Lock Your Accounts Before AI Hackers Do With These 4 Free Tools

You can lock down your main accounts in about ten minutes, for free. Check whether your email has leaked with Have I Been Pwned. Put a passkey on your main email. Move your login codes from text messages to Ente Auth, a free authenticator app. Then give every new sign-up its own email address with SimpleLogin.

Do all four and a leaked password isn't enough, on its own, to get into the accounts you've locked.

Why now? On 21 October 2026, Microsoft reported an AI-driven campaign that tried to sign in to more than 2,250 company tenants. Below is the reel's 10-minute checklist, then what each tool protects you from.

How do you lock your accounts in 10 minutes?

Ten minutes, four free tools, in order of impact. When you're done, a leaked password is useless on its own.

1. Check if your email has leaked (2 minutes)

1. Go to haveibeenpwned.com and type in your email.
2. If it goes red, it lists the breaches your email was in. Change the password on each of those sites, and anywhere else you used the same one.

2. Turn on a passkey for your main email (3 minutes)

A passkey lets you sign in with your face, fingerprint or phone PIN instead of a password. Start with your main email, because it can reset every other account.

1. Google: myaccount.google.com/signinoptions/passkeys, then Create a passkey.
2. Microsoft: account.live.com/proofs/manage, then Add a new way to sign in or verify, then Face, Fingerprint, PIN, or Security Key.
3. WhatsApp: Settings, then Account, then Passkeys, then Create passkey.
4. Apple: there's no passkey switch. With two-factor authentication and iCloud Keychain on (iOS 17 or later), your iPhone already works as one: on icloud.com, choose Sign in with Passkey and scan the code with your phone.

3. Move your codes off text messages (3 minutes)

A scammer can talk your phone company into moving your number to their SIM, and then your text-message codes go to them. An authenticator app keeps the codes on your phone.

1. Install Ente Auth (free, open source, on iPhone, Android and computer) from ente.com/auth and turn on its encrypted backup.
2. In your email account's security settings, open two-step verification and switch to an authenticator app. Scan the QR code with Ente Auth.
3. Do the same for your bank and social accounts where they allow it. Turn SMS codes off once the app works.

4. Give every site its own email address (2 minutes)

1. Make a free SimpleLogin account at simplelogin.io (it's from the team behind Proton). The free plan gives you 10 addresses.
2. Use one of those addresses for your next sign-up. If that site leaks, nobody can tie it back to your real inbox, and you can switch the address off.

What does each tool protect you from?

Each one closes a different gap, so they work best together.

Have I Been Pwned: find out which passwords are already out there

Have I Been Pwned is a free site that checks your email against known data breaches. Its homepage counts over 17.8 billion pwned addresses from 1,047 breached websites. A red result lists each breach, so you know which passwords to change first.

Passkeys: sign in without typing a password

A passkey can't be shared, copied, written down or accidentally given to someone else, Google says, which makes it more secure against phishing. Adding one doesn't remove your password or your other sign-in options, so do the other three steps too. And only create one on a device you own, because anyone who can unlock that device can get into the account.

Ente Auth: keep your login codes off text messages

Ente Auth is a free, open-source authenticator app for iPhone, Android, Mac, Windows, Linux and the web. Your codes come from the app instead of a text, so a scammer who takes over your phone number doesn't get them. With its end-to-end encrypted backup on, you don't lose your codes if you lose your phone.

SimpleLogin: a different email address for every site

SimpleLogin, from Proton, gives you email aliases that forward to your real inbox. If a site you signed up to with one leaks, the address in the breach isn't your real one, and you can switch it off. The free plan gives you 10 aliases, and the code is open source.

What did Microsoft report about the AI attack?

On 21 October 2026, Microsoft said a China-state aligned group it tracks as Storm-0940 used ARTEX, an open-source AI framework for penetration testing, to try to sign in to more than 2,250 organisations' Microsoft cloud tenants after the compromise of ConnectWise's Cloud Backup service. Microsoft says most of the targeting wasn't successful, though the group got privileged access at many organisations.

In one password-spraying run, failed logins peaked at 2,900 a minute on 11 October, and Microsoft saw no successful sign-ins from it. TechCrunch covered the breach on 22 October.

Those were attacks on companies, not on your personal email. But they show how fast automated login attempts now run, and why a leaked password shouldn't be enough to get in.

For the settings that stop AI apps training on your chats, see our AI chat privacy settings. To find where AI could save your team the most time, take the free AI bottleneck test, or read our insights on AI implementation.