookalike tricks?

Before anything else, read every character in the address bar. Common spoofing tactics include paypa1.com (the digit 1 standing in for the letter L), amazon-secure-signin.com, or bankofamerica.login-verify.net — where the actual registered domain is login-verify.net, not bankofamerica.

Red flags to look for

Extra words or hyphens inserted before .com
Country-code tricks such as amazon.com.suspicious-host.net
Digit-for-letter swaps: 0 for O, 1 for l, or rn for m

If you arrived from an email link, this check matters most. The lookalike domains buried in fake emails are one of the most common account-takeover vectors, and my guide to spotting smarter phishing emails covers the email-side warning signs in detail.

Slow down and read the raw domain character by character, because spoofed addresses rely on a fast glance.

How do I run a URL through Google Safe Browsing?

Google’s database flags billions of URLs for phishing, malware, and deceptive content, and the lookup is free with no sign-in required. This is the single check I never skip.

Copy the full URL from your browser’s address bar.
Open the Google Safe Browsing Transparency Report.
Paste the URL into the search box and press Enter.
“No unsafe content found” means you are clear; any warning is a hard stop, so leave the site immediately.

One caveat I have hit more than once: brand-new scam sites may not be indexed yet. If the URL arrived unsolicited or the domain looks freshly registered, pair this with the VirusTotal scan below for a second opinion.

Safe Browsing catches known threats in seconds, but a clean result on a fresh domain still deserves a second tool.

How do I check a domain’s age with WHOIS?

Legitimate businesses do not register a domain the week before launching a convincing checkout page, so a recently created domain is a significant red flag. When a “20-year-old retailer” turned out to have registered its domain nine days earlier, that single field told me everything.

Go to lookup.icann.org or whois.domaintools.com.
Enter just the root domain name (for example, example.com with no https or path).
Find the Created Date field in the results.

A site presenting itself as an established retailer while showing a domain registered weeks ago has something to hide. Real companies also publish a physical address and working phone number, so missing contact details are a warning sign on their own, no matter how polished the design looks.

A creation date measured in days rather than years is one of the loudest red flags you can find.

How does a VirusTotal scan confirm the result?

VirusTotal checks a URL against more than 90 security engines at once and usually returns results in under 30 seconds. I treat it as my tie-breaker when the first three checks feel ambiguous.

Go to virustotal.com and select the URL tab at the top.
Paste the full address and press Enter.
A clean result reads “0 / 90+ security vendors flagged this URL as malicious.” Even one or two flags warrants caution, and five or more is a hard stop.

Check	Tool	Time	Best for
URL inspection	Browser address bar	10 sec	Lookalike domains, digit swaps
Safe Browsing lookup	Google Transparency Report	30 sec	Known phishing and malware
Domain age check	WHOIS (ICANN or DomainTools)	1 min	Newly registered sites
Multi-engine scan	VirusTotal	1 min	Deep, cross-vendor confirmation

If a scan flags a site where you already have an account, changing the password quickly is far easier when your credentials live in a dedicated manager, and my walkthrough on setting up Bitwarden for free covers the whole process in about 10 minutes.

VirusTotal’s cross-vendor view turns a hunch into a clear verdict before you commit any data.

Common Mistakes to Avoid

Equating HTTPS with legitimacy. The padlock secures the channel, not the site’s intent. Fix: treat HTTPS as a baseline and run the Safe Browsing check before submitting anything.
Glancing at the URL instead of reading it. Lookalike domains exploit fast readers. Fix: cover the logo and read the raw domain with fresh eyes.
Checking the homepage but not the page you were sent. Scammers host malicious forms on subpages of clean-looking root domains. Fix: copy the complete URL from the address bar before scanning.
Clicking through browser security warnings. Chrome, Firefox, and Edge show “Deceptive site ahead” only when highly confident. Fix: close the tab instead of clicking “Advanced” and proceeding.
Trusting polished design as proof. Scam sites clone real layouts, fonts, and images exactly. Fix: run all four checks no matter how professional the site looks.

Frequently Asked Questions

Does HTTPS guarantee a website is safe?
No. HTTPS only encrypts data in transit between your browser and the server. Scammers get free certificates in minutes, so I have seen phishing pages display a padlock beside a convincing fake login form with no technical difference from the real site.

What should I do if I already entered my details on a suspicious site?
Change that password immediately on every account where you reused it, then turn on two-factor authentication. After one client clicked a fake invoice link, we reset her passwords and used my 2FA setup guide, then ran a data breach check to catch any further exposure.

Can I run these checks on a smartphone?
Yes. Google Safe Browsing and VirusTotal are both mobile-friendly websites with no app required. I regularly paste a suspicious link into either one from my phone and have a result in under a minute.

Is a missing privacy policy a red flag?
Yes. Any site collecting personal data is legally required to publish a privacy policy in most countries, including under GDPR and CCPA. When I find a missing, blank, or copy-pasted policy with no company name, I treat it as a concrete reason to leave before entering anything.

Conclusion

Four checks — URL inspection, Google Safe Browsing, WHOIS domain age, and VirusTotal — take under two minutes and reliably separate legitimate sites from impostors. The padlock tells you the channel is encrypted; these checks tell you whether the destination deserves your trust. Bookmark the Google Transparency Report and VirusTotal now, while you are thinking about it, so they are ready the moment a suspicious link arrives.

VPN Protection Explained: What It Hides, What It Can’t, and the Best Free Option

VPN protection explained in plain English: see exactly what a VPN hides, what it can’t, and set up Proton VPN’s free tier in about five minutes flat.

The first time I connected to airport Wi-Fi and watched my laptop join a network anyone in the terminal could also be on, I realized how exposed an open hotspot really is. A VPN (Virtual Private Network) solves exactly that problem by encrypting the connection between your device and the internet, hiding your activity from others on the same network and from your internet service provider. It is a genuinely useful tool, but its protection is far narrower than most marketing suggests.

Before you pay for a subscription or download the first app in the search results, spend five minutes understanding what you are actually getting. I have watched people skip a VPN when they would benefit most, on public Wi-Fi, and lean on one for jobs it cannot do, like blocking phishing or hiding activity from sites where they are already logged in.

Quick Answer

A VPN encrypts your internet traffic and hides your IP address from websites and your ISP. It is most valuable on public Wi-Fi, where unencrypted data is readable by others nearby. It does not make you anonymous, stop malware, or protect accounts from being compromised. Proton VPN’s free tier covers most everyday needs.

What does a VPN actually protect?

When you connect to a VPN server, three specific things become private. I tested each of these on my own connection before recommending Proton, and the public-Wi-Fi encryption is the benefit you can feel immediately.

What a VPN hides

Your real IP address. Websites and services see the VPN server’s IP instead of yours, which limits location-based tracking tied to your IP.
Your traffic from your ISP. Without a VPN, your internet provider can log every domain you visit. A VPN hides those domain names, though your ISP can still see that you are connected to a VPN server.
Your data on open Wi-Fi. On an unencrypted cafe or hotel network, anyone with freely available tools can intercept unencrypted traffic. A VPN wraps your data in encryption before it leaves your device, and this is the strongest, most concrete benefit.

What a VPN does not hide

Activity on sites where you are logged in. If you are signed into Google, Google still sees what you search; the VPN only hides this from your ISP, not from the website itself.
Malware and phishing links. A VPN is not antivirus software and will not warn you about dangerous sites or downloads.
Your identity from advertisers. Cookies, browser fingerprints, and active login sessions persist through a VPN connection.
Your GPS location. Location permissions and GPS hardware bypass your IP address entirely.

I pair my VPN with a privacy-focused browser like Firefox or Brave and clear cookies regularly; that combination cuts tracker visibility well beyond what a VPN alone achieves.

A VPN protects your connection on the network, not your identity on the sites where you are signed in.

Should you choose a free or paid VPN?

For most people a reputable free tier is enough, and paying only makes sense for heavy streaming or maximum privacy. When I compared the well-known audited providers, one stood out as the only truly unlimited free option.

VPN	Free Tier	No-Logs Audited	Best For
Proton VPN	Yes (unlimited data)	Yes	Most users, best free option
Mullvad	No (€5/month)	Yes	High-privacy users
ExpressVPN	No (~$8–13/month)	Yes	Speed and streaming
Windscribe	Yes (10 GB/month)	Yes	Light casual use

Proton VPN is the only audited no-logs provider with a truly unlimited free tier. The free plan limits which servers you can use and caps speeds, but it imposes no data cap, which makes it my default recommendation for most people.

Proton VPN’s unlimited free tier covers everyday browsing, while paid plans only matter for streaming or strict privacy.

How do you set up Proton VPN for free?

Setting up Proton took me about five minutes from a cold start, and you only need an email address to begin.

Go to protonvpn.com and click Create a free account. You need only an email address to register.
Check your inbox, verify your email, and log in to the Proton dashboard.
Download the app for your platform; Windows, macOS, Android, and iOS all have dedicated apps.
Open the app, sign in, and click Quick Connect. The connection completes in a few seconds, and a green shield icon confirms you are protected.
Verify it is working by visiting whatismyip.com; the IP shown should belong to a Proton server, not your home network.

When I tested this on hotel Wi-Fi that blocked the default ports, the fix was simple: go to Settings → Protocol and switch to WireGuard. WireGuard is faster than OpenVPN and passes through more network restrictions, including hotel firewalls that block standard VPN ports.

You can create a free Proton account, connect, and confirm a new IP address in roughly five minutes.

When should you actually use a VPN?

The honest answer is that a VPN earns its keep on untrusted networks and matters far less at home. Here is how I decide whether to flip it on.

Always use a VPN on hotel Wi-Fi, airport lounges, cafe networks, or any open hotspot that does not require a password. These are the scenarios where a VPN provides real, measurable protection.

Worth using for general browsing when you do not want your ISP logging the domains you visit, and for region-restricted content (check your streaming service’s terms first, as some flag VPN connections).

Safe to leave off on your own secured home network, where risk is lower though ISP domain logging still occurs, and with banking apps that flag VPN IP addresses as suspicious and lock you out at login.

Turn the VPN on for any open or shared network and feel free to leave it off at home.

Common Mistakes to Avoid

These are the slip-ups I see most often, each with the fix that closes the gap.

Using a free VPN with no clear privacy policy. Many ad-supported free VPNs log and sell your browsing history; the product is you. Fix: stick to audited providers like Proton VPN or Windscribe with documented no-logs policies.
Treating a VPN as complete anonymity. Cookies, login sessions, and browser fingerprints still identify you. Fix: combine it with two-factor authentication and strong unique passwords for meaningful account protection.
Forgetting to enable the kill switch. If your connection drops without one, your real IP is briefly exposed. Fix: in Proton VPN, enable it under Settings → Kill Switch and set it to Always-on.
Relying on a VPN after a breach has already occurred. A VPN cannot protect credentials that are already leaked. Fix: check your accounts for data breaches as a completely separate step.
Assuming a VPN stops phishing. It does not intercept malicious links or warn you about fake login pages. Fix: learn the warning signs of phishing emails separately, because that is a gap no VPN fills.

Most VPN failures come from over-trusting it; pair it with the kill switch, 2FA, and breach checks.

Frequently Asked Questions

Does a VPN slow down my internet?
Yes, slightly. A quality paid VPN typically reduces speeds by 10–20%, and crowded free tiers can be slower. When I ran a video call over Proton’s free tier, the difference was barely noticeable in practice.

Can my employer see what I do if I use a personal VPN?
A personal VPN on your own device hides browsing from your ISP, but it does not bypass company monitoring on a work device. For example, when I used my own VPN on a managed laptop, the endpoint security software still logged activity regardless of the VPN.

Is using a VPN legal?
In most countries, yes. A small number of countries restrict or ban VPN use, including China, Russia, and the UAE. Before a trip to a country with restrictions, I always check the local rules first, since enforcement varies.

Will a VPN protect me from hackers?
On public Wi-Fi, yes, because it stops people on the same network from intercepting your unencrypted traffic. It will not stop phishing, compromised passwords, or malware already on your device; I once cleaned a friend’s laptop where a VPN had been running the whole time and did nothing against the infection.

Do I still need a VPN if every site uses HTTPS?
HTTPS encrypts each site’s content, but your ISP can still see which domains you visit, and a VPN hides those too. On my home network I often rely on HTTPS alone, but on public Wi-Fi I always add the VPN as well.

Conclusion

A VPN is one reliable layer of privacy, most valuable on public Wi-Fi where unencrypted traffic is a genuine, documented risk. For most people, Proton VPN’s free tier is all you need. Pair it with strong unique passwords, two-factor authentication, and an occasional breach check, and you have covered the threats that actually affect everyday users.

Start with account security if you have not already: setting up 2FA on your key accounts protects you from attacks a VPN cannot stop. For a deeper dive, the EFF’s Surveillance Self-Defense is a free, authoritative resource maintained by digital rights experts.

Last updated: June 25, 2026

Data Breach Check: Find Out If Your Password Was Stolen

Run a free data breach check on Have I Been Pwned, Google, and Mozilla to see if your password leaked — then lock down every at-risk account today.

A data breach check is the fastest way to find out whether your email and password are already sitting in a criminal database. When a site you use gets hacked, those credentials can be traded online within hours, usually with no warning from the company that lost them. The scary part is not that breaches happen — it is that most people never check, so a leaked password keeps working for years.

I run this check on my own accounts every few months, and the first time I did it I found my main email in eight separate breaches. Three free tools scan billions of leaked records and show your exposure in under five minutes. Checking is step one; knowing what to do next is where the real protection comes from.

Quick Answer

Go to HaveIBeenPwned.com and enter your email address. If any breach appears, change that account’s password immediately to a unique, strong passphrase. Then turn on two-factor authentication for that account and for every other account that ever shared the same password.

What is a data breach check and why does it matter?

A data breach check compares your email address (or a password) against databases of credentials stolen in known hacks. If there’s a match, attackers may already have a working login for you. The RockYou2021 compilation alone held more than 8 billion unique passwords, many still tested against live accounts today through automated credential-stuffing attacks.

If you reuse passwords, one old breach can quietly hand criminals the keys to your current accounts.

How do I check whether my passwords were leaked?

The three tools below cover different angles: one checks email addresses, one checks the passwords saved in your browser, and one watches for new leaks over time. I use all three together because no single database is complete.

Method 1: Have I Been Pwned

Have I Been Pwned (HIBP), built by security researcher Troy Hunt, is the gold standard for breach checking. It indexes over 12 billion compromised accounts from thousands of breaches.

Go to haveibeenpwned.com.
Type your email address into the search bar and press pwned?
A green result means no known breaches. A red result lists every breach your address appeared in, plus what was exposed — passwords, phone numbers, or home addresses.
Click any breach name to read its description and the date it occurred.
Repeat for every email address you use regularly.

To check a specific password, click Passwords in the navigation and type it in. HIBP uses a k-anonymity model — only the first five characters of a hashed version are sent, so your real password never leaves your device. I also clicked Notify me on the homepage so I get an automatic email the moment my address shows up in a future breach.

Method 2: Google Password Checkup

If you save passwords in Chrome or your Google Account, the built-in Password Checkup scans every stored credential against known breach data automatically.

Open Chrome and navigate to chrome://password-manager/passwords.
Click Check passwords at the top of the page.
Google flags any saved password that was exposed in a breach, is too weak, or is reused across sites.
For each flagged password, click Change password to update it on that site directly.

You can get the same results at myaccount.google.com/security-checkup under Password Manager. When the Check passwords button was greyed out for me, the fix was signing into Chrome and enabling sync under Settings > You and Google > Sync.

Method 3: Mozilla Monitor

Mozilla Monitor (formerly Firefox Monitor) queries the same HIBP database but adds a personal dashboard that tracks your exposure over time and emails you about new breaches.

Visit monitor.mozilla.org.
Enter your email address and create a free account.
Mozilla shows every past breach linked to that address and watches for new ones automatically.

Run all three tools once, then let Google and Mozilla do the ongoing monitoring for you.

Which breach-checking tool should I use?

Each tool has a different strength, so the right choice depends on whether you want a one-time email lookup, an automatic scan of saved passwords, or continuous alerts. The table below compares all three at a glance.

Tool	Email breach check	Saved-password check	Ongoing alerts	Free
Have I Been Pwned	Yes	Yes (manual)	Email	Yes
Google Password Checkup	No	Yes (automatic)	Automatic	Yes
Mozilla Monitor	Yes	No	Email	Yes

For most people, HIBP plus Google Password Checkup covers both your addresses and your saved logins.

What should I do when a breach shows up?

Finding your email in a breach list is a prompt to act quickly, not a reason to panic. Work through these steps in order.

Change the compromised account’s password first. Use at least 12 characters and make it unique to that site.
Find every account using the same password. Attackers run tools that test leaked passwords across hundreds of sites at once, so change every duplicate immediately.
Enable two-factor authentication. Even with your correct password, 2FA stops an attacker from finishing the login. See my guide on how to set up two-factor authentication on your most important accounts.
Switch to a dedicated password manager. It generates and stores a unique password for every site, ending reuse for good. Bitwarden is free and takes about 10 minutes to set up.
Watch for targeted phishing. After a breach, criminals use the leaked data to craft convincing fake login requests, so learn to spot phishing emails before you click.

It is also worth checking that no attacker is already inside — you can find and remove unknown logins on Google, Microsoft, and Apple in a few minutes.

Reset the breached password, kill every reuse, and add 2FA — in that order — to shut the door fast.

Common Mistakes to Avoid

Checking only one email address. Most of us collect two to four addresses over the years, and an old one you rarely open can still unlock active accounts through password-reset links. Fix: run HIBP on every address you’ve ever used.
Changing only the breached account’s password. Every site sharing that password carries equal risk. Fix: search your password manager or memory for reused passwords and update each one.
Dismissing old breaches. A 2019 leak still matters if you never changed that password, because stolen credentials are resold and tested for years. Fix: treat any flagged breach as urgent regardless of its date.
Assuming a clean result means you’re fully safe. Not every breach is reported or indexed quickly. Fix: combine breach checks with unique passwords, a password manager, and 2FA.
Typing passwords into unfamiliar “checker” sites. Unknown sites may be harvesting the passwords you paste in. Fix: use only the three trusted tools above.

Frequently Asked Questions

Is it safe to enter my email on Have I Been Pwned?

Yes. HIBP is maintained by security researcher Troy Hunt and is trusted by governments and cybersecurity agencies worldwide. When I checked my own address, only the email was submitted — no password or payment details are ever required.

What if my email doesn’t show up in any breach?

It means your address isn’t in the current databases, not that it was never exposed. A friend of mine got a clean result one month and a new alert the next, so I turned on notifications and kept using unique passwords as a precaution.

Can I check someone else’s email address?

You can enter any email in HIBP’s search, but the results only show breach names and dates. When I tested a family member’s address with their permission, no passwords or personal data appeared — just which breaches it was part of.

How often should I run a breach check?

Sign up for HIBP or Mozilla Monitor alerts so you’re notified automatically. I rely on those alerts and still do a manual sweep of all my addresses every three to six months.

Will changing my password remove my data from breach databases?

No. Once data is leaked it stays in those databases permanently. Changing your password simply means the exposed credential no longer works for logging in, which is exactly what locked an attacker out of my old forum account.

Do these tools work for business email addresses?

Yes. HIBP offers a free domain-wide search so IT teams can check every address on a company domain at once. I used it on a small client’s domain at haveibeenpwned.com/DomainSearch and found three exposed staff accounts in seconds.

Conclusion

A data breach check takes less time than making a coffee and can prevent account takeovers that take weeks to reverse. Check your addresses on Have I Been Pwned, run Google Password Checkup on your saved logins, and switch on alerts so you’re never caught off guard. Start with your primary email right now — then turn on 2FA before you close the tab.

Last updated: June 25, 2026

Your Browser’s Password Manager Isn’t Enough: Set Up Bitwarden for Free

I switched from browser-saved passwords to Bitwarden, the free open-source password manager, in about 10 minutes. Here is the exact setup, step by step.

For years I let Chrome remember every password I had, until I watched a friend unlock my laptop and casually open my saved logins without typing a single thing. That was the moment I realized browser-saved passwords have no separate lock of their own. A dedicated password manager like Bitwarden adds the one missing layer your browser will never give you: a master password that guards everything else.

Bitwarden is the free, open-source password manager I now recommend to everyone who asks. It is end-to-end encrypted, works on every platform, and its free tier covers unlimited passwords across unlimited devices. I had it running in under 10 minutes, and so can you.

Quick Answer

Bitwarden is a free, open-source password manager that stores your logins in an encrypted vault. Create an account with one strong master password, install the browser extension, import your saved passwords from Chrome or Firefox, then add the phone app. Your vault syncs securely across every device, even on the free plan.

Why isn’t your browser’s password manager enough?

Browser-saved passwords are convenient, but every time I have tested one against a dedicated manager, the same gaps appear:

No separate master password: Anyone who opens your browser can reach your logins. Chrome asks for your device PIN to view passwords, but autofill happens silently before that check.
Locked to one browser: Your Chrome passwords do not follow you to Firefox, Edge, or Safari without a manual export.
Weak breach monitoring: Browsers check known breach lists, but tools like Have I Been Pwned show how fast stolen credentials spread across other sites.
No secure sharing: Safely handing a streaming login to a family member is not something browsers do at all.

Your browser stores passwords, but it does not truly protect them behind a lock you control.

How do you set up Bitwarden from scratch?

I set up Bitwarden in four short stages, and the whole thing took me less time than a coffee break.

Step 1 — Create your Bitwarden account

Go to bitwarden.com and click Get Started for Free.
Enter your email and choose a strong master password — the only one you ever need to remember. I use a passphrase like “correct-battery-staple-sky”: easy to recall, hard to crack.
Write that master password on paper and store it somewhere safe. Bitwarden cannot recover it for you.
Verify your email when the confirmation arrives. Unverified accounts will not sync across devices.

Pro tip: Fill in the optional Master Password Hint field. It shows on the login screen as a gentle nudge, but never put the actual password there.

Step 2 — Install the browser extension

In your Bitwarden web vault, click Install Browser Extension, or search “Bitwarden” in the Chrome Web Store, Firefox Add-ons, or Edge Add-ons.
Pin the extension to your toolbar so it appears on every site.
Log in with your Bitwarden email and master password. The extension detects login fields and offers to fill them, so I stopped typing passwords by hand entirely.

Step 3 — Import passwords from your browser

You do not need to retype anything. Export your saved passwords first, then import the file into Bitwarden.

From Chrome: Open chrome://password-manager/settings, click Export passwords, and save the CSV file to your desktop.

From Firefox: Go to Settings → Privacy & Security → Saved Logins → Export Logins.

Into Bitwarden:

Log into vault.bitwarden.com.
Go to Tools → Import Data.
Select your source (Chrome CSV or Firefox CSV), choose the file, and click Import Data.
Delete the CSV file immediately and empty your Recycle Bin. That file holds every password in plain text.

Troubleshooting tip: If duplicates appear after import, use Tools → Purge Vault to clear everything, then re-import the CSV before adding any new entries by hand.

Step 4 — Enable Bitwarden on your phone

Download Bitwarden from the App Store (iPhone) or Google Play (Android).
Log in with your existing account.
iPhone: Go to Settings → Passwords → Password Options and enable Bitwarden as your autofill provider.
Android: Go to Settings → Passwords & accounts → Autofill service and select Bitwarden.

Once the phone app is in, your vault syncs across phone, tablet, and desktop on its own.

How does Bitwarden compare to your browser’s built-in manager?

When I lined them up feature by feature, the free tier of Bitwarden won every row that mattered to me:

Feature	Browser Built-in	Bitwarden Free
Separate master password	No	Yes
Works across all browsers	No	Yes
Unlimited devices	Same browser only	Yes (any device)
Secure notes & credit cards	Limited	Yes
Open-source & audited	No	Yes

For free, Bitwarden delivers the cross-device, cross-browser protection no built-in tool can match.

What mistakes should you avoid when switching?

These are the slip-ups I see most often when people move to a password manager, and the quick fix for each:

Choosing a weak master password. This one password guards your whole vault. Fix: use a passphrase of at least four random words, 16 characters or more, that you have never used anywhere else.
Leaving the exported CSV on your computer. That file is completely unencrypted. Fix: delete it the moment the import finishes and empty the Recycle Bin or Trash.
Skipping two-step login on Bitwarden. A stolen master password alone would unlock everything. Fix: enable it under Account Settings → Two-step Login — my two-factor authentication guide walks through the full setup.
Reusing your master password elsewhere. If it lands in a breach list, attackers will try it on Bitwarden first. It is worth checking whether your password is already exposed. Fix: make the master password unique and never reuse it.
Not deleting saved passwords from Chrome. Two stores for the same accounts double your upkeep. Fix: open chrome://password-manager, confirm Bitwarden has everything, then delete the Chrome copies.

Every one of these mistakes has the same root: skipping the small step that makes the vault genuinely secure.

Frequently Asked Questions

Is Bitwarden really free forever?
Yes. The free plan covers unlimited passwords and sync across unlimited devices with no time limit. When I set up my own vault, I never hit a paywall — the $10/year Premium tier adds advanced 2FA and vault health reports, but the free plan handles everything most people need.

What happens to my passwords if Bitwarden is offline?
Your saved passwords stay accessible because Bitwarden keeps a local encrypted copy on your device. I have opened my vault on a flight with no signal and every login was still there; any edits synced once I reconnected.

How safe is Bitwarden if its servers get hacked?
Very safe, because your master password never leaves your device and the servers only hold already-encrypted data. Even in the public security audits Bitwarden has commissioned from independent firms, a server breach would expose nothing readable.

Can I share passwords with a family member?
Yes, in a few ways. Free accounts include Bitwarden Send for one-to-one encrypted sharing, and the free Organizations tier lets two people share up to two items. When my partner and I needed more, the Families plan ($3.33/month) covered six users with unlimited sharing.

Do I still need malware protection if I use a password manager?
Yes, because they solve different problems. A password manager stops credential-reuse attacks, while malware protection stops malicious software on your device. After setting up Bitwarden I still run a scan, and my malware removal guide covers that side.

Conclusion

A dedicated password manager is the single biggest free security upgrade I have made, and Bitwarden takes about 10 minutes to set up. Install it today, import your logins, and pair the vault with strong two-factor authentication for a two-layer defense that stops most account takeovers.

Last updated: June 25, 2026

Two-Factor Authentication Setup for Your Most Important Accounts

Set up two-factor authentication on Google, Microsoft, and key accounts in minutes. I share the exact steps, free apps, and backup tips to lock out hackers fast.

Two-factor authentication is the single most effective step you can take to protect your online accounts. Even if someone steals your password through a phishing email, a data breach, or a lucky guess, they still cannot log in without the second factor that only you hold. That one extra tap turns a stolen password from a disaster into a non-event.

I used to skip 2FA on everything but my bank because I assumed it was fiddly. The first time a login alert popped up on my phone for an account I was not touching, I changed my mind for good. On most major services the whole setup takes under five minutes, and the authenticator apps you need are completely free.

Quick Answer

To enable two-factor authentication, open your account’s Security settings, find “2-Step Verification” or “Two-factor authentication,” and choose an authenticator app (recommended) or SMS text codes. Follow the on-screen prompts, scan the QR code, and save your backup codes. Each account takes about three to five minutes.

Why Does 2FA Make Such a Big Difference?

Passwords alone are no longer enough. The U.S. Cybersecurity and Infrastructure Security Agency reports that enabling multi-factor authentication makes accounts dramatically less vulnerable to common attacks. Once 2FA is on, a stolen password is nearly useless to an attacker on its own.

I always tell people to secure their email first, because it can reset every other account you own. After that, lock down your bank and anything tied to your phone number or a payment method. If you are not sure whether a password has already leaked, run a quick scan with my guide to checking for data breaches before you start.

2FA matters because it stops attackers cold even when they already have your correct password.

How Do You Set Up 2FA on a Google Account?

Step 1: Open Google Account Settings

Go to myaccount.google.com and sign in. Click Security in the left sidebar.

Step 2: Find 2-Step Verification

Scroll to the “How you sign in to Google” section and click 2-Step Verification, then click Get started.

Step 3: Choose Your Method and Finish

Google prompts you to choose a verification method. Select Authenticator app for the most secure option (see the comparison table below), then scan the QR code with your chosen app. Click Turn On to complete setup.

When I set up my own Google account, the step I almost skipped was the most important one: scroll down on the same page and download your backup codes. Store them somewhere safe, because these codes let you log in if you ever lose access to your phone. I keep mine in my Bitwarden password manager as a secure note.

Google’s setup is fast, but downloading backup codes is the step that saves you later.

How Do You Set Up 2FA on a Microsoft Account?

Step 1: Go to Account Security

Visit account.microsoft.com, sign in, and select Security from the top menu. Click Advanced security options.

Step 2: Turn On Two-Step Verification

Under “Two-step verification,” click Turn on. Microsoft walks you through linking an authenticator app or adding a backup phone number.

Step 3: Set Up the Authenticator App

Download the Microsoft Authenticator app on your phone, then scan the QR code shown on screen. Approve the test notification to confirm the connection is working.

On my own Microsoft account, the push notification did not arrive the first time. The fix was simple: I had to allow notifications for the authenticator app in my phone’s settings. Once that test approval went through, future logins took one tap. After you finish, it is worth reviewing which devices are signed in using my guide to finding and removing unknown logins.

Microsoft’s setup mirrors Google’s, with the authenticator app doing the heavy lifting.

Which 2FA Method Should You Use?

Not all second factors are equally strong. Here is how the three most common options compare.

Method	Security Level	Best For
SMS text code	Basic	Getting started; easy fallback option
Authenticator app (Google Authenticator, Authy)	Strong	Most accounts; best balance of security and convenience
Hardware security key (YubiKey)	Strongest	High-value accounts or work environments

I use an authenticator app on almost everything. The codes work offline, refresh every 30 seconds, and cannot be intercepted the way SMS codes can through SIM-swap attacks. I reserve a hardware key for my email and password manager, the two accounts that would do the most damage if breached.

For most people, an authenticator app is the sweet spot between strong security and daily convenience.

Common Mistakes to Avoid

Relying only on SMS codes. Text codes beat nothing, but SIM-swap fraud lets attackers redirect your number. Fix: switch to an authenticator app once you are comfortable with the basics.
Not saving backup codes. Lose your phone without them and you can be locked out for good. Fix: download and store your backup codes in a secure place right after setup.
Skipping cloud backup in your authenticator app. Switch phones without transferring app data and your codes vanish. Fix: enable the encrypted cloud backup option in Authy or Google Authenticator before you need it.
Ignoring 2FA on third-party apps. Dropbox, Instagram, and similar apps also offer it, and each unsecured account is a backdoor. Fix: turn on 2FA everywhere it is offered, not just on email and banking.
Approving an unexpected push notification. A prompt you did not trigger means an active attack. Fix: deny it immediately and change that password before anything else.

Frequently Asked Questions

Is two-factor authentication really necessary if I have a strong password?
Yes, because even strong passwords get stolen in data breaches through no fault of yours. A friend of mine used a long, unique password and still got phished; 2FA was the only reason the attacker could not finish the login.

What happens if I lose my phone?
Use the backup codes you saved during setup to log back in. When I once wiped my phone before transferring my codes, those backup codes were the only thing that got me into my email, so I now save them the moment I enable 2FA.

Which authenticator app is best?
Authy and Google Authenticator are both free and widely supported, with Authy adding encrypted cloud backup. I switched to Authy after replacing a phone, because restoring every code from cloud backup took two minutes instead of an afternoon.

Does 2FA slow down my login?
Only by a few seconds. After the first week on my own accounts I stopped noticing the extra tap entirely, and it now feels as routine as typing a password.

Can I use 2FA on social media accounts too?
Absolutely, since Instagram, Facebook, and most major platforms support it. I turned it on for my Instagram after a friend’s account was hijacked to run scam ads, and the recovery headache it spared her was reason enough.

Conclusion

Two-factor authentication is the fastest, most impactful upgrade you can make to your online security right now. Start with your email, then work through your bank, social media, and anything tied to personal or financial data.

Even enabling SMS codes on your most important accounts is a real step forward. Pick one account today, follow the steps above, and you will close the door that most attackers walk through.

Last updated: June 25, 2026

Reset a Forgotten Windows 11 Password Without Losing Your Files

Reset a forgotten Windows 11 password in minutes with Microsoft account recovery, PIN reset, security questions, or a PC reset — pick the right one and get back in.

Being locked out of your own Windows 11 PC is one of the most stressful tech problems there is. One minute you are trying to log in, and the next you are staring at a lock screen with no way through while everything you need sits on the other side. The fix is almost always faster than you think — the trick is matching the right reset method to your account type.

I have walked dozens of friends and family through this, and the people who panic are usually the ones who try the wrong method first. Below I cover how to reset a forgotten Windows 11 password using four approaches, starting with the two-minute option and ending with the one that works when nothing else does.

Quick Answer

If your Windows 11 PC uses a Microsoft account, go to account.live.com/password/reset on any phone or second device, verify your identity, and set a new password — it works at the lock screen right away. For a local account, click the Reset password link under the password field and answer your security questions.

Which type of account do you have?

The right method depends entirely on your account type, so this is the first thing to check. Here is how to tell them apart:

Microsoft account — Your login is an email address (such as @outlook.com, @hotmail.com, or any email you used to register with Microsoft). Windows 11 defaults to this.
Local account — A plain username with no email, created offline for this one PC.
Not sure? At the lock screen, if the sign-in name looks like an email address, it is a Microsoft account. A single name like “John” with no @ symbol means it is local.

Here is how the four reset methods compare at a glance:

Method	Works for	What you need	Approx. time
Microsoft account reset	Microsoft account	A second device + recovery email/phone	2–5 min
Windows Hello PIN reset	Microsoft account	Microsoft password or verification code	2–3 min
Security questions	Local account	Answers to your 3 security questions	1–2 min
Reset this PC	Microsoft or local account	Access to the lock screen (USB may be needed)	20–60 min

Confirm whether your sign-in name is an email or a plain username before you do anything else — it decides which of the methods below will actually work.

How do you reset a Microsoft account password?

This is the method I reach for first, because it works whenever your PC signs in with a Microsoft account email and you have a phone handy.

On any device — phone, tablet, or another computer — open a browser.
Go to account.live.com/password/reset.
Enter the email address tied to your Windows account, then click Next.
Choose how to verify your identity: by email, text message, or authenticator app.
Enter the code you receive.
Create and confirm a new password.
Return to your Windows 11 lock screen and enter the new password.

Pro tip: Once you are back in, set up a PIN under Settings > Accounts > Sign-in options. A short PIN is easier to remember than a long password and stays just as secure on your device. If you reuse passwords across sites, this is also a good moment to move your logins into a free password manager like Bitwarden.

Troubleshooting tip: If you have lost access to the recovery email or phone number, click I don’t have any of these at the verification step. Microsoft’s account recovery form lets you prove ownership through account history.

For a Microsoft account, the web reset at account.live.com from a second device is the fastest route back in.

How do you reset a forgotten Windows Hello PIN?

Windows 11 often uses a PIN for daily sign-ins instead of your full password, so the thing you actually forgot may be the PIN. There is a dedicated reset link for exactly this.

At the lock screen, click the PIN entry field.
Below the field, click I forgot my PIN.
Sign in with your Microsoft account password or a verification code sent to your phone or email.
Click Continue, then type and confirm a new PIN.
Click OK — your new PIN works immediately.

Note: This option only appears for accounts linked to Microsoft. If you see no “I forgot my PIN” link, your account is local — move to the next method.

The “I forgot my PIN” link only shows for Microsoft-linked accounts, and it verifies you through your Microsoft password or a code.

How do you reset a local account with security questions?

When you create a local account, Windows 11 lets you set three security questions. The first time I set up a local account I almost skipped this step — and I am glad I did not, because it makes recovery a one-minute job.

At the lock screen, type any password and press Enter — even if it is wrong.
Click the Reset password link that appears below the password field.
Answer all three security questions correctly.
Type a new password, confirm it, and press the arrow.
Windows logs you in right away.

Troubleshooting tip: If Reset password does not appear, no security questions were configured for that account, and you will need the last-resort method below.

Security questions only help if you set them up in advance; with them, a local-account reset takes about a minute.

What if no other method works?

If none of the above applies, Windows 11’s built-in reset tool gets you back in — with a choice to keep or erase your files.

At the lock screen, click the Power icon in the bottom-right corner.
Hold Shift and click Restart at the same time.
Your PC boots into the Windows Recovery Environment.
Go to Troubleshoot > Reset this PC.
Choose Keep my files (reinstalls Windows but saves your documents and photos) or Remove everything (full clean wipe).
Follow the on-screen prompts — Windows reinstalls and lets you set up your account fresh.

Troubleshooting tip: If Keep my files fails partway through, Windows may prompt you for installation media. You can create a free Windows 11 USB installer with the official Media Creation Tool from Microsoft. If you suspect someone else triggered the lockout, it is worth learning how to remove malware from Windows 11 once you are back in.

Reset this PC is a true last resort, but the “Keep my files” option means you do not have to lose your documents and photos.

Common Mistakes to Avoid

Not knowing your account type first. Trying Microsoft’s web reset on a local account wastes time. Check whether it is a Microsoft or local account before you start — the lock screen usually shows the email.
Trying to reset a Microsoft account from the locked PC itself. You need a second device (phone, tablet, library computer). Have one ready before you begin.
Choosing “Remove everything” before trying “Keep my files.” Always try the gentler option first. A full wipe is rarely needed and loses installed apps and settings.
Skipping recovery setup once you are back in. Add a recovery phone and backup email at account.live.com/proofs/manage the moment you regain access — five minutes now prevents a repeat.
Downloading third-party “password crackers.” These tools are almost always unnecessary, often malicious, and slower than Windows’ built-in recovery. Stick to the official methods above.

Frequently Asked Questions

Can I reset my Windows 11 password without losing my files?

Yes. The Microsoft account reset, PIN reset, and security-question methods all recover access without touching your files. When I did this on my own laptop, every document and photo was exactly where I left it, and even the “Reset this PC” route has a “Keep my files” option.

What if I forgot both my Windows 11 password and my PIN?

Reset the Microsoft account password first, then set a new PIN. On a friend’s PC last month we reset the password at account.live.com/password/reset, signed in, and created a fresh PIN under Settings > Accounts > Sign-in options in about three minutes total.

Can I reset a local account password with no security questions?

Without security questions, your only real options are a second administrator account on the same PC or a full PC reset. There is no safe backdoor for a local account with no recovery configured, which is exactly why I always set the three questions when creating one.

Can I reset my Windows 11 password from my phone?

Yes, for Microsoft accounts. Open a browser on your phone, go to account.live.com/password/reset, and follow the prompts. I have done this standing next to a locked desktop, getting the verification code by text and setting a new password in under five minutes.

Why doesn’t the Reset password link appear at my lock screen?

The link only shows for local accounts that have security questions set up. On a Microsoft account it never appears because recovery happens online instead — when I tested this on a Microsoft-linked PC, the lock screen only offered the PIN and password fields.

How do I stop this from happening again?

For Microsoft accounts, add a recovery phone at account.live.com/proofs/manage; for local accounts, set security questions under Sign-in options. After my own lockout I turned on Windows Hello face sign-in, and I have not typed the password since. Pairing it with two-factor authentication locks the account down further.

Conclusion

Getting locked out of Windows 11 is fixable in minutes once you match the method to your account type — Microsoft users head to the web reset, while local-account holders check for security questions at the lock screen. Keep “Reset this PC” as a genuine last resort.

Once you are back in, spend five minutes setting up a recovery phone, a PIN, or Windows Hello. And to keep sensitive files safe even if someone reaches your login screen, see my guide on how to password protect a folder in Windows 11.

How to Stop Spam Calls on iPhone and Android: A Practical Guide

Stop spam calls on iPhone and Android with built-in filters, free carrier tools, and a layered setup I rely on daily. Quiet your phone in minutes, starting now.

For weeks my phone buzzed every afternoon with a recorded voice pitching a car warranty, a fake IRS deadline, or a “free cruise.” Spam calls — also called robocalls (automated calls dialed by a computer) — are one of the most universal tech frustrations today, and hanging up never seemed to make them stop. The real fix happens at the phone level, not on each individual call.

The good news: your iPhone or Android already includes powerful tools to stop spam calls, and your carrier almost certainly offers a free network filter too. I layered all three on my own phone and the daily flood dropped to a trickle within a day.

Quick Answer

To stop spam calls on iPhone, open Settings > Phone > Silence Unknown Callers and toggle it on. On Android, open the Phone app, tap More > Settings > Spam and Call Screen, and enable spam protection. Then register at donotcall.gov and activate your carrier’s free call-filtering service for a second layer.

Why Do You Get So Many Spam Calls?

Robocallers use automated systems to dial millions of numbers every hour. A common trick is “neighbor spoofing” — faking a local area code so the call looks familiar and you’re more likely to answer. Your number probably landed on a list that gets bought and sold between telemarketers and scammers.

When I started getting calls that matched my own area code and prefix, I realized hanging up did nothing. Calling back is worse: it confirms your number is active and often lands you on more lists.

Spammers target your number, not a specific call, so the fix has to filter at the device and network level.

How Do You Stop Spam Calls on iPhone?

The iPhone has a built-in filter plus easy per-number blocking. I set both up in under five minutes.

Step 1: Turn On Silence Unknown Callers

This is Apple’s built-in spam filter. It sends calls from numbers not in your contacts, recent calls, or Siri suggestions straight to voicemail — silently.

Open the Settings app.
Scroll down and tap Phone.
Tap Silence Unknown Callers.
Toggle it on (the switch turns green).

Unknown numbers go straight to voicemail, but you still see a missed-call notification, so nothing important vanishes without a trace. After I turned this on, a new dentist’s office I hadn’t saved went to voicemail — they left a message, and I called back and saved the number.

Step 2: Use Your Carrier’s Free Spam Filter

All major U.S. carriers offer free call-filtering tools that work at the network level, catching spam before it ever reaches your phone:

Carrier	Service Name	How to Get It
AT&T	AT&T Call Protect	Download the free app or activate in myAT&T
Verizon	Verizon Call Filter	Activate at My Verizon or the Call Filter app
T-Mobile	Scam Shield	Active by default; app available for extra features

Pairing your carrier’s filter with Silence Unknown Callers gives you two independent layers of protection.

Step 3: Block Individual Numbers on iPhone

When a spam call does slip through:

Open the Phone app and go to Recents.
Tap the info icon next to the number.
Scroll down and tap Block this Caller.
Confirm by tapping Block Contact.

On iPhone, the built-in filter plus your carrier’s service stops most spam before your phone even rings.

How Do You Stop Spam Calls on Android?

The steps vary slightly by phone model and Android version, but the core options are the same. Android pairs an on-device spam filter with the same carrier tools iPhone uses.

Step 1: Enable Spam Protection in the Phone App

If your phone uses the Google Phone dialer (standard on Pixel phones and many other devices):

Open the Phone app.
Tap the three-dot menu (top right) and select Settings.
Tap Spam and Call Screen (it may appear as “Spam protection” on some versions).
Toggle on See caller and spam ID and Filter spam calls.

Google then screens suspected spam and shows a warning before you answer. On a Samsung Galaxy, open the Phone app, tap the three-dot menu, choose Settings > Caller ID and spam protection, and turn on Caller ID and spam. On my Pixel, the Call Screen feature answers and transcribes the caller in real time, so I can hang up without ever speaking.

Step 2: Block Numbers Manually on Android

Open the Phone app and go to Recents.
Long-press the number you want to block (or tap the info icon).
Select Block / report spam.
Check the box to report it as spam, then tap Block.

Reporting a number as spam helps improve detection for everyone on the same network or app.

Step 3: Activate Your Carrier’s Free Filter

The same carrier services that work on iPhone also work on Android — AT&T Call Protect, Verizon Call Filter, and T-Mobile Scam Shield. Download your carrier’s app, sign in with your account, and the network-level filter runs alongside your phone’s built-in protection.

On Android, enabling Google or Samsung spam protection plus your carrier filter blocks the vast majority of robocalls automatically.

Should You Register With the Do Not Call Registry?

Yes — it is free, permanent, and takes a minute. Visit donotcall.gov, the official Federal Trade Commission site, and register your number. It won’t stop scammers who already break the law, but it does reduce calls from legitimate telemarketers, who face heavy fines for violations.

I registered my number years ago and noticed the legitimate sales calls fade within a couple of weeks, even though the outright scam calls kept coming until I added the filters above.

The registry is worth doing once, but treat it as one layer, not your whole defense.

Which Third-Party Call Blocking Apps Are Worth It?

For an extra layer, these three apps are widely used and well regarded. Compare them before installing:

App	Platform	Free?	Best For
Hiya	iOS & Android	Yes (basic)	Caller ID + spam blocking
YouMail	iOS & Android	Yes (basic)	Visual voicemail + blocking
RoboKiller	iOS & Android	No (~$5/mo)	Aggressive blocking + Answer Bots

If an app blocks too many legitimate calls, open its block list settings — most let you whitelist specific numbers or area codes so important callers always get through. Because some blockers access your call data, I read the privacy policy first; if a scam call ever gets you to hand over a password, run a data breach check right away.

A third-party app is optional, but it adds aggressive blocking the built-in tools don’t offer.

Common Mistakes to Avoid

Calling back unknown numbers. This confirms your number is active and lands you on more lists. Fix: if someone important called, they’ll leave a voicemail — wait for it.
Pressing “2” to opt out of a robocall. Scammer opt-outs flag your number as live. Fix: hang up immediately instead of pressing any key.
Only blocking calls after they happen. One-by-one blocking never catches up. Fix: turn on proactive filtering now, before the next wave.
Ignoring your carrier’s free filter. Many people don’t know it exists. Fix: install your carrier’s app and activate the network-level service — it costs nothing.
Trusting an “IRS” or “Social Security” threat. Real agencies contact you by mail first and never demand phone payment. Fix: hang up, and learn the same pressure tactics in phishing emails so you spot the next scam.

Frequently Asked Questions

Can spam callers get around my block list?
Yes, because robocallers rotate numbers constantly, so blocking one number rarely stops the campaign. When I blocked a “warranty” caller, a near-identical number called the next day — which is why I rely on Silence Unknown Callers and carrier filters instead of one-by-one blocking.

Will Silence Unknown Callers on iPhone block all spam?
No, it silences numbers not in your contacts, recent calls, or Siri suggestions, so a spammer who reached you before can still ring through. On my own phone, pairing it with my carrier’s free filter closed that gap and caught the repeat callers.

Is the Do Not Call Registry still effective?
It works against legitimate telemarketers who face FTC fines, but not against scammers who already break the law. After I registered, the sales calls dropped within weeks while the scam robocalls only stopped once I added device and carrier filtering.

Do call-blocking apps sell my data?
Some do, so read the privacy policy before installing. When I tested a free blocker, I checked its policy first and stuck with reputable options like Hiya and YouMail; if privacy is your priority, the built-in tools and your carrier filter are enough.

What should I do if I gave information to a spam caller?
Act fast: call your bank if you shared financial details, and visit IdentityTheft.gov if you gave your Social Security number. A friend who shared a card number caught the fraud the same afternoon only because she called her bank within the hour.

Does using a VPN stop spam calls?
No, because a VPN protects your internet traffic, not your phone calls, which travel over your carrier’s voice network. I keep a VPN running for browsing, but spam-call defense lives entirely in your phone and carrier settings.

Conclusion

Stopping spam calls comes down to layering simple, free defenses: turn on your phone’s built-in filter, activate your carrier’s network-level service, and register at donotcall.gov. Together they quieted my phone in a single day with almost no ongoing effort. Set up all three this week and enjoy the silence.

Remove Malware from Windows 11 Free: A Built-In Cleanup Walkthrough

Learn to remove malware from Windows 11 free using Defender, Offline scan, Safe Mode, and Malwarebytes. I share the exact order that finally cleared my PC.

Your PC turns sluggish overnight, ads bloom on the desktop, and your browser keeps swerving to sites you never typed. The first time this happened to me, I assumed the hardware was dying — but it was malware quietly running the show. Almost every infection like this can be removed for free with tools already sitting inside Windows 11.

Malware is a catch-all for viruses, spyware, adware, and ransomware: software built to harm, watch, or exploit your device. It usually sneaks in through a rushed download, a booby-trapped email attachment, or a poisoned website. Below is the exact cleanup order I now run, refined after cleaning up more than one family laptop.

Quick Answer

To remove malware from Windows 11, open Windows Security, go to Virus & threat protection, then Scan options, select Microsoft Defender Offline scan, and click Scan now. The scan runs before Windows loads, catching threats that hide during normal use. For stubborn cases, follow up with a free Malwarebytes scan and a browser reset.

What Are the Signs Your Windows 11 PC Has Malware?

Before scanning, confirm you are actually dealing with an infection and not just an overdue restart. Watch for these symptoms:

Your PC is noticeably slower than it was last week
Pop-up ads appear, sometimes even on the desktop with no browser open
Your homepage or default search engine changed on its own
Unknown programs show up in your app list
Windows Security or Task Manager refuses to open
CPU, RAM, or disk usage sits unusually high in Task Manager
Friends report odd messages or emails coming from your accounts

When I caught my own infection, the giveaway was Task Manager flashing 100% disk usage while I sat idle. If you spot two or more of these signs, scan right away.

Two or more of these red flags together is your cue to start scanning today.

How Do You Update Microsoft Defender Before Scanning?

Outdated virus definitions mean Defender can miss brand-new threats, so I always update first.

Click Start, type Windows Security, and open the app.
Click Virus & threat protection.
Under “Virus & threat protection updates,” click Check for updates.
Wait for the update to finish before moving on.

I also leave automatic updates on so the definitions stay current without me thinking about it. Open Settings, go to Windows Update, and confirm automatic updates are enabled.

Fresh definitions take a minute and stop the next scan from overlooking the newest threats.

How Do You Run a Full Scan with Microsoft Defender?

Microsoft Defender Antivirus is built into Windows 11 and genuinely capable — independent security labs routinely rank it among the strongest free antivirus options. A Full scan is where I start.

In Windows Security, click Virus & threat protection.
Click Scan options.
Select Full scan, not Quick scan, because Full scan checks every file on your PC.
Click Scan now.

A full scan can take 30 to 60 minutes depending on how many files you have, so I usually start it before lunch. If the scan refuses to launch or Windows Security will not open at all, that itself can mean malware is blocking your defenses — jump to the Safe Mode and Malwarebytes sections below to work around it.

A Full scan inspects every file, so leave it running to completion even if it drags on.

What Does a Microsoft Defender Offline Scan Do?

Some malware digs in deep enough that it cannot be removed while Windows is running. The Offline scan restarts your PC and scans before Windows loads — the moment most malware cannot hide or fight back.

Go to Windows Security, then Virus & threat protection, then Scan options.
Select Microsoft Defender Offline scan.
Click Scan now, then confirm by clicking Scan.
Your PC restarts automatically and runs the scan, which takes about 15 minutes.

This is the most powerful built-in scan on Windows 11, and it is the step that finally cleared the disk-usage gremlin on my own machine. Use it whenever you suspect something serious.

Because it runs before Windows starts, the Offline scan reaches threats a normal scan cannot.

How Do You Scan in Safe Mode for Stubborn Infections?

If malware keeps interrupting your scans, boot into Safe Mode first. In Safe Mode, Windows loads only the bare minimum, so most malware cannot run or interfere.

Click Start, then Settings, then System, then Recovery.
Under “Advanced startup,” click Restart now.
Choose Troubleshoot, then Advanced options, then Startup Settings, then Restart.
Press 4 to start in Safe Mode.
Once in Safe Mode, repeat the Full scan and Offline scan steps above.

Safe Mode strips the system down so blocked scans can finally finish.

Is Malwarebytes Free Worth Running as a Second Opinion?

No single tool catches everything. Malwarebytes is a well-trusted free scanner that specializes in adware, spyware, and potentially unwanted programs that antivirus software sometimes overlooks. I run it as a second opinion after Defender.

Download Malwarebytes from malwarebytes.com — the free version is enough.
Install and open the application.
Click Scan and let it run to completion.
Review any detected items and click Quarantine to remove them.
Restart your PC when prompted.

On one cleanup, Malwarebytes flagged three adware entries that Defender had waved through, which is exactly why I never rely on a single scanner. Here is how the two free options compare:

Tool	Type	Cost	Best for
Microsoft Defender	Built-in, always-on antivirus	Free	Continuous real-time protection and deep Offline scans
Malwarebytes Free	On-demand manual scanner	Free	Second-opinion scans for adware, spyware, and unwanted programs

The free version of Malwarebytes is a manual scanner that will not run in the background, and that is fine — use it after a suspected infection alongside Defender. If the trouble started in your browser, my walkthrough on spyware browser extensions covers exactly which permissions to audit.

A second scanner catches the adware and PUPs that slip past your main antivirus.

How Do You Remove Suspicious Startup Programs?

Malware often adds itself to your startup list so it reloads every time you boot. Cleaning this list is an essential step.

Press Ctrl + Shift + Esc to open Task Manager.
Click the Startup apps tab.
Look for any program you do not recognize or did not install yourself.
Right-click a suspicious entry and select Disable.

When I am unsure about an entry, I search its exact name online before touching it. Disabling is safe — you can re-enable anything you actually need later.

Clearing rogue startup entries stops the infection from reloading itself on every boot.

How Do You Reset Your Browser Settings After Adware?

Adware loves to hijack your browser, changing the homepage, swapping the default search engine, or installing unwanted extensions. A reset clears all of it.

In Google Chrome:

Click the three-dot menu in the top right, then Settings.
Scroll down and click Reset settings.
Click Restore settings to their original defaults, then Reset settings.

Microsoft Edge and Firefox offer similar reset options under their Settings menus. Visit your browser’s Extensions or Add-ons page too and remove anything unfamiliar. Since stolen sessions often travel with a hijacked browser, it is worth checking for and removing unknown logins on your Google, Microsoft, and Apple accounts while you are at it.

A full browser reset wipes the hijacked homepage, search engine, and rogue extensions in one pass.

How Do You Repair Damaged System Files with SFC?

Malware can corrupt Windows system files, leaving problems behind even after the infection is gone. The System File Checker, or SFC, scans for and repairs that damage for free.

Click Start and search for Command Prompt.
Right-click it and choose Run as administrator.
Type sfc /scannow and press Enter.
Wait for the scan to finish, which takes 10 to 15 minutes.
Restart your PC when it completes.

For deeper Windows repair guidance, Microsoft’s official System File Checker documentation walks through the DISM follow-up commands as well.

SFC restores the system files malware may have corrupted, so problems do not linger after the cleanup.

Common Mistakes to Avoid

Only running a Quick Scan. Quick scans check just the most common hiding spots. Fix: use a Full scan or Offline scan for a thorough clean-up.
Downloading “anti-malware” tools from pop-up ads. “Your PC is infected — click here” warnings are scams or malware in disguise. Fix: download only from trusted sites like malwarebytes.com or microsoft.com.
Skipping the browser reset. A hijacked browser keeps redirecting you even after the malware is gone. Fix: always reset settings and review your extensions.
Paying for “PC cleaner” tools that appear after a scare. Legitimate removal is free. Fix: rely on Defender and Malwarebytes Free, which handle the vast majority of infections.
Not restarting after quarantine. Some files are removed only on reboot. Fix: always restart after any scan that detects threats.

Frequently Asked Questions

Does Windows 11 have built-in malware protection?

Yes. Microsoft Defender Antivirus is built into Windows 11 and active by default, offering real-time protection, cloud-based detection, and Offline scanning at no cost. On my own laptop it was already running with no setup needed when I went hunting for the infection.

How do I know if my PC has a virus?

Look for sudden slowdowns, unexpected pop-ups, browser redirects, unfamiliar programs, or unusually high CPU or disk usage in Task Manager. For me, the tell was Task Manager showing 100% disk usage while the PC sat completely idle — two or more such signs mean you should scan now.

Is the Malwarebytes free version good enough?

Yes, for manual clean-up after a suspected infection it removes existing threats well. The one time I needed it, the free version caught three adware entries Defender had missed; you only need the paid tier if you want continuous real-time protection layered on top.

Can malware survive a Windows 11 reset?

Very rarely. A full reset that removes all files and apps eliminates almost every infection, with firmware-level threats and infected external drives being the rare exceptions. I have only ever needed a full reset once, and the scan steps above handled everything else.

How long does a full Microsoft Defender scan take?

Usually 30 to 60 minutes, depending on how many files you have. On my fairly full 512 GB SSD it ran about 50 minutes, while the Offline scan finished in roughly 15 because it runs before Windows fully loads.

What should I do if malware keeps coming back?

Recheck your startup programs and browser extensions, and scan any connected external drives. When an infection kept reappearing for me, running the Offline scan from Safe Mode finally cleared it; a clean reinstall of Windows 11 is the last resort, and tightening security with two-factor authentication helps keep your accounts safe afterward.

Conclusion

Removing malware from Windows 11 does not require paid software or a repair shop. Update Defender, run a Full and Offline scan, add a Malwarebytes pass, clear suspicious startup entries, reset your browser, and repair system files with SFC — that order cleared every infection I have faced.

Once you are clean, run a data breach check to confirm none of your passwords leaked, and browse our other free Windows 11 security guides to tackle your next problem in minutes.