---
name: password-and-2fa-setup
description: "Set up a sane password and two-factor-authentication baseline that's genuinely secure and actually sustainable — a password manager, unique passwords where it counts, and 2FA on what matters. Use when asked to improve my password security, set up a password manager, how do I use 2FA, or make my accounts more secure. Produces a prioritized rollout (secure the crown-jewel accounts first), a password-manager setup, a 2FA plan by method strength, backup-code and recovery safeguards, and a realistic order so it gets done, not abandoned."
---

# Password & 2FA Setup

Perfect security advice that nobody follows is useless. This sets up a baseline that's both strong and livable: a password manager doing the remembering, unique passwords on the accounts that matter most, and 2FA where it counts — rolled out in priority order (email and finances first) so you actually finish instead of giving up at account number three.

## What This Skill Produces

- **A prioritized rollout** — secure the crown-jewel accounts first (email, banking, primary logins), then work outward
- **A password-manager setup** — choosing and setting one up, a strong unique master password, importing/replacing weak reused ones
- **A 2FA plan by strength** — authenticator app or hardware key over SMS where possible, on the accounts that matter
- **Recovery safeguards** — backup codes stored safely, recovery contacts, and avoiding lock-yourself-out mistakes
- **A sustainable order** — a realistic sequence so it gets done, not abandoned halfway

## Required Inputs

Ask for these if not provided:
- **Where you are now** — reused passwords? a manager already? any 2FA?
- **Key accounts** — email, banking, work, socials, anything sensitive
- **Comfort level** — how technical, and how much effort you'll sustain
- **Devices** — phone/computer platforms (affects manager and 2FA choices)
- **Concerns** — a specific breach, getting locked out, or general hardening

## Framework: Crown Jewels First, Manager Does The Work

1. **Secure email first.** It's the reset hub for everything — a unique strong password + strong 2FA here protects all the rest.
2. **Let a password manager remember.** Unique, long passwords everywhere are only possible if software stores them; set one up with a strong master password (and 2FA on the manager).
3. **Add 2FA where it counts, by strength.** Prefer an authenticator app or hardware key; SMS is better than nothing but weaker. Prioritize email, finance, and primary accounts.
4. **Protect against lockout.** Save backup/recovery codes somewhere safe, set recovery options, and keep a second 2FA method — so security doesn't lock *you* out.
5. **Sequence it sustainably.** Do the highest-value accounts now, then chip away — a finished baseline beats a perfect plan abandoned.

## Output Format

### Security baseline: [current state] · [comfort level]

**Order of operations**
1. Email: unique password + [authenticator/hardware] 2FA + save backup codes.
2. Set up a password manager (strong master password + 2FA on it).
3. Banking/finance: unique passwords + strongest available 2FA.
4. Work + primary logins: same.
5. Everything else: replace reused passwords over time.

**2FA by strength:** hardware key ≥ authenticator app > SMS (use SMS only if that's all there is).
**Don't lock yourself out:** store backup codes safely · set recovery options · keep a second 2FA method.

## Quality Checks
- [ ] Email/crown-jewel accounts are secured first
- [ ] Recommends a password manager for unique passwords
- [ ] 2FA guidance ranks methods by strength (app/hardware over SMS)
- [ ] Includes backup-code/recovery safeguards against lockout
- [ ] Rollout is prioritized and sustainable, not all-at-once
- [ ] Tailored to the person's current state and comfort

## Anti-Patterns
- **All-or-nothing overhaul** that gets abandoned.
- **Ignoring email** while securing minor accounts.
- **Manual "clever" passwords** instead of a manager.
- **SMS-only 2FA** presented as strong.
- **No backup codes** — locking yourself out.

## Example Trigger Phrases
- "Help me set up better password security — I reuse the same one everywhere."
- "How do I set up a password manager?"
- "Walk me through enabling 2FA on my important accounts."
- "Which is safer, SMS codes or an authenticator app?"
- "I want to secure my accounts without locking myself out."