Which account security tools are worth installing

There are five or six categories of account security tool, and real products inside each. The category decides what risk you remove. The product decides how pleasant the removal is.

So this page names the products, and asks the question that matters for every one: what does this make impossible, as opposed to less likely?

What to take away

The tools, by name

Eleven products cover the four categories: password managers, code apps, hardware keys and breach checks. Prices are US list prices or labelled typical ranges as of 2026.

Prices move. Check the vendor's own pricing page before you buy, and read what happens to your data if you stop paying.

Start with the password manager

The obvious benefit is a unique password everywhere. Reuse is how a breach at one company becomes a problem at another, so this is the single change that most reduces account loss.

The benefit people miss is quieter. Bitwarden, 1Password and Dashlane fill a login based on the domain, so on a copied page they will not offer the credential. That silence beats your own judgment at the end of a long day.

The rule: when it does not autofill, stop. Do not open the vault and copy the password across to make the page work. You have just been told something.

Free tiers are real. Bitwarden's free plan covers unlimited passwords on unlimited devices, and KeePassXC keeps the vault in a file on your own disk. 1Password has no free tier and runs a 14-day trial instead.

Choose on four things: whether it works on every device you use and offline, whether you can export your data in a readable form, what happens if the company disappears, and how account recovery works. That last one is the real decision. You are creating a single point of failure on purpose.

The case for a manager over memory is put plainly in CISA's guidance on strong passwords.

Second factors, in the order they resist things

Any second factor beats none. They are not equivalent, and the difference is whether a copied page can use them.

Codes, whoever produces them, can be read aloud or typed into the wrong page. That is not a knock on Google Authenticator, Authy or Microsoft Authenticator; it is the nature of a code a human handles.

Push approvals are better, but a tired person can still approve one at the wrong moment. A stream of prompts you did not trigger is a warning, not a nuisance.

Keys and passkeys are bound to the real site. A copied page cannot use one, because the check involves the address. The YubiKey 5 NFC and the Google Titan key are the common hardware versions, and passkeys ship inside Apple, Google and Microsoft accounts.

If you adopt one thing from this page, put a YubiKey or a passkey on your email account first, then register a second key or print backup codes so losing the first is an inconvenience rather than a disaster.

What a second factor is actually for, in standards language, is in NIST's introduction to multi-factor authentication.

The controls already inside your accounts

Providers ship their own settings, and they are the only things that can actually change an account. Google, Apple and Microsoft all put the functions below in the same few screens. The names move; the functions do not.

Working through these is the substance of a security review. The order to do them in is in the social media account security audit, and the wider version across all your accounts is in privacy checkup tools.

Buying a tool without buying a new problem

A new tool can enlarge the target it was meant to shrink. Run these six questions before you adopt anything in this area.

That last one has a sharper version for anyone who has already lost something. Businesses that advertise account recovery, fund recovery or scam investigation to people who have just been hit are one of the most reliable follow-up scams there is. No legitimate service takes an upfront fee to get an account or money back.

What no tool covers

Tools do not decide what you publish. They do not stop a support agent being persuaded, and they do not manage the people who hold access alongside you. Those are the routes described in account security risks, and habits and rules handle them rather than software.

They also do not help with a message that never touches a login page at all: a request to move money, to change payment details, or to install something. The defense there is procedural, and it is on phishing scams.

Common questions

Is a browser's built-in password manager good enough?

For most people, yes, and it is a large improvement over reuse. Chrome, Edge, Safari, Apple Passwords and Google Password Manager all fill logins on the device you are using.

Check that it works across the devices you use, that you can export from it, and that the account holding it has strong protection of its own.

Authenticator app or text codes?

The app, where you have a choice. It does not depend on your phone number staying yours. Google Authenticator, Microsoft Authenticator and Authy all do the job at no cost.

Back it up or print the recovery codes, because the app is now a thing you can lose.

Are passkeys and security keys worth the setup?

On your email account and anything holding money, yes, because they are the only common option a copied page cannot use. A YubiKey or a Titan key costs roughly $30 to $70 once.

Keep a second method registered so a lost device does not lock you out.

Do I need paid breach monitoring?

Rarely. Chrome, Edge and Safari report known-compromised passwords for free, and that report is the actionable part. Have I Been Pwned answers the same question for an email address at no cost, and Firefox Monitor sends alerts by email.

Paid checks such as Dashlane's dark web monitoring or 1Password Watchtower mostly add notice, not remedy.