password reset – Free Tech Tutor

Create Strong Passwords You Can Actually Remember

Create strong memorable passwords using the passphrase method, sentence abbreviation trick, and a free password manager — so you stop reusing passwords for good.

Most people know they should use strong, unique passwords — yet reusing the same password across multiple accounts remains the norm. I did it for years. The cycle is predictable: you create a genuinely random password, forget it within a week, reset it to something you can recall, then use that familiar string on every new site you join.

The problem isn’t laziness. Standard password advice treats memorability and security as opposites, and that framing makes the advice unworkable. The real danger isn’t a weak password — it’s any password you’ve reused across more than one account. Attackers don’t crack passwords one by one; they take credentials from one leaked database and test them automatically across every major site. Here’s how I broke the cycle for good.

Quick Answer

Build a passphrase from four random, unrelated words — for example, “cobalt fence eleven grape.” At 26 characters, it’s far stronger than an 8-character random string and takes about five repetitions to memorize. For every other account, use a free password manager like Bitwarden to generate unique passwords you’ll never need to type or remember.

Why Is Standard Password Advice So Hard to Follow?

Rules like “include uppercase letters, numbers, and symbols” were designed for security systems, not human memory. When you’re forced to memorize “Xk$9!mQz,” your brain shortcuts to “Password1!” — and then you reuse that everywhere. That predictable shortcut is exactly what credential-stuffing attacks rely on: grab a password from one breach and test it on every other site automatically.

The real measure of password strength is length combined with unpredictability. A 26-character passphrase made of four random unrelated words is mathematically stronger than an 8-character “complex” password. It also takes far less mental effort to memorize, because your brain stores sequences of real words as images rather than random character strings.

Complexity requirements backfire by driving reuse — length and randomness are what actually protect your accounts.

How Do I Create a Strong, Memorable Password?

Method 1: The Passphrase

This is the method I use for my password manager’s master password — anything I need to type from memory on a regular basis.

Pick four words that share no logical connection. Avoid personal details: your pet’s name, hometown, birth year, or anything tied to your public identity.
String them together, optionally adding a number or symbol to satisfy site requirements: “cobalt-fence-eleven-grape7”
Picture each word as a frame in a short comic strip. If you can see all four images in sequence, you’ll recall them after about five repetitions.

A passphrase like “cobalt fence eleven grape” sits at 26 characters. Brute-force cracking it would take longer than the age of the universe. I had my current master passphrase memorized within the first day — the visual association trick genuinely shortens the learning curve.

Pro tip: Use the EFF’s free Diceware wordlist at eff.org/dice to pick your words at true random. Words you choose yourself cluster around common phrases far more than you’d expect.

Method 2: The Sentence Abbreviation Trick

Take a sentence only you’d know and use the first letter of each word. “My first dog Bella was born October 3rd, 2010” becomes “MfdBwbO3,2010” — 13 characters with mixed case, a number, and punctuation already built in naturally.

To make it unique per site, add the site’s first two letters at the end: “MfdBwbO3,2010gm” for Gmail, “MfdBwbO3,2010am” for Amazon. I used this approach for several years before switching to a manager, and you can still recreate any password anywhere just by remembering your original sentence.

Method 3: One Passphrase, a Manager for Everything Else

This is what I recommend to everyone today. Use Method 1 to create one strong master passphrase, then let a free manager like Bitwarden generate unique 20-character random passwords for every other account. You memorize exactly one thing; the manager handles the rest. I made this switch two years ago and haven’t reused a password since.

Troubleshooting tip: If you’re ever locked out of your password manager, recovery depends on setup. In Bitwarden, go to Settings > Emergency Access before you need it — designate a trusted contact as a backup so you’re never permanently locked out of your vault.

If you ever switch browsers later, moving your saved passwords between browsers takes about five minutes and doesn’t require retyping anything by hand.

One strong passphrase unlocks a vault of unique credentials — the only setup that makes password reuse impossible without taxing your memory.

How Strong Is “Strong Enough”?

Length is the dominant variable. The table below shows how crack resistance scales with password type, assuming dedicated hardware and known attack patterns such as dictionary mutations and brute force.

Password Type	Example	Length	Estimated Crack Resistance
Common word	sunshine	8 chars	Under 1 second
Symbol substitution	$uNsh!N3	8 chars	Under 1 minute
Random alphanumeric	Xk9mQzRpL2	10 chars	Days to weeks
4-word passphrase	cobalt fence eleven grape	26 chars	Billions of years
Manager-generated random	qY7#kRzPm2@Lv9nXw	17 chars	Effectively impossible

The bigger real-world threat isn’t brute force anyway — it’s database breaches. Even a strong password causes damage if you’ve reused it. Pair strong passwords with the two-factor authentication steps in these iPhone privacy settings or these Android privacy settings for a complete security upgrade.

Length and uniqueness together are what actually protect accounts — short complexity without length gives you a false sense of security.

What Common Mistakes Should You Avoid?

Reusing any password across sites. One breach hands attackers access to every account that shares it. Fix: use a manager so every site gets its own unique string, automatically.
Using personal information. Your dog’s name, birth year, or hometown appear in data broker records and are easily guessable. Fix: choose words or phrases with no connection to your life.
Appending “1!” to a familiar base word. Attackers run this mutation pattern first in any brute-force sequence. Fix: use a passphrase or a manager-generated string instead.
Storing passwords in a plain notes app. An unlocked phone or laptop exposes everything at once. Fix: use a dedicated password manager that requires its own authentication to open.
Believing short complexity beats long simplicity. “P@$$w0rd” cracks in seconds on modern hardware. Fix: start with length — 16 or more characters makes any password exponentially harder to attack, even without symbols.

Every one of these mistakes trades a few seconds of convenience for a systemic vulnerability — fix the method once and you stop making the same trade-off on every new account.

Frequently Asked Questions

Should I change my passwords on a regular schedule?

Only when you have a specific reason — a breach notification, a shared account you’re revoking, or suspicious login activity. Forced rotation drives predictable increments like “Password1,” “Password2.” I check haveibeenpwned.com a few times a year instead, which gives me a real signal rather than an arbitrary 90-day reminder.

What is the best free password manager available right now?

Bitwarden is open-source, independently audited, and free for personal use across every device and browser. The built-in managers in Chrome and Safari are also solid if your device stays with you. I use Bitwarden because it follows me across operating systems and browsers without locking me into one ecosystem.

Is a passphrase really stronger than a short complex password?

Yes — length is the dominant factor in brute-force resistance. “Cobalt fence eleven grape” at 26 characters beats “Xk$9!mQz” at 8 characters by an enormous computational margin. The passphrase also defeats dictionary attacks because the specific combination of four random unrelated words is effectively unique in any attack database.

What should I do if my password shows up in a data breach?

Change it on the affected site immediately, then check whether you’ve reused that password anywhere else and change those too. A breach is only catastrophic if the password wasn’t unique to that site. Going forward, a password manager keeps each account isolated — a future breach stays contained to one login.

Do I really need a different password for every account?

Yes, every account. With a password manager, this is effortless — it generates and fills unique passwords automatically so you never type them. If you prefer the sentence abbreviation method, a site-specific suffix makes each login distinct. I manage over 200 unique passwords now and only remember one: my master passphrase.

Every FAQ about passwords points to the same answer: use a passphrase, use a manager, and never reuse — the three habits that cover nearly every attack vector most people face.

Conclusion

Creating strong passwords you can actually remember comes down to one shift in approach: use a four-word passphrase for anything you type from memory, and a free password manager for everything else. Start today by setting up Bitwarden and updating your five most important accounts — email, banking, and social media first. That one hour of setup protects you from the credential-stuffing attacks that catch most people off guard long after a breach they never heard about.

Outlook Keeps Asking for Password: Stop the Login Loop for Good

Outlook keeps asking for your password on a loop? Clear stale tokens, enable Modern Auth, or rebuild your profile to stop the prompt in minutes — no reinstall needed.

When Outlook keeps asking for your password every time you open it — or even mid-session — the cause is almost never a wrong password. The looping prompt hits Microsoft 365 and Outlook.com users constantly, and it rarely stops on its own. The first time it happened to me on a client’s laptop, I retyped the correct password four times before I realized Outlook was ignoring it entirely. The real culprit is usually a stale saved credential or a misconfigured authentication setting, not a compromised account.

Before you change your password or reinstall Office, work through the targeted fixes below. I clear most cases in under five minutes once I know which layer is actually broken.

Quick Answer

Open Windows Credential Manager (Control Panel > Credential Manager > Windows Credentials), find every entry containing “MicrosoftOffice” or your email domain, and click Remove. Restart Outlook and sign in fresh. This clears the stale authentication token behind most repeated password prompts — no password change or reinstall required.

Why does Outlook keep asking for my password?

Outlook stores an authentication token after your first sign-in and reuses it silently. When that token goes stale, duplicates, or fails to renew, Outlook can’t validate it — so it falls back to prompting you, and the prompt loops because the broken token is never replaced. On the client laptop I mentioned, three duplicate “MicrosoftOffice16” entries were fighting each other in Credential Manager; deleting all three ended the loop instantly.

A changed work password, an expired refresh token, a deprecated Basic Authentication fallback, or security software that inspects Microsoft’s login traffic can each break that renewal. The good news: every one of these is a local configuration issue you can fix yourself.

The loop is your token failing to renew, not Outlook doubting your actual password.

How do I clear stale credentials in Credential Manager?

This resolves the loop in the majority of cases and takes about two minutes. It’s the first thing I try, every time.

Press Win + S, type Credential Manager, and open it.
Click Windows Credentials.
Look for entries containing MicrosoftOffice, outlook, or your email domain (for example, office365 or your company name).
Click each entry and select Remove. Remove every matching entry — even ones that look current.
Restart Outlook and sign in when prompted.

If you see multiple entries for the same account, remove all of them. Duplicate tokens make Outlook cycle between credentials rather than locking onto a valid one, which is why the prompt keeps returning even after you type the correct password.

Deleting every Microsoft-related credential entry forces Outlook to mint one clean token on the next sign-in.

Is Modern Authentication enabled on your account?

Microsoft 365 accounts require Modern Authentication (OAuth 2.0). Older Outlook builds or misconfigured tenant settings can fall back to Basic Authentication — which Microsoft has deprecated and which reliably triggers repeated prompts.

In Outlook, go to File > Office Account > About Outlook and note your version number.
Build 16.0.7967 or later supports Modern Auth natively. If you’re below that, update via File > Office Account > Update Options > Update Now.
IT admins can confirm Modern Auth is on in the Microsoft 365 admin center under Settings > Org Settings > Modern Authentication.

One detail that burned me once: a VPN or antivirus performing SSL inspection on Microsoft’s login endpoints can silently block OAuth token renewal. Temporarily disconnect the VPN or whitelist login.microsoftonline.com in your security software, then test whether the prompt disappears. Microsoft documents this behavior in its own guidance on repeated Outlook password prompts.

If your build predates 16.0.7967 or a VPN is inspecting login traffic, the token can never renew no matter how often you sign in.

How do I create a fresh Outlook profile?

A corrupted profile stores a broken auth state that can’t be repaired in place. Building a new profile is the cleanest fix when the steps above don’t hold — I save it for stubborn cases because it takes the longest.

Close Outlook completely.
Open Control Panel > Mail (Microsoft Outlook). Search “mail” in the Start menu if it doesn’t appear in the list.
Click Show Profiles > Add, name the new profile, and follow the wizard to add your email account.
Under When starting Microsoft Outlook, use this profile, select Always use this profile and choose the new one.
Open Outlook. If the prompt is gone, the old profile was the culprit — delete it from the same Show Profiles dialog.

A new profile sidesteps the corrupted auth state instead of trying to repair it in place.

Can I just remove and re-add the one account?

Yes. If a full new profile feels like overkill, removing and re-adding only the affected account is a lighter alternative that often resolves single-account issues without touching your others.

Go to File > Account Settings > Account Settings.
Select the affected email account and click Remove.
Click New and complete the add-account wizard with your credentials.
Restart Outlook and confirm the prompt no longer appears.

Re-adding a single account rebuilds just that token while leaving every other mailbox untouched.

Which fix should you try first?

When more than one fix could apply, I work top to bottom — fastest and least disruptive first. This table is the order I follow.

Fix	Best for	Time	Affects saved emails?
Clear Credential Manager	Stale or duplicate tokens	~2 min	No
Enable Modern Auth	Outdated Outlook or tenant config	~5 min	No
New Outlook profile	Corrupted profile	~10 min	Moves to new profile
Remove & re-add account	Single-account misconfiguration	~5 min	No

Start with Credential Manager and only escalate to a profile rebuild if the loop survives.

Common Mistakes to Avoid

Checking “Remember my credentials” without clearing old entries first. Outlook reads existing stored credentials before saving new ones, so stale entries block the new password from taking hold. Remove old entries first, then sign in.
Reinstalling Office as a first step. A reinstall takes 20+ minutes and almost never fixes an auth loop unless the installation files are damaged. Start with Credential Manager and treat reinstall as a last resort.
Changing your Microsoft account password to break the loop. If the cause is a stale token, a new password just creates a fresh mismatch and can extend the problem. Fix the token, not the password.
Testing with a VPN still connected. VPNs that inspect Microsoft’s login traffic can stop a working fix from taking effect. Always test without the VPN before deciding a fix failed.
Skipping “Stay signed in” during re-authentication. Selecting Stay signed in writes a long-lived refresh token; skip it and you’ll likely be prompted again within hours.

Frequently Asked Questions

Does this password loop happen on Mac too?
Yes, and the fix mirrors Windows. Open Keychain Access, search for “Microsoft,” delete any Outlook or Exchange-related entries, then reopen Outlook and sign in fresh. I cleared a colleague’s MacBook loop this way in about a minute — the stale credential cache is the same root cause as on Windows.

Why does it only affect one of my email accounts and not the others?
Each account stores its credentials separately, so one corrupted token or profile entry leaves the rest working. On my own setup, only my work account looped while a personal Outlook.com account signed in fine — removing and re-adding just the work account fixed it without disturbing the other.

Will clearing Credential Manager delete my emails?
No. Credential Manager stores authentication tokens, not message data. Your mail lives on the Microsoft 365 or Exchange server, or in a local .ost file on your drive, so a recent client of mine lost zero messages after I wiped every credential entry on their machine.

My work password changed and now Outlook loops — what’s the quickest fix?
Open Credential Manager, remove the old entry for your work email, and restart Outlook so it prompts once for the new credentials. When I hit this after a forced domain reset, signing out and back into Windows with the new password first made the single-sign-on token refresh cleanly.

Could repeated password prompts mean my account was hacked?
Rarely — it’s almost always a technical credential issue, not a breach. That said, if you also see unfamiliar login locations or sent mail you didn’t write, treat it as a security event and change your password from a trusted device. If malware is possible, run a quick scan with Malwarebytes Free before rebuilding a profile.

Conclusion

The Outlook password loop is almost always a credential cache or authentication issue — not a broken install or security breach. Clearing Windows Credential Manager takes two minutes and resolves most cases; Modern Auth and a fresh profile close the rest.

If your mailbox itself stops moving messages, see my walkthrough on when Outlook won’t send or receive email, and if sync trouble spreads across your account, the guide to why OneDrive stops syncing covers the next common issue in the same stack. Try Credential Manager first, then come back if the loop holds.

Find and Remove Unknown Logins on Google, Microsoft, and Apple

See how I find and remove unknown logins on Google, Microsoft, and Apple — review every active session and sign out anything suspicious in five minutes flat.

The first time I spotted an unfamiliar sign-in on my Google account, it was a browser session from a city three hours away that I had never visited. My password still worked, nothing looked broken, and that was exactly the problem — an unknown login does not always announce itself. The real danger is the session that stays quietly open, watching your inbox while everything appears perfectly normal.

You do not need special software to fix this. A few clicks on each platform’s security page gives you a clear list of every device, browser, and location with an open session on your account. I now run this check on the first of every month, and catching a stale session from a phone I sold last year matters just as much as catching a stranger.

Quick Answer

Open myaccount.google.com/security, scroll to “Your devices,” and click “Manage all devices” to review and sign out Google sessions. For Microsoft, visit account.microsoft.com/security and check “Sign-in activity.” For Apple, open Settings then [Your Name] on iPhone, or visit appleid.apple.com to see and remove connected devices.

Why should you check for unknown logins at all?

Because a leaked password rarely triggers an obvious lockout. When my credentials turned up in a breach years ago, the attacker did not change my password — they simply logged in and lurked, reading password-reset emails for my other accounts. Reviewing active sessions is the one check that exposes that quiet access, and it works even when every other sign looks fine.

Running it monthly also clears out forgotten devices. An old laptop you recycled or a phone you handed to a relative often stays logged in for years, and each one is a door you forgot to close.

Checking active sessions reveals quiet intruders and forgotten devices that a password change alone would never catch.

How do you check active logins on Google?

Step 1: Open the security page

Go to myaccount.google.com/security. Sign in if prompted, then scroll down to the “Your devices” section.

Step 2: Review active sessions

Click “Manage all devices.” You will see every phone, tablet, and browser that has accessed your Google account recently, along with its approximate location and last-activity time. A session from a city you have never visited, or a device you no longer own, is a red flag.

Step 3: Sign out the device

Click the suspicious device, then click “Sign out.” Google signs that device out of all Google services immediately. The person on that device would need your password to get back in, which is exactly why you should change it right after.

Pro tip: Once I sign out an unknown device, I change my Google password and confirm two-factor authentication is on before doing anything else. That locks the door before a removed user can try to slip back in.

Google gives you a per-device list and instant remote sign-out, making it the easiest of the three to clean up.

How do you review sign-in activity on Microsoft?

Step 1: Open sign-in activity

Go to account.microsoft.com/security and sign in. Click “View my activity” under the Sign-in activity section.

Step 2: Read the activity log

Microsoft shows every sign-in by date, device, browser, IP address, and approximate location. I scan for logins from countries I have not visited, or odd timestamps like 3 a.m. when I was asleep.

Step 3: Respond to suspicious logins

Each entry has a “This wasn’t me” button that launches a guided security review and password reset, which forces all active sessions to sign out. If you spot a currently active session you do not recognize, change your password immediately to cut off access.

Troubleshooting tip: If you see repeated logins from one unfamiliar IP, your credentials may have leaked. Check your email at Have I Been Pwned (free, no sign-up), then read this breach-check guide for the next steps.

Microsoft shows a detailed sign-in log rather than per-device toggles, so a password reset is how you force a stranger out.

How do you remove devices from your Apple account?

Step 1: Find your devices

On iPhone or iPad, go to Settings then [Your Name] and scroll to the device list. On Mac, open System Settings then [Your Name] and scroll down. On the web, sign in at appleid.apple.com and click “Devices” in the sidebar.

Step 2: Review each device

Tap or click any device to see its model, operating system version, and serial number. A device you sold, gifted, or lost should not still appear here.

Step 3: Remove the device

Tap “Remove from Account” and confirm. The device instantly loses access to iCloud, Apple Pay, and your iCloud data. Apple also sends a security notification email to your registered address.

Apple’s device list, like Google’s, lets you remove unrecognized hardware instantly and notifies you by email when you do.

Which platform makes removal easiest?

When I cleaned up all three accounts in one sitting, the differences were obvious: Google and Apple let me kill a specific device in one click, while Microsoft routes you through a password reset. The table below sums up where to look and what each platform actually lets you do.

Platform	Where to check	Per-device session view?	Remote sign-out?
Google	myaccount.google.com/security	Yes	Yes, instantly
Microsoft	account.microsoft.com/security	Sign-in log only	Via password reset
Apple	appleid.apple.com / Settings	Yes	Yes, instantly

Google and Apple offer instant per-device sign-out, while Microsoft relies on a password reset to evict an intruder.

Common Mistakes to Avoid

Checking only one account. Most people secure Google but forget Microsoft and Apple, and attackers count on that. The fix: review all three in the same sitting.
Removing a session but not changing your password. Signing out kills the active session, but anyone who still has your password can sign back in within minutes. The fix: change the password immediately after removing an unknown device.
Dismissing nearby but unfamiliar locations. VPNs and mobile towers can make your own logins look like they came from another city. The fix: compare the timestamp to your own activity before deciding, and investigate anything you cannot explain.
Leaving old devices on your account. A phone you sold two years ago and never signed out is still a live session. The fix: remove every device you no longer own.
Skipping two-factor authentication after cleanup. Evicting an intruder without enabling 2FA is like changing the lock but leaving a spare key under the mat. The fix: pair this check with a strong password manager and 2FA.

Frequently Asked Questions

Does removing a device delete my files?
No. Signing a device out only revokes its access to your account. When I removed an old iPad from my Apple ID, every photo and document in iCloud stayed exactly where it was on the server.

Will the person on the removed device know they were signed out?
Not directly. They simply find themselves logged out the next time they open a linked app. A friend I removed from my old Netflix-linked Google session just saw a “please sign in again” prompt with no alert naming me.

How often should I check my active sessions?
Once a month is plenty for most people. I run mine on the first of the month, and I always check immediately after using a public computer, as I did at a hotel business center last spring.

What if I cannot sign in because someone already changed my password?
Use the “Forgot password” recovery flow on each platform. When a relative’s account was hijacked, Google’s trusted-phone recovery got her back in within ten minutes, even after the attacker had reset the password.

Is it safe to run this check on a public computer?
Yes, if you sign out fully and clear saved passwords before walking away. I once forgot to clear a library PC and had to remotely sign that very session out from my phone, which is the better tool for the job anyway.

Conclusion

Five minutes on each platform’s security page can close access you never knew was open. Run the check on Google, Microsoft, and Apple today, remove anything unfamiliar, and reset your password the moment something looks off. Make it a monthly habit, pair it with strong unique passwords and 2FA, and start with Google right now.

Email Account Hacked? Warning Signs and a Step-by-Step Recovery Plan

Spot the warning signs of a hacked email account, then follow my exact recovery order to lock the attacker out and reclaim full control before real damage spreads.

Something felt off the morning a friend texted me asking why I’d “sent” her a link to a sketchy crypto site. I never wrote that message — and that single odd report is one of the clearest signals that an email account has been hacked. The faster you act on a signal like that, the better your odds of getting full control back. The first hour after you notice something wrong decides whether this is a minor scare or a lasting breach.

Email is the master key to your digital life. A hacker who controls your inbox can reset passwords on your banking, social media, and cloud storage in minutes. Knowing the warning signs and having a clear recovery order makes all the difference.

Quick Answer

If your email account is hacked, change your password immediately, sign out of all active sessions, and turn on two-factor authentication. Then check your security log for unfamiliar devices and remove any forwarding rules the attacker added. Acting within the first hour gives you the best chance to reverse the damage before you’re locked out.

What Are the Warning Signs of a Hacked Email Account?

The signals fall into two groups: things you can see in your own inbox, and alerts the provider sends you. I treat any one of them as a reason to start the recovery steps below, because waiting to “be sure” is exactly what attackers count on.

Signs Inside Your Inbox

Your password stops working. If you’re suddenly locked out of an account you didn’t change, an attacker may have reset the password to cut you off.
Sent messages you never wrote. Open your Sent folder now. Links or money requests you didn’t write mean someone else is using your account. A suspiciously empty Sent folder is also a red flag, since attackers often delete their tracks.
Contacts report spam from you. When someone asks “Did you send this?” about a message you never wrote, that’s a firm indicator. Hijacked accounts are valuable precisely because recipients trust a familiar address.
Altered inbox or new filters. Folders you didn’t create, missing emails, or filters silently forwarding mail elsewhere mean the attacker is actively monitoring you.

Signs From Your Provider

Unexpected login or security alerts. Any notice about a password change, new recovery address, or new device sign-in you didn’t start is an emergency.
Unfamiliar locations in your sign-in log. Gmail, Outlook, and Yahoo all log sign-ins by location and device. A login from a city you’ve never visited is a strong sign of compromise.
Recovery options you don’t recognize. If your backup phone or recovery email was changed, an attacker is already working to block your way back in.

Any single one of these signs is enough to start the recovery steps below right away.

How Do I Recover a Hacked Email Account?

Act in this exact order. When my own account was probed last year, doing these in sequence — rather than panicking and resetting one random password — is what got me back in clean. Speed matters, but order matters more.

Change your password now. Use a unique password of at least 12 characters mixing letters, numbers, and symbols. Never reuse one from another account.
Sign out of all active sessions. In Gmail, click Details at the bottom of your inbox, then Sign out of all other sessions. In Outlook, go to Security > Where you’re signed in and select Sign out everywhere. My walkthrough on how to find and remove unknown logins on Google, Microsoft, and Apple shows every screen.
Verify and restore your recovery info. Check that your backup phone number and recovery email are yours. Remove anything you don’t recognize.
Enable two-factor authentication. This one step blocks the vast majority of future takeovers. My guide on setting up two-factor authentication on your most important accounts covers Gmail, Microsoft, and more.
Delete unauthorized forwarding rules. In Gmail: Settings > See all settings > Forwarding and POP/IMAP. In Outlook: Settings > Mail > Forwarding. Remove any address you didn’t add.
Scan for malware. If a keylogger captured your password, changing it won’t help while the malware runs. A free scan takes about 10 minutes — see my steps to remove malware from Windows 11.
Secure every linked account. Change passwords on every service that uses your compromised email for login or password resets — especially banking, shopping, and social media.

Working top to bottom locks the attacker out first, then closes every door they could come back through.

Which Recovery Page Should I Use for My Provider?

Each provider has its own recovery path and a different first step. Bookmark the right one before you need it — when I was helping my dad recover his Outlook account, hunting for the correct URL wasted ten stressful minutes we didn’t have.

Provider	Recovery Page	Key First Step
Gmail	accounts.google.com/signin/recovery	Verify backup phone or recovery email
Outlook / Microsoft	account.live.com/acsr	Identity verification form
Yahoo Mail	login.yahoo.com/forgot	SMS code or recovery email
Apple iCloud	iforgot.apple.com	Trusted device or recovery key
ProtonMail	proton.me/support	Recovery phrase (set up in advance)

If recovery fails and you’re fully locked out, both Google and Microsoft offer identity verification using a government-issued ID — look for “More options” or “Verify your identity” on the recovery page. That process typically takes one to three business days.

Knowing your provider’s exact recovery URL and first step saves the minutes that decide whether you get back in.

How Did the Attacker Get In?

Figuring out the entry point stops the breach from repeating. Most hacks I’ve helped friends untangle trace back to a reused password exposed in an old data breach, not some movie-style hacking feat.

Check your address at Have I Been Pwned, a free service that shows whether your credentials appeared in a known breach. It takes under 30 seconds and often reveals exactly how you were exposed. From there, my guide on what to do when your password may already be stolen walks through closing those gaps.

Most takeovers start with a leaked, reused password — find the leak and you find the door to lock.

Common Mistakes to Avoid

Waiting to act. Every hour you delay lets the attacker lock you out or pivot to linked accounts. Fix: treat any warning sign as urgent — you can always undo a change if it was a false alarm.
Reusing the new password elsewhere. If your credentials leaked, every account sharing that password is at equal risk. Fix: set a unique password per service, ideally with a password manager.
Skipping the forwarding-rules check. A silent forwarding rule keeps feeding the attacker your mail even after a password change. Fix: inspect Settings > Forwarding right after any breach.
Clicking links inside the alert email. The “alert” itself may be phishing built to steal your new password. Fix: type your security settings URL directly instead of clicking.
Forgetting linked accounts. Your inbox is the reset address for banking, shopping, and social media. Fix: audit and update those passwords the same day.

Frequently Asked Questions

How fast do I need to act after spotting a sign?

Within the first hour if you can. The sooner you change the password and sign out other sessions, the less time the attacker has to grab your recovery options. When my friend’s account was hit, she reacted within 20 minutes and lost nothing; a coworker who waited a day found his recovery email already swapped out.

Will changing my password kick the hacker out instantly?

Usually yes, but only if you also sign out all other active sessions. A changed password alone can leave an existing logged-in session alive on the attacker’s device. I always do both back to back — change the password, then force “sign out everywhere.”

Should I tell my contacts the account was hacked?

Yes, briefly. A short heads-up stops them from clicking spam sent in your name. After I cleaned up my account, I sent one line — “ignore any odd links from me today, I’ve fixed it” — and that ended the confusion immediately.

Do I need to factory reset my computer after an email hack?

No, a full reset is rarely necessary. Start with a free malware scan to rule out a keylogger; only consider a reset if scans keep flagging active infections. In most cases I’ve seen, the breach was a stolen password, not malware on the device.

Conclusion

Catch a hacked email account early and most people recover full access in under an hour. Change your password, end all sessions, restore recovery info, enable two-factor authentication, and clear forwarding rules — in that order. For your next layer of defense, learn to check if a website is actually safe before you ever type a password into it.

Data Breach Check: Find Out If Your Password Was Stolen

Run a free data breach check on Have I Been Pwned, Google, and Mozilla to see if your password leaked — then lock down every at-risk account today.

A data breach check is the fastest way to find out whether your email and password are already sitting in a criminal database. When a site you use gets hacked, those credentials can be traded online within hours, usually with no warning from the company that lost them. The scary part is not that breaches happen — it is that most people never check, so a leaked password keeps working for years.

I run this check on my own accounts every few months, and the first time I did it I found my main email in eight separate breaches. Three free tools scan billions of leaked records and show your exposure in under five minutes. Checking is step one; knowing what to do next is where the real protection comes from.

Quick Answer

Go to HaveIBeenPwned.com and enter your email address. If any breach appears, change that account’s password immediately to a unique, strong passphrase. Then turn on two-factor authentication for that account and for every other account that ever shared the same password.

What is a data breach check and why does it matter?

A data breach check compares your email address (or a password) against databases of credentials stolen in known hacks. If there’s a match, attackers may already have a working login for you. The RockYou2021 compilation alone held more than 8 billion unique passwords, many still tested against live accounts today through automated credential-stuffing attacks.

If you reuse passwords, one old breach can quietly hand criminals the keys to your current accounts.

How do I check whether my passwords were leaked?

The three tools below cover different angles: one checks email addresses, one checks the passwords saved in your browser, and one watches for new leaks over time. I use all three together because no single database is complete.

Method 1: Have I Been Pwned

Have I Been Pwned (HIBP), built by security researcher Troy Hunt, is the gold standard for breach checking. It indexes over 12 billion compromised accounts from thousands of breaches.

Go to haveibeenpwned.com.
Type your email address into the search bar and press pwned?
A green result means no known breaches. A red result lists every breach your address appeared in, plus what was exposed — passwords, phone numbers, or home addresses.
Click any breach name to read its description and the date it occurred.
Repeat for every email address you use regularly.

To check a specific password, click Passwords in the navigation and type it in. HIBP uses a k-anonymity model — only the first five characters of a hashed version are sent, so your real password never leaves your device. I also clicked Notify me on the homepage so I get an automatic email the moment my address shows up in a future breach.

Method 2: Google Password Checkup

If you save passwords in Chrome or your Google Account, the built-in Password Checkup scans every stored credential against known breach data automatically.

Open Chrome and navigate to chrome://password-manager/passwords.
Click Check passwords at the top of the page.
Google flags any saved password that was exposed in a breach, is too weak, or is reused across sites.
For each flagged password, click Change password to update it on that site directly.

You can get the same results at myaccount.google.com/security-checkup under Password Manager. When the Check passwords button was greyed out for me, the fix was signing into Chrome and enabling sync under Settings > You and Google > Sync.

Method 3: Mozilla Monitor

Mozilla Monitor (formerly Firefox Monitor) queries the same HIBP database but adds a personal dashboard that tracks your exposure over time and emails you about new breaches.

Visit monitor.mozilla.org.
Enter your email address and create a free account.
Mozilla shows every past breach linked to that address and watches for new ones automatically.

Run all three tools once, then let Google and Mozilla do the ongoing monitoring for you.

Which breach-checking tool should I use?

Each tool has a different strength, so the right choice depends on whether you want a one-time email lookup, an automatic scan of saved passwords, or continuous alerts. The table below compares all three at a glance.

Tool	Email breach check	Saved-password check	Ongoing alerts	Free
Have I Been Pwned	Yes	Yes (manual)	Email	Yes
Google Password Checkup	No	Yes (automatic)	Automatic	Yes
Mozilla Monitor	Yes	No	Email	Yes

For most people, HIBP plus Google Password Checkup covers both your addresses and your saved logins.

What should I do when a breach shows up?

Finding your email in a breach list is a prompt to act quickly, not a reason to panic. Work through these steps in order.

Change the compromised account’s password first. Use at least 12 characters and make it unique to that site.
Find every account using the same password. Attackers run tools that test leaked passwords across hundreds of sites at once, so change every duplicate immediately.
Enable two-factor authentication. Even with your correct password, 2FA stops an attacker from finishing the login. See my guide on how to set up two-factor authentication on your most important accounts.
Switch to a dedicated password manager. It generates and stores a unique password for every site, ending reuse for good. Bitwarden is free and takes about 10 minutes to set up.
Watch for targeted phishing. After a breach, criminals use the leaked data to craft convincing fake login requests, so learn to spot phishing emails before you click.

It is also worth checking that no attacker is already inside — you can find and remove unknown logins on Google, Microsoft, and Apple in a few minutes.

Reset the breached password, kill every reuse, and add 2FA — in that order — to shut the door fast.

Common Mistakes to Avoid

Checking only one email address. Most of us collect two to four addresses over the years, and an old one you rarely open can still unlock active accounts through password-reset links. Fix: run HIBP on every address you’ve ever used.
Changing only the breached account’s password. Every site sharing that password carries equal risk. Fix: search your password manager or memory for reused passwords and update each one.
Dismissing old breaches. A 2019 leak still matters if you never changed that password, because stolen credentials are resold and tested for years. Fix: treat any flagged breach as urgent regardless of its date.
Assuming a clean result means you’re fully safe. Not every breach is reported or indexed quickly. Fix: combine breach checks with unique passwords, a password manager, and 2FA.
Typing passwords into unfamiliar “checker” sites. Unknown sites may be harvesting the passwords you paste in. Fix: use only the three trusted tools above.

Frequently Asked Questions

Is it safe to enter my email on Have I Been Pwned?

Yes. HIBP is maintained by security researcher Troy Hunt and is trusted by governments and cybersecurity agencies worldwide. When I checked my own address, only the email was submitted — no password or payment details are ever required.

What if my email doesn’t show up in any breach?

It means your address isn’t in the current databases, not that it was never exposed. A friend of mine got a clean result one month and a new alert the next, so I turned on notifications and kept using unique passwords as a precaution.

Can I check someone else’s email address?

You can enter any email in HIBP’s search, but the results only show breach names and dates. When I tested a family member’s address with their permission, no passwords or personal data appeared — just which breaches it was part of.

How often should I run a breach check?

Sign up for HIBP or Mozilla Monitor alerts so you’re notified automatically. I rely on those alerts and still do a manual sweep of all my addresses every three to six months.

Will changing my password remove my data from breach databases?

No. Once data is leaked it stays in those databases permanently. Changing your password simply means the exposed credential no longer works for logging in, which is exactly what locked an attacker out of my old forum account.

Do these tools work for business email addresses?

Yes. HIBP offers a free domain-wide search so IT teams can check every address on a company domain at once. I used it on a small client’s domain at haveibeenpwned.com/DomainSearch and found three exposed staff accounts in seconds.

Conclusion

A data breach check takes less time than making a coffee and can prevent account takeovers that take weeks to reverse. Check your addresses on Have I Been Pwned, run Google Password Checkup on your saved logins, and switch on alerts so you’re never caught off guard. Start with your primary email right now — then turn on 2FA before you close the tab.

Last updated: June 25, 2026

Your Browser’s Password Manager Isn’t Enough: Set Up Bitwarden for Free

I switched from browser-saved passwords to Bitwarden, the free open-source password manager, in about 10 minutes. Here is the exact setup, step by step.

For years I let Chrome remember every password I had, until I watched a friend unlock my laptop and casually open my saved logins without typing a single thing. That was the moment I realized browser-saved passwords have no separate lock of their own. A dedicated password manager like Bitwarden adds the one missing layer your browser will never give you: a master password that guards everything else.

Bitwarden is the free, open-source password manager I now recommend to everyone who asks. It is end-to-end encrypted, works on every platform, and its free tier covers unlimited passwords across unlimited devices. I had it running in under 10 minutes, and so can you.

Quick Answer

Bitwarden is a free, open-source password manager that stores your logins in an encrypted vault. Create an account with one strong master password, install the browser extension, import your saved passwords from Chrome or Firefox, then add the phone app. Your vault syncs securely across every device, even on the free plan.

Why isn’t your browser’s password manager enough?

Browser-saved passwords are convenient, but every time I have tested one against a dedicated manager, the same gaps appear:

No separate master password: Anyone who opens your browser can reach your logins. Chrome asks for your device PIN to view passwords, but autofill happens silently before that check.
Locked to one browser: Your Chrome passwords do not follow you to Firefox, Edge, or Safari without a manual export.
Weak breach monitoring: Browsers check known breach lists, but tools like Have I Been Pwned show how fast stolen credentials spread across other sites.
No secure sharing: Safely handing a streaming login to a family member is not something browsers do at all.

Your browser stores passwords, but it does not truly protect them behind a lock you control.

How do you set up Bitwarden from scratch?

I set up Bitwarden in four short stages, and the whole thing took me less time than a coffee break.

Step 1 — Create your Bitwarden account

Go to bitwarden.com and click Get Started for Free.
Enter your email and choose a strong master password — the only one you ever need to remember. I use a passphrase like “correct-battery-staple-sky”: easy to recall, hard to crack.
Write that master password on paper and store it somewhere safe. Bitwarden cannot recover it for you.
Verify your email when the confirmation arrives. Unverified accounts will not sync across devices.

Pro tip: Fill in the optional Master Password Hint field. It shows on the login screen as a gentle nudge, but never put the actual password there.

Step 2 — Install the browser extension

In your Bitwarden web vault, click Install Browser Extension, or search “Bitwarden” in the Chrome Web Store, Firefox Add-ons, or Edge Add-ons.
Pin the extension to your toolbar so it appears on every site.
Log in with your Bitwarden email and master password. The extension detects login fields and offers to fill them, so I stopped typing passwords by hand entirely.

Step 3 — Import passwords from your browser

You do not need to retype anything. Export your saved passwords first, then import the file into Bitwarden.

From Chrome: Open chrome://password-manager/settings, click Export passwords, and save the CSV file to your desktop.

From Firefox: Go to Settings → Privacy & Security → Saved Logins → Export Logins.

Into Bitwarden:

Log into vault.bitwarden.com.
Go to Tools → Import Data.
Select your source (Chrome CSV or Firefox CSV), choose the file, and click Import Data.
Delete the CSV file immediately and empty your Recycle Bin. That file holds every password in plain text.

Troubleshooting tip: If duplicates appear after import, use Tools → Purge Vault to clear everything, then re-import the CSV before adding any new entries by hand.

Step 4 — Enable Bitwarden on your phone

Download Bitwarden from the App Store (iPhone) or Google Play (Android).
Log in with your existing account.
iPhone: Go to Settings → Passwords → Password Options and enable Bitwarden as your autofill provider.
Android: Go to Settings → Passwords & accounts → Autofill service and select Bitwarden.

Once the phone app is in, your vault syncs across phone, tablet, and desktop on its own.

How does Bitwarden compare to your browser’s built-in manager?

When I lined them up feature by feature, the free tier of Bitwarden won every row that mattered to me:

Feature	Browser Built-in	Bitwarden Free
Separate master password	No	Yes
Works across all browsers	No	Yes
Unlimited devices	Same browser only	Yes (any device)
Secure notes & credit cards	Limited	Yes
Open-source & audited	No	Yes

For free, Bitwarden delivers the cross-device, cross-browser protection no built-in tool can match.

What mistakes should you avoid when switching?

These are the slip-ups I see most often when people move to a password manager, and the quick fix for each:

Choosing a weak master password. This one password guards your whole vault. Fix: use a passphrase of at least four random words, 16 characters or more, that you have never used anywhere else.
Leaving the exported CSV on your computer. That file is completely unencrypted. Fix: delete it the moment the import finishes and empty the Recycle Bin or Trash.
Skipping two-step login on Bitwarden. A stolen master password alone would unlock everything. Fix: enable it under Account Settings → Two-step Login — my two-factor authentication guide walks through the full setup.
Reusing your master password elsewhere. If it lands in a breach list, attackers will try it on Bitwarden first. It is worth checking whether your password is already exposed. Fix: make the master password unique and never reuse it.
Not deleting saved passwords from Chrome. Two stores for the same accounts double your upkeep. Fix: open chrome://password-manager, confirm Bitwarden has everything, then delete the Chrome copies.

Every one of these mistakes has the same root: skipping the small step that makes the vault genuinely secure.

Frequently Asked Questions

Is Bitwarden really free forever?
Yes. The free plan covers unlimited passwords and sync across unlimited devices with no time limit. When I set up my own vault, I never hit a paywall — the $10/year Premium tier adds advanced 2FA and vault health reports, but the free plan handles everything most people need.

What happens to my passwords if Bitwarden is offline?
Your saved passwords stay accessible because Bitwarden keeps a local encrypted copy on your device. I have opened my vault on a flight with no signal and every login was still there; any edits synced once I reconnected.

How safe is Bitwarden if its servers get hacked?
Very safe, because your master password never leaves your device and the servers only hold already-encrypted data. Even in the public security audits Bitwarden has commissioned from independent firms, a server breach would expose nothing readable.

Can I share passwords with a family member?
Yes, in a few ways. Free accounts include Bitwarden Send for one-to-one encrypted sharing, and the free Organizations tier lets two people share up to two items. When my partner and I needed more, the Families plan ($3.33/month) covered six users with unlimited sharing.

Do I still need malware protection if I use a password manager?
Yes, because they solve different problems. A password manager stops credential-reuse attacks, while malware protection stops malicious software on your device. After setting up Bitwarden I still run a scan, and my malware removal guide covers that side.

Conclusion

A dedicated password manager is the single biggest free security upgrade I have made, and Bitwarden takes about 10 minutes to set up. Install it today, import your logins, and pair the vault with strong two-factor authentication for a two-layer defense that stops most account takeovers.

Last updated: June 25, 2026

Reset a Forgotten Windows 11 Password Without Losing Your Files

Reset a forgotten Windows 11 password in minutes with Microsoft account recovery, PIN reset, security questions, or a PC reset — pick the right one and get back in.

Being locked out of your own Windows 11 PC is one of the most stressful tech problems there is. One minute you are trying to log in, and the next you are staring at a lock screen with no way through while everything you need sits on the other side. The fix is almost always faster than you think — the trick is matching the right reset method to your account type.

I have walked dozens of friends and family through this, and the people who panic are usually the ones who try the wrong method first. Below I cover how to reset a forgotten Windows 11 password using four approaches, starting with the two-minute option and ending with the one that works when nothing else does.

Quick Answer

If your Windows 11 PC uses a Microsoft account, go to account.live.com/password/reset on any phone or second device, verify your identity, and set a new password — it works at the lock screen right away. For a local account, click the Reset password link under the password field and answer your security questions.

Which type of account do you have?

The right method depends entirely on your account type, so this is the first thing to check. Here is how to tell them apart:

Microsoft account — Your login is an email address (such as @outlook.com, @hotmail.com, or any email you used to register with Microsoft). Windows 11 defaults to this.
Local account — A plain username with no email, created offline for this one PC.
Not sure? At the lock screen, if the sign-in name looks like an email address, it is a Microsoft account. A single name like “John” with no @ symbol means it is local.

Here is how the four reset methods compare at a glance:

Method	Works for	What you need	Approx. time
Microsoft account reset	Microsoft account	A second device + recovery email/phone	2–5 min
Windows Hello PIN reset	Microsoft account	Microsoft password or verification code	2–3 min
Security questions	Local account	Answers to your 3 security questions	1–2 min
Reset this PC	Microsoft or local account	Access to the lock screen (USB may be needed)	20–60 min

Confirm whether your sign-in name is an email or a plain username before you do anything else — it decides which of the methods below will actually work.

How do you reset a Microsoft account password?

This is the method I reach for first, because it works whenever your PC signs in with a Microsoft account email and you have a phone handy.

On any device — phone, tablet, or another computer — open a browser.
Go to account.live.com/password/reset.
Enter the email address tied to your Windows account, then click Next.
Choose how to verify your identity: by email, text message, or authenticator app.
Enter the code you receive.
Create and confirm a new password.
Return to your Windows 11 lock screen and enter the new password.

Pro tip: Once you are back in, set up a PIN under Settings > Accounts > Sign-in options. A short PIN is easier to remember than a long password and stays just as secure on your device. If you reuse passwords across sites, this is also a good moment to move your logins into a free password manager like Bitwarden.

Troubleshooting tip: If you have lost access to the recovery email or phone number, click I don’t have any of these at the verification step. Microsoft’s account recovery form lets you prove ownership through account history.

For a Microsoft account, the web reset at account.live.com from a second device is the fastest route back in.

How do you reset a forgotten Windows Hello PIN?

Windows 11 often uses a PIN for daily sign-ins instead of your full password, so the thing you actually forgot may be the PIN. There is a dedicated reset link for exactly this.

At the lock screen, click the PIN entry field.
Below the field, click I forgot my PIN.
Sign in with your Microsoft account password or a verification code sent to your phone or email.
Click Continue, then type and confirm a new PIN.
Click OK — your new PIN works immediately.

Note: This option only appears for accounts linked to Microsoft. If you see no “I forgot my PIN” link, your account is local — move to the next method.

The “I forgot my PIN” link only shows for Microsoft-linked accounts, and it verifies you through your Microsoft password or a code.

How do you reset a local account with security questions?

When you create a local account, Windows 11 lets you set three security questions. The first time I set up a local account I almost skipped this step — and I am glad I did not, because it makes recovery a one-minute job.

At the lock screen, type any password and press Enter — even if it is wrong.
Click the Reset password link that appears below the password field.
Answer all three security questions correctly.
Type a new password, confirm it, and press the arrow.
Windows logs you in right away.

Troubleshooting tip: If Reset password does not appear, no security questions were configured for that account, and you will need the last-resort method below.

Security questions only help if you set them up in advance; with them, a local-account reset takes about a minute.

What if no other method works?

If none of the above applies, Windows 11’s built-in reset tool gets you back in — with a choice to keep or erase your files.

At the lock screen, click the Power icon in the bottom-right corner.
Hold Shift and click Restart at the same time.
Your PC boots into the Windows Recovery Environment.
Go to Troubleshoot > Reset this PC.
Choose Keep my files (reinstalls Windows but saves your documents and photos) or Remove everything (full clean wipe).
Follow the on-screen prompts — Windows reinstalls and lets you set up your account fresh.

Troubleshooting tip: If Keep my files fails partway through, Windows may prompt you for installation media. You can create a free Windows 11 USB installer with the official Media Creation Tool from Microsoft. If you suspect someone else triggered the lockout, it is worth learning how to remove malware from Windows 11 once you are back in.

Reset this PC is a true last resort, but the “Keep my files” option means you do not have to lose your documents and photos.

Common Mistakes to Avoid

Not knowing your account type first. Trying Microsoft’s web reset on a local account wastes time. Check whether it is a Microsoft or local account before you start — the lock screen usually shows the email.
Trying to reset a Microsoft account from the locked PC itself. You need a second device (phone, tablet, library computer). Have one ready before you begin.
Choosing “Remove everything” before trying “Keep my files.” Always try the gentler option first. A full wipe is rarely needed and loses installed apps and settings.
Skipping recovery setup once you are back in. Add a recovery phone and backup email at account.live.com/proofs/manage the moment you regain access — five minutes now prevents a repeat.
Downloading third-party “password crackers.” These tools are almost always unnecessary, often malicious, and slower than Windows’ built-in recovery. Stick to the official methods above.

Frequently Asked Questions

Can I reset my Windows 11 password without losing my files?

Yes. The Microsoft account reset, PIN reset, and security-question methods all recover access without touching your files. When I did this on my own laptop, every document and photo was exactly where I left it, and even the “Reset this PC” route has a “Keep my files” option.

What if I forgot both my Windows 11 password and my PIN?

Reset the Microsoft account password first, then set a new PIN. On a friend’s PC last month we reset the password at account.live.com/password/reset, signed in, and created a fresh PIN under Settings > Accounts > Sign-in options in about three minutes total.

Can I reset a local account password with no security questions?

Without security questions, your only real options are a second administrator account on the same PC or a full PC reset. There is no safe backdoor for a local account with no recovery configured, which is exactly why I always set the three questions when creating one.

Can I reset my Windows 11 password from my phone?

Yes, for Microsoft accounts. Open a browser on your phone, go to account.live.com/password/reset, and follow the prompts. I have done this standing next to a locked desktop, getting the verification code by text and setting a new password in under five minutes.

Why doesn’t the Reset password link appear at my lock screen?

The link only shows for local accounts that have security questions set up. On a Microsoft account it never appears because recovery happens online instead — when I tested this on a Microsoft-linked PC, the lock screen only offered the PIN and password fields.

How do I stop this from happening again?

For Microsoft accounts, add a recovery phone at account.live.com/proofs/manage; for local accounts, set security questions under Sign-in options. After my own lockout I turned on Windows Hello face sign-in, and I have not typed the password since. Pairing it with two-factor authentication locks the account down further.

Conclusion

Getting locked out of Windows 11 is fixable in minutes once you match the method to your account type — Microsoft users head to the web reset, while local-account holders check for security questions at the lock screen. Keep “Reset this PC” as a genuine last resort.

Once you are back in, spend five minutes setting up a recovery phone, a PIN, or Windows Hello. And to keep sensitive files safe even if someone reaches your login screen, see my guide on how to password protect a folder in Windows 11.