crackthe.netDeutsch
Menu

Level 0 · Basics2 min read

Why your email account needs the best protection

Why whoever controls your inbox can take over your other accounts, how to protect it with a unique password and two-factor sign-in, and what to do if it was hacked.

Illustration: a key icon in a rounded tile, with the title Protect your email account

Key points

  • When you forget a password, many websites send a reset link to your email address. Whoever gets into your inbox can reset the passwords of your other accounts.
  • Germany’s Federal Office for Information Security (BSI) calls the email account one of your most important accounts and advises turning on two-factor authentication for it.
  • Prepare now: a unique password, two-factor sign-in, and recovery details that you control.

Why your inbox opens other doors

If you forget a password, many websites offer to send a reset link to your email address. That makes your inbox a master key. The BSI puts it plainly: whoever has access to your mailbox can have the passwords of your online services reset and set new ones.

One weak spot is a password that you also use elsewhere. If one of those websites leaks it, attackers can try it on your mailbox. Two-factor sign-in adds a second step that a leaked password alone does not pass.

Protect your email account

  1. Give it a long password that you use nowhere else. A password manager creates and stores it for you.
  2. Turn on two-factor sign-in. Keep the codes for your email account in a separate authenticator app, not in the same vault as the password. The guide Passkeys and 2FA codes in password managers explains why.
  3. Check your recovery details. The US Federal Trade Commission (FTC) advises making sure that the recovery email addresses and phone numbers are ones you entered and still have access to.
  4. Look for forwarding rules in your settings that you did not set up. A hidden rule can send copies of your mail to someone else.

The FTC gives the same advice for codes: if you get verification codes by email, “use a strong password and two-factor authentication on your email account.”

If someone got in

The FTC lists these steps for a hacked email account:

  1. Update your security software and run a scan. Delete anything suspicious.
  2. Follow your provider’s steps to get your account back.
  3. Change the password, sign out of all devices, turn on two-factor sign-in, and check the recovery details.
  4. Check your settings for forwarding, and your sent folder for messages you did not write.
  5. Warn your contacts not to click on links in emails from you.

Next step

The guide How to set up a private email account shows the first steps at the four private providers listed here, including their two-factor options.

Check it with the archive's data

Read next: How to set up a private email accountAll guides on private email