Your starting list: your devices, your accounts and the two keys

List every device and the accounts that matter, mark your main email and your phone number as the two keys to the rest, and make the screen comfortable to read first.

1. Why a list comes first Understand

Every free security curriculum we compared, and the two US organizations that run Cybersecurity Awareness Month, start with the same four actions: strong passwords with a password manager, a second step at sign-in, automatic software updates, and spotting scams. The Cybersecurity and Infrastructure Security Agency (CISA), the federal agency for civilian cybersecurity, lists them as update often, use strong passwords, turn on multifactor authentication, and spot phishing (CISA, Cybersecurity Awareness Month). The National Cybersecurity Alliance, the nonprofit that runs the month with CISA, gives the same four (National Cybersecurity Alliance, Cybersecurity Awareness Month). The SANS Institute's free newsletter calls them the Core Four (SANS OUCH!, Focus on the Core Four).

This manual covers all four in Passwords, Two-step sign-in and passkeys, Your phone and tablet, Your computer and home Wi-Fi, Backups and Recognizing scams. Each of them is something you do to a device or an account. Before you can do any of them, you need to know which devices and accounts you have. That is the job of this chapter.

What the list does

The list does three things for the rest of this manual.

• It sets the order. Some accounts can open others. The list marks those, so you change them first.
• It shows what each device needs. An iPhone, an Android tablet and a Windows laptop each keep their settings in a different place. The list names the system on each one, so the steps in the other chapters match what you have.
• It records what is switched on. Other chapters add columns: where a password is kept, whether two-step sign-in is on, when the backup last ran. When you check again in six months, the list shows what you did and when.

No agency we read tells households to keep a written list of their accounts. The list is this manual's method, built on the agency advice that email comes first (the next sections give the sources). Our convention

What stays off the list

The list names accounts and settings. It holds nothing that opens them. Keep these off every sheet in this manual, on screen and on paper:

• passwords, and hints that give a password away
• PINs and phone passcodes
• sign-in codes and backup codes
• answers to security questions
• full card numbers, full bank account numbers and Social Security numbers

Where the list needs to say something about one of these, it says where the thing is kept: "password book, kitchen drawer," "printed codes, passport folder," "card ends in 4417." Our convention

There are two reasons. The sheets are stored in this browser, so anyone who uses this browser on this device can open them. And the printed list is paper, so anyone who can reach the drawer it is in can read it. A list that holds only account names tells that person what you have. It does not let them in.

2. Make the screen comfortable to read

The rest of this manual asks you to read settings screens and type carefully. Do this first, so the small print on those screens is not the hard part. There are three places to change the size of what you see: this manual's own pages, your device's text size, and your device's magnifier.

On these pages

Every page of this manual has a Text size control in the menu. On a computer the menu is down the left side of the page. On a phone, tap Menu at the top of the page to open it, and tap outside it to close it.

1. Open the menu.
2. Find Text size.
3. Tap A for the smallest size, A+ for larger, or A++ for the largest.

This manual starts at A+. Your choice is saved in this browser on this device, and every page of this manual uses it. It changes only this manual's pages, not your device's other apps.

On your device

Your device's own text size changes the text in its settings screens and in most apps. Find your device in the table. If you are not sure which device or system you have, the device section below shows how to tell.

The steps for each one follow, one action per step.

iPhone and iPad

1. Open the Settings app.
2. Tap Display & Brightness.
3. Tap Text Size.
4. Drag the slider until the text is comfortable.

In short: Settings > Display & Brightness > Text Size. For sizes beyond the end of that slider, open Settings, tap Accessibility, tap Display & Text Size, then tap Larger Text. Apple notes that text made very large can make buttons in some apps hard to tap; if that happens, go back and move the slider down a step. Product-specific

Android phone or tablet

1. Open the Settings app.
2. Tap the search box at the top and type Font size.
3. Tap Font size in the results.
4. Move the slider until the text is comfortable.

In short: Settings > search Font size. Search for Display size the same way to make buttons and icons larger too. Google says the font size setting does not apply in some apps, and that some steps need Android 13 or later. These are the steps for Google's Pixel phones; other makers' menus differ, and searching Settings for "font size" is the quickest way in on any of them. Product-specific

Mac

1. Click the Apple menu in the upper-left corner of the screen.
2. Choose System Settings.
3. Click Accessibility in the sidebar.
4. Click Display.
5. Scroll to Text and drag the Text size slider to the right.

In short: Apple menu > System Settings > Accessibility > Display > Text size. In Safari, Command and Plus (+) makes a page's text larger. Apple's Zoom setting enlarges the whole screen once you turn on its keyboard shortcuts.

Windows

1. Select the Start button.
2. Select Settings.
3. Select Accessibility.
4. Select Text size.
5. Move the Text size slider to the right.

In short: Start > Settings > Accessibility > Text size. On Windows 10 the setting is under Ease of Access instead: Start > Settings > Ease of Access > Display > Make text bigger. Magnifier enlarges part of the screen without changing any setting: hold the Windows logo key and press Plus (+) to start it, and press the Windows logo key and Esc to stop it.

3. Your devices: what each one is and what it runs

A device, in this manual, is anything you sign in to: a phone, a tablet, a computer or a Chromebook. Each one runs an operating system, the software that starts when the device turns on and holds its settings: iOS on an iPhone, iPadOS on an iPad, Android on most other phones and tablets, macOS on a Mac, Windows on most other computers, and ChromeOS on a Chromebook. The operating system decides where every setting in this manual lives, and its version number decides whether the device still gets security fixes (Your phone and tablet and Your computer and home Wi-Fi).

The device list has one row per device, with four things this chapter fills in: what the device is, what kind it is, who uses it, and the system and version it runs. The other columns are filled in by the other chapters.

How to tell what you have

If you are not sure what a device is, its own settings screen will say. Each kind of device has a different way into its settings, and that difference is itself the first clue.

The steps for each kind follow. Write what you read in the "System and version" column of the device list.

iPhone and iPad

1. Open the Settings app.
2. Tap General.
3. Tap About.
4. Read the line iOS software version (on an iPad, iPadOS software version).
5. Read the line Model Name, for example "iPhone 13".

In short: Settings > General > About (Apple iPhone User Guide, Get information about your iPhone; Apple iPad User Guide, Get information about your iPad). Write the model name and the version, for example "iPhone 13, iOS 27.0.1". The same screen shows the model number and the serial number; the list does not need them.

Android phone or tablet

1. Open the Settings app.
2. Scroll down and tap About phone (on a tablet, About tablet).
3. Tap Android version.
4. Read the Android version number.
5. Read the Android security update date.

In short: Settings > About phone > Android version (Google Android Help, Check and update your Android version). These are the steps for Google's own Pixel phones; other makers' menus differ. Write the maker and model, the Android version and the security update date, for example "Pixel 8, Android 16," and the security update date as shown. The security update date matters more than it looks: Your phone and tablet uses it to check whether the phone is still getting fixes.

On a Samsung Galaxy phone or tablet, the version is one tap further in:

1. Open the Settings app.
2. Tap About phone (on a tablet, About tablet).
3. Tap Software information.
4. Read the version lines on that screen.

In short: Settings > About phone > Software information (Samsung US Support, How to update your Galaxy phone or tablet). Samsung says its screens vary by phone company, software version and model. Product-specific

Windows computer

1. Select the Start button, at the bottom of the screen.
2. Select Settings.
3. Look at the list of settings down the left side of the window.
4. If Windows Update is its own item in that list, write "Windows 11." If you see Update & Security instead, write "Windows 10."

In short: Start > Settings, then look for Windows Update (Windows 11) or Update & Security (Windows 10). Microsoft's own pages give the update steps for the two systems with those two different paths (Microsoft Support, Install Windows Updates), and its text-size page does the same with Accessibility and Ease of Access. This is a quick way to tell the two apart, not Microsoft's own test; Your computer and home Wi-Fi shows where Windows names its exact version. Test it

The difference matters. Microsoft's update page notes that support for Windows 10 ended on October 14, 2025, which means no more free security fixes from Windows Update. Your computer and home Wi-Fi covers what that means and the options. For now, write which one you have.

Mac

1. Click the Apple menu in the upper-left corner of the screen.
2. Choose About This Mac.
3. Read the name and version number of macOS in the window that opens.

In short: Apple menu > About This Mac. Apple's support article on finding the macOS version says the window shows the name and version number of the macOS the Mac is using, though its layout can differ from Mac to Mac. Write both, for example "MacBook Air, macOS Tahoe 26.7.1."

Chromebook

1. At the bottom right of the screen, select the time.
2. Select Settings.
3. At the bottom left, select About ChromeOS.
4. Select Additional details.
5. Read the Update schedule section, which says when the Chromebook will get its last update.

In short: Settings > About ChromeOS > Additional details > Update schedule (Google Chromebook Help, Check your Chromebook's update schedule). Write "ChromeOS" in the system column, and copy the update schedule date into "Gets updates until." That date is one Your computer and home Wi-Fi would otherwise send you back for.

Who uses each device

Write a name in "Who uses it" for every device, even when the answer is "just me." A device that two people use is a device whose passcode two people know, and whose saved passwords and email may be open to both. That is not wrong. It changes what Your phone and tablet says about screen locks and what Your security file says about a shared security file. If a grandchild or a neighbor sometimes uses a tablet, write that too.

Include devices that are put away: the old phone in a drawer, the laptop that no longer charges. If it was ever signed in to your email or your Apple, Google or Microsoft account, it may still be. Your computer and home Wi-Fi covers erasing an old device before it leaves the house; for now, give it a row and write "old, in the drawer" in the device column.

4. The two keys: your main email and your phone number

Two things on your list open most of the others. This manual calls them the two keys: your main email address and your phone number. Our convention

Why email is the first key

When you forget a password, most sites send a reset link to your email. So whoever can read your email can ask for a new password to almost everything else. The UK's National Cyber Security Centre (NCSC), the British government's cybersecurity agency, says a criminal in your email could reset your other account passwords, and tells readers to use an email password they use nowhere else (NCSC, Use a strong and separate password for your email). The Federal Trade Commission's guide to hacked accounts makes the same point: someone with your email can request password reset links for your other accounts (FTC, How to Recover Your Hacked Email or Social Media Account).

CISA's older password page, now archived and kept here as an example rather than current advice, told the chain as a story: one password reused on several accounts let an attacker into a person's email, and from the email into the bank (CISA, Use Strong Passwords, archived page). Passwords deals with the reused password. This chapter marks the email so you know which password to change first.

Which email is the main one

Your main email is the address your important accounts send to. Many people have more than one address: an old one from an internet company, one from work, one made for shopping. The main one may not be the one you read most. It is the one your bank, your card company, your phone company and your Apple, Google or Microsoft account would write to if you forgot a password.

To find it:

1. Find the last message from your bank or card company: a statement notice, an alert or a "your payment is due" message.
2. Look at the address it was sent to. Your email app shows it under the sender's name or when you open the message details.
3. Do the same for your phone company's last bill notice.
4. Do the same for a message from Apple, Google or Microsoft about your account.
5. The address that appears most often is your main email. Write it at the top of the account list.

If two addresses each get some of these, write both, mark the one with more of your money accounts as the main one, and note the other in the Notes column. Passwords puts a new password on the main one first and the other one second. If an important account sends to an address you can no longer open, note it; Getting back in is where that gets fixed. Our convention

Writing the email address on the list is fine. An address is how people reach you, not a way in. The password stays off the list.

Why your phone number is the second key

Many accounts send a code by text message when you sign in from a new place or reset a password. Whoever receives texts sent to your number can receive those codes. The National Institute of Standards and Technology (NIST), the federal agency that writes the US government's sign-in standards, names the risk in its 2025 guidance: an attacker who persuades the phone company to redirect a number receives the text codes sent to it (NIST SP 800-63B-4, Authentication and Authenticator Management). Moving someone's number to a new SIM card without their permission is called a SIM swap. CISA's mobile guidance tells people to add a PIN or passcode to their phone company account and require it for changes such as moving the number (CISA, Mobile Communications Best Practice Guidance). Two-step sign-in and passkeys turns that lock on.

The phone number is also how many accounts recognize you when you are locked out. Gmail, Apple and Microsoft each keep a recovery phone on file. Getting back in checks that it is the number you have now.

On the account list, the phone company gets its own row. Write the phone number's last four digits in the Notes column of that row, for example "my mobile, ends 2210." That is enough to tell your numbers apart if you have more than one, and it matches how the recovery sheet records phones in Getting back in. Our convention

5. Your accounts: list them, then rank them

An account is anything you sign in to with a name or email and a password. Most households have dozens. The list does not need all of them on the first pass. It needs the few that would cost the most if someone else got in.

The kinds of account

The device account

Every phone, tablet and computer is signed in to one account that its maker runs. This manual calls it the device account. On an iPhone, iPad or Mac it is your Apple Account. On an Android phone or a Chromebook it is your Google Account. On a Windows computer it is usually your Microsoft account. The device account often holds your photos, your contacts, your backups and, in Passwords, your saved passwords. It is also what finds and erases a lost phone (Your phone and tablet). Product-specific

The device account and the main email can be the same account or two different ones. A Gmail address is a Google Account, so on an Android phone your main email and your device account may be one row. On an iPhone with a Gmail address, they are two accounts: the Apple Account the iPhone signs in with, and the Google Account behind Gmail. Each gets its own row, and each gets its own recovery check in Getting back in.

Ranking: the three that matter most

Once the accounts are on the list, mark the three that matter most in the "Most important" column. This manual ranks them in this order: Our convention

1. The main email, because it can reset the others.
2. The money accounts: the bank or credit union first, then each card and any payment app linked to your bank.
3. The phone company, because it controls the number that receives your codes.
4. The device account: Apple, Google or Microsoft.
5. Everything else, in the order you use it.

For most lists, the three marks go on the main email, the account that holds the most money, and the phone company. If your main email is also your device account (Gmail on an Android phone), mark the email, the bank and the phone company, and the device account is already covered. If you have no bank account online, the three are the email, the phone company and the device account.

No agency publishes this order. It follows from the two keys: change first what can open the rest, then what holds money. Getting back in, Passwords and Two-step sign-in and passkeys work down the list in this order, so the first pass on recovery, passwords and two-step sign-in covers the three you marked.

Where the printed list lives

The account list and the device list are kept in this browser, and you print them in Your security file as part of your security file. Choose now where the paper copy will go, so it does not end up on the kitchen counter.

Google's advice for its printed backup codes is to store them where you keep your passport or other important documents (Google Account Help, Sign in with backup codes). The list holds no codes, but the same place suits it: somewhere you would look in an emergency, that strangers in the house would not open. Our convention

Paper has one strength and one weakness. The NCSC's guidance on writing passwords down says a written record is safe from criminals online, because they would need to be in the room, and asks readers to think about who can enter that room (NCSC, Managing your passwords). The same holds for a list of account names. If you keep passwords in a notebook, keep the printed list somewhere else, so one drawer does not hold the map and the keys together. Our convention

6. See it See it

Free pages that show the steps in each maker's own words:

• Apple iPhone User Guide, Get information about your iPhone: the About screen and what each line means.
• Google Android Help, Check and update your Android version: where an Android phone shows its version and security update date.
• Microsoft Support, Change the size of text in Windows: the Windows 11 and Windows 10 paths side by side.

7. Practice Practice

Minimum: one row on the device list for each device you use, and an account list with your main email, your phone company and your money accounts, three of them marked most important. Time: about 30 minutes; add 10 minutes for each device beyond the first. Materials: each device you use; your last bank or card statement, or the cards themselves; your phone bill or the phone company's app; the device list and the account list, both essential on a first pass.

1. Set the text size. Use this page's Text size control, then your device's own setting from the text size section.
2. Gather the devices. Put every phone, tablet and computer you use in front of you, including any you share.
3. Read each device's system. Use the steps in the device section for each one, and write the device, kind, who uses it, and system and version on the device list.
4. Find your main email. Check which address your bank, card and phone company write to, and write it in the first row of the account list.
5. Add the phone company. Write the phone company's name, and the last four digits of your number in Notes.
6. Add the money accounts. One row for the bank or credit union, one per card, one per payment app linked to your bank. Use names and last four digits only.
7. Add the device account. Apple Account, Google Account or Microsoft account, one row for each one your devices sign in with.
8. Mark the three that matter most. Use this manual's order: the main email, the account that holds the most money, and the phone company.
9. Check that nothing secret is on either list. Read every cell. A password, PIN, code or full number gets deleted and replaced with where it is kept.
10. Choose the place. Write where the printed list will live in the Notes column of the main email row, for example "printed copy: passport folder."

8. Your setup Your setup

The box below reads your setup. It shows where your own devices name their system, the text-size steps for them, and which accounts the account list starts with.

9. Check your work Check your work

Criteria

• Does every device you use, including shared and put-away ones, have a row with who uses it and the system it runs?
• Is the main email in the first row of the account list, and can you say which messages showed you it was the main one?
• Does the phone company have its own row, with the last four digits of the number?
• Are your bank or credit union, each card and the device account on the list?
• Are exactly three accounts marked most important, and do they follow this manual's order?
• Is every cell free of passwords, PINs, codes, security answers and full numbers?
• Do you know where the printed list will go, and is that place apart from any password book?

Worked example

Ruth's lists (fictional) meet each criterion. Her one device has a row with "Ruth" and its system. Gmail is in the first row, and she can name the three messages that showed it was her main email. The phone company has its own row with the last four digits. The credit union, the card and the Apple Account are listed. Gmail, the credit union and the phone company are marked. No cell holds a password or a full number. The printed copy will go in the passport folder, away from the kitchen drawer. That settles what is listed. It does not settle whether any of those accounts can be recovered, or whether their passwords are different from one another; Getting back in and Passwords check those, in that order. Under her assumption that the credit union and the card are her only money accounts, the list is complete for the first pass.

Common mistakes

• Listing the email you read most instead of the one your bank writes to. Check the address on the bank's messages.
• Treating the device account and the main email as the same account when they are not. An iPhone with Gmail has two: the Apple Account and the Google Account behind Gmail.
• Writing a password "just for now." Write where it is kept instead. A list with passwords on it is a different and riskier thing to print.
• Leaving out the old phone in the drawer. If it was ever signed in, give it a row.
• Marking everything most important. Three marks keep the first pass of Getting back in, Passwords and Two-step sign-in and passkeys short enough to finish.

What is still unresolved

This chapter lists what you have. It does not check whether you can get back into any account (Getting back in), whether your passwords are long and different (Passwords), whether two-step sign-in is on (Two-step sign-in and passkeys), or whether your devices still get updates (Your phone and tablet and Your computer and home Wi-Fi). It cannot tell you whether an account has already been broken into; When something goes wrong covers the signs and what to do. In a shared household, who sees which list is for the people in it to decide.

10. Knowledge check and scenario

Checklist

• The text on my screen, and on this manual, is comfortable to read.
• The device list has a row for each device, with who uses it and the system it runs.
• The account list starts with my main email and has a row for my phone company.
• My money accounts and device account are listed, and three accounts are marked most important.
• Neither list holds a password, PIN, code, security answer or full number.
• I have chosen where the printed list will live.
• I ran the account sweep and a built-in breach check. (Go deeper; optional)