How to protect your personal information online.

Quick answer. Unique passwords in a manager, two-factor authentication on the accounts that matter, a pass over breach exposure, then data-broker removals — in that order. The first two block the attacks that actually happen; the rest reduces what a stranger can assemble about you.

Invisibility is not available, and chasing it wastes the effort that works. What is available is a smaller attack surface: fewer reusable credentials, fewer accounts that can be reset by someone who knows your birthday, fewer public listings tying your name to your address.

Start where the attacks actually are

Almost no one is targeted personally. What happens is credential stuffing: a password leaked from one service is tried automatically against hundreds of others. Reuse is what turns one old breach into a chain of account takeovers.

So the first move is a password manager with a unique password per account. The second is two-factor authentication — an app or a hardware key rather than SMS where the choice exists, because a number can be ported away from you and text codes can be intercepted.

The third is recovery. Most account takeovers go through the reset flow rather than the password: an old email address that still works, a phone number you no longer control, security questions whose answers are in any public listing. Fix recovery details on your primary email first — it is the key to everything else.

Deal with the breaches you are already in

Assume your email address appears in several. That is not alarming by itself; what matters is whether the password beside it is one you still use anywhere.

Check your address against known breaches, change anything reused, and treat any account that shares a password with a breached one as breached too. The breach check shows where your address appears.

Where a breach exposed more than a password — an address, a date of birth, the last four digits of an account — assume it is in circulation permanently and adjust the things that depend on it, particularly security questions.

Reduce what is published about you

People-search sites compile public records and commercial data into profiles: current and former addresses, phone numbers, relatives, sometimes property and court references. They are the raw material for both social engineering and ordinary stalking.

Removal works, imperfectly. Most operators publish an opt-out, several brands share upstream checks, and records get re-ingested, so a single pass is not permanent. Work from the largest checks down and repeat the check periodically rather than chasing brand names. The removal guide sets out that order, and the free self-check shows what is visible in the first place.

Four states — California, Texas, Oregon and Vermont — run data-broker registries with different rules about what must be honoured, so the answer you get to a removal request depends partly on where you live.

Stop feeding the compilers

Every loyalty scheme, competition entry, warranty registration and "free" quote form sells or shares what you give it. You cannot avoid all of them, but you can be deliberate: a secondary email address for commercial signups keeps your primary address out of the marketing pool, and a virtual card number limits what a merchant breach exposes.

Social accounts deserve a separate pass. Set old posts to private in bulk where the platform allows it, remove the birth year, and check what your friends list and tagged photographs reveal to someone who is not connected to you. Then look at your profile while logged out — that view, not the one you normally see, is what a stranger gets.

Photographs carry location metadata, and some platforms strip it while others do not. If you post images of your own home, assume the file knows where it was taken.

Protect the identifiers that unlock everything

Your phone number is now an authentication factor, which makes SIM-swap fraud worth someone's effort. Add a carrier PIN or port-out lock; it takes one call and defeats the common version of the attack.

Freeze your credit with all three bureaus if you are not actively borrowing. A freeze is free, reversible, and stops new accounts being opened in your name — the single highest-value control on this page for most people.

Keep the documents that prove identity out of shared drives and email archives. A scan of a passport or a licence sitting in an inbox is a credential waiting for the next mailbox compromise.

A maintenance rhythm that survives contact with real life

Quarterly is enough for most people, and it takes one sitting: run a breach check, review the devices and sessions logged into your main accounts, re-run a search on your own name, and repeat removals where listings have reappeared.

Once a year, go further: check your credit reports, review which third-party apps have access to your email and social accounts, and delete the accounts you no longer use — a dormant account is an unmonitored one.

Key takeaways

Order matters more than effort. Unique passwords, real two-factor authentication and clean recovery details prevent more harm than any amount of removal work.

Removal is maintenance, not a project. Listings return because records are re-ingested; the point is keeping the volume down, not reaching zero.

And check what is actually visible before deciding what to fix — checking yourself costs nothing and replaces guesswork with a list.