Personal Security Audit: The 30-Minute Checklist

Most people learn about a breach from a login alert they didn't trigger, a password reset email they didn't request, or a friend asking why they sent a crypto link at 3am. By that point the damage is hours old and the cleanup takes days. The uncomfortable part is that the entry point usually wasn't clever: surveys consistently find that a majority of people reuse passwords across accounts, and automated tools exist to exploit exactly that, at scale, around the clock.

A personal security audit flips the timing. Instead of finding out what was weak after someone else does, you spend one sitting finding it first. I've built and refined this checklist over years of writing about consumer security, and the version below covers the four areas that account for most real-world takeovers. It takes about 30 minutes. Set a timer, silence the phone, and work top to bottom.

Step 1: Inventory your accounts (8 minutes)

You can't protect accounts you forgot you have, and the forgotten ones are the softest targets: old password, no two-factor, nobody watching. Three moves surface most of them.

First, list your crown jewels from memory: primary email, banking, phone carrier, Apple or Google ID, and anything with a saved card. Your email goes at the top of the list because whoever controls it can reset almost everything else. Second, search your inbox for the phrases "welcome to", "verify your email", and "your account has been created", and skim the results. Give this five minutes, not twenty. Third, open your browser's saved password list (Chrome: Settings then Passwords; Safari: Settings then Passwords) and count the entries. That list is often the most complete record of your online life that exists anywhere.

Mark anything you haven't used in a year. You'll deal with those at the end.

Step 2: Check your passwords (8 minutes)

Reused passwords cause more account takeovers than any hack, because one breached site turns into a key that opens every other door you locked with it. The attack even has a name, credential stuffing, and it's fully automated: leaked email and password pairs get tried against hundreds of major sites within hours of a breach circulating.

Go to haveibeenpwned.com and enter your main email addresses. It tells you which breaches your credentials appear in, for free, using data security researchers already index. Then run your browser's built-in password checkup (Chrome: Settings, Passwords, Checkup), which flags reused, weak, and breached passwords in one pass. If you want to test a specific password's strength without typing it into a random website, our password checker does the breach lookup with k-anonymity, meaning the password itself never leaves your browser.

Whatever the tools flag, fix the worst one immediately: whichever important account shares a password with anything else gets a new, generated, 16+ character password right now, before you continue reading. Our free password generator runs entirely in your browser for exactly this job. And if your personal system is one base word plus the site name, retire it today. Cracking tools know every variation of that pattern.

Step 3: Turn on two-factor where it counts (8 minutes)

Microsoft has reported that multi-factor authentication can block more than 99.9% of account-compromise attacks in its identity systems, with results varying by attack type and method. You don't need it everywhere today. You need it in three places, in this order: your primary email, every account that touches money, and your Apple or Google ID.

Use an authenticator app rather than SMS codes where the option exists, because SMS is vulnerable to SIM-swapping: an attacker convinces your carrier to move your number to their SIM and then receives your codes. While you're thinking about it, call your carrier or open their app and set an account PIN or port-out lock. It takes five minutes and it blunts that entire attack class. Whatever 2FA you enable, save the backup codes somewhere that is not the email account they protect.

Step 4: Clean up (6 minutes)

Every dead account is a liability someone else maintains, and old services get breached years after you stopped caring. Pick the two dead accounts from your Step 1 list that hold the most personal data and delete them now (search "[service name] delete account" for the path). Remove saved cards from any shop you buy from less than monthly. Then check the active sessions on your email and social accounts (Google: Security, then Your devices) and sign out anything you don't recognize, especially devices you sold or retired.

Last move: put a calendar reminder six months out. Security drifts, new accounts accumulate, and a twice-yearly half hour keeps you ahead of nearly everyone.

What this checklist doesn't cover

I'll be straight about the limits. The 30 minutes above covers accounts, passwords, MFA, and cleanup, which is where most takeovers begin. It doesn't audit your recovery paths (the "forgot password" back doors), your devices, your browser extensions, your home router, or the shared logins floating around your family group chat. Those take another 40 minutes and a more structured walkthrough than a blog post can hold.

That's why I turned the full process into a workbook: The 30-Minute Digital Life Audit is 26 pages with nine guided audits, printable worksheets, a 50-point self-assessment, and a breach response plan for the day something goes wrong anyway. If you want to try the format first, the free 5-page starter covers Steps 1 and 2 above in workbook form, no email required.

The tool that automates the slowest part

Step 2 is the one people abandon, because fixing password reuse by hand across dozens of accounts is miserable. A password manager does that part continuously: it generates unique passwords, stores them encrypted, flags anything weak or reused, and watches breach data so you don't have to keep checking manually. I currently recommend NordPass for that job, and the audit above works the same whichever manager you pick, so compare alternatives before choosing.

Paid affiliate link: I may earn a commission if you purchase NordPass through this link, at no additional cost to you.

Quick FAQ

How often should I run a personal security audit?

Twice a year, plus once immediately after any breach notification that names a service you use. Repeat rounds go faster because the inventory already exists.

Do I need to pay for anything to do this?

No. Every step above uses free tools. The paid workbook adds structure, the seven areas this checklist skips, and worksheets, but the core audit costs nothing except the half hour.

What's the single highest-value step if I only have five minutes?

Two-factor authentication on your primary email, with an authenticator app. Nothing else you can do in five minutes removes more risk.