Tools Digital Security Checkup

Free tool · Digital Security Checkup

How safe are my accounts and identity online?

Most account takeovers and identity theft start with a gap you can close in an evening: a reused password, a text-message code, an unfrozen credit file. Answer 13 quick questions to get a digital security score from 0 to 100 and a fix list ordered by risk, each step linked to the official how-to.

By · Updated

Step 1 · Accounts

Do you use a password manager?

An app that creates, stores and fills in your passwords, such as the one built into your phone or browser. Partly: for some accounts only.

Is every important account’s password different from all your others?

Partly: email and banking are unique, but some passwords are reused.

Is multifactor authentication on for your email and your money accounts?

A second step after your password, like a code or a prompt on your phone. Partly: on some of them.

Do your email and bank use a passkey, security key or authenticator app instead of text-message codes?

Text codes beat a password alone but can be phished or stolen in a SIM swap. Partly: on some accounts.

When a message or call asks you to log in, pay or share a code, do you check by going to the site or number you already know?

Partly: usually, but not every time.

Step 2 · Devices

Are automatic updates on for your phone, computer and browser?

Partly: on some devices, or you install updates by hand when you remember.

Do your phone and computer lock with a passcode, face or fingerprint?

On a phone, at least a 6-digit passcode. Partly: one device doesn’t lock.

Are your photos and files backed up automatically?

To the cloud or an external drive. Partly: only some devices, or only now and then by hand.

Step 3 · Identity

Is your credit frozen at all three bureaus: Equifax, Experian and TransUnion?

Partly: at one or two of them.

Do you have an IRS Identity Protection PIN?

A six-digit number that stops anyone else filing a tax return with your Social Security number. Partly: you have one, but your spouse or dependents don’t.

Do you read your bank and card statements every month?

Looking for charges, withdrawals or bills you don’t recognize. Partly: now and then, or only some accounts.

Step 4 · Recovery

Is recovery set up on your main email: current backup phone and email, and backup codes saved somewhere safe?

Partly: some of it, or you haven’t checked in years.

Have you named a trusted contact on your brokerage and retirement accounts?

Someone the firm may call if it suspects fraud or can’t reach you. It gives them no access to your money. Partly: on some accounts. No such accounts? Choose Yes.

Private by design: everything is calculated in your browser. Nothing you answer is saved or sent.

Beyond your accounts

Locking down your logins protects your money. Security wealth goes further.

The free Security assessment looks at your whole safety net: financial cushions, digital and physical safety, legal documents and contingency plans. It takes about two minutes, scores you from 0 to 100 and feeds your overall Wealth Score across eight dimensions. No sign-up needed.

  • Financial
  • Retirement
  • Security
  • Medical
  • Physical
  • Mental
  • Social
  • Time
Take the Security Assessment

Want the bigger picture first? Read what security wealth means, or see all eight dimensions.

How this checkup works

The checks come from official advice for individuals: CISA’s Secure Our World campaign (use strong passwords and a password manager, turn on multifactor authentication, recognize and report phishing, update software), NIST’s digital identity guidelines, the FTC’s identity theft guidance, the IRS Identity Protection PIN program and FINRA’s trusted contact rule. Each “yes” earns the check’s full points, “partly” earns half, and “no” earns none.

Score = points earned ÷ 30 × 100

The points are our judgment of how much each protection matters, weighing how often the gap is exploited against how much damage it can do. They are not an official standard:

  • 4 points: multifactor authentication on email and money accounts. Your email can reset almost every other password.
  • 3 points each: a password manager, unique passwords, automatic updates, and a credit freeze at all three bureaus.
  • 2 points each: phishing-resistant sign-in (passkeys, security keys or an authenticator app), checking before you click, a screen lock, automatic backups, monthly statement checks, and email account recovery.
  • 1 point each: an IRS Identity Protection PIN and a trusted contact on investment accounts.

Under 50 is Exposed, 50 to 79 is Partly protected, and 80 or more is Well protected. The fix list sorts every “no” and “partly” by the points it costs you, so the top item is the one that closes the most risk. For the full playbook, including what to do if your identity is already stolen, read how to protect yourself from identity theft. Choosing tools? See our comparisons of the best password managers and identity theft protection services; most of what a paid service does, like a credit freeze, you can do yourself for free.

Words you’ll see

Multifactor authentication (MFA)
A second step after your password, such as a code from an app, a prompt on your phone or a security key, so a stolen password alone can’t open the account.
Passkey
A sign-in that replaces the password with a key stored on your phone or computer and unlocked with your face, fingerprint or PIN. It only works on the real site, so it can’t be phished.
Phishing
A message, call or text pretending to be someone you trust, to get you to click a link, share a code or send money.
Credit freeze
A free block on your credit report that stops anyone, you included, from opening new credit in your name until you lift it. It doesn’t affect your credit score.
Fraud alert
A note on your credit report telling lenders to verify it’s you before opening an account. It lasts a year, and placing it at one bureau notifies the other two.
IRS Identity Protection PIN (IP PIN)
A six-digit number, known only to you and the IRS, that must be on your tax return, so a thief can’t file one with your Social Security number.
Trusted contact
A person your brokerage may contact if it suspects fraud or can’t reach you. They get no authority over the account.

Common questions

What are the most important steps to stay safe online?

CISA’s Secure Our World campaign boils it down to four habits: use long, unique passwords with a password manager, turn on multifactor authentication, recognize and report phishing, and keep your software updated. Start with your email account, because whoever controls it can reset most of your other passwords.

Should I freeze my credit?

For most people, yes. A credit freeze is free, does not affect your credit score, and stops anyone, including you, from opening new credit in your name until you lift it. You have to place it separately at Equifax, Experian and TransUnion, and when you apply for credit you only lift it at the bureau the lender uses.

Is two-factor authentication by text message safe enough?

It is far better than a password alone, but text codes can be phished or stolen with a SIM swap. NIST treats phone-network codes as a restricted method and counts only cryptographic sign-ins, such as passkeys and security keys, as phishing-resistant. Use a passkey or security key where offered, then an authenticator app, and text codes only as a fallback.

How long should my passwords be?

CISA recommends at least 16 characters, random and different for every account. NIST’s current guidelines require services to accept at least 15 characters when a password is the only sign-in step and to allow password managers, which make that length effortless.

Who can get an IRS Identity Protection PIN?

Anyone with a Social Security number or ITIN who can verify their identity can get one, even if they do not have to file a tax return, and parents can request one for dependents. The six-digit PIN stops someone else from filing a return with your number, and the IRS issues a new one each year.

Sources

  1. Secure Our World: Use Strong Passwords, Cybersecurity and Infrastructure Security Agency (CISA)
  2. Secure Our World: Turn On MFA, Cybersecurity and Infrastructure Security Agency (CISA)
  3. Implementing Phishing-Resistant MFA, Cybersecurity and Infrastructure Security Agency (CISA)
  4. Secure Our World: Recognize and Report Phishing, Cybersecurity and Infrastructure Security Agency (CISA)
  5. Secure Our World: Update Software, Cybersecurity and Infrastructure Security Agency (CISA)
  6. Data Backup Options, Cybersecurity and Infrastructure Security Agency (CISA)
  7. SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management, National Institute of Standards and Technology (NIST)
  8. How To Protect Your Phone From Hackers, Federal Trade Commission
  9. Credit Freezes and Fraud Alerts, Federal Trade Commission
  10. Free Credit Reports, Federal Trade Commission
  11. How To Recover Your Hacked Email or Social Media Account, Federal Trade Commission
  12. Get an Identity Protection PIN (IP PIN), Internal Revenue Service
  13. Why You Should Consider Adding a Trusted Contact to Your Account, Financial Industry Regulatory Authority (FINRA)

This tool is for informational and educational purposes only. It is not financial, tax, legal or security advice, and it can’t detect whether an account has already been compromised. If you think your identity was stolen, go to IdentityTheft.gov for a recovery plan.