Protecting your accounts: 2FA, passkeys, password managers and recovery.

The email connecting your password manager, sample shop, digital distributor and project social accounts is the master lock of your career: whoever controls it can request password changes, generate new two-step codes and drain accounts for days before you notice. Protection requires an orderly afternoon and decisions you need not revisit weekly, rather than advanced security knowledge.

The objective is not making access impossible—no such thing exists—but preventing one stolen password from being enough for anything. This guide covers 2FA, passkeys, password managers and, above all, account recovery, where most people lack a plan when they need one.

What is lost when an account is compromised

Inventory what each login protects. Music is only part of it: accounts hold money, identity and years of work.

• Primary email. Everything revolves around it: other passwords reset from there. Losing it means losing the key to the rest of the house.
• Cloud storage and library. Playlists, stems, masters and synchronised databases. Attackers can empty or delete them; recovery depends on backups, as explained in library backups with the 3-2-1 rule.
• Payment and commercial accounts. Sample subscriptions, plugin licences and platform access: damage is financial and often immediate.
• Artist profiles and social media. A stolen verified profile is used to scam your audience with fake payment links.
• Distributors and collecting societies. Changed bank details, catalogue blocks or withheld royalties can take weeks to resolve.

The common attack is dull and effective: a reused password appears in a breach, is tried on your email and, without a second factor, lets the attacker continue down the recovery chain. Hence email first, then everything else.

Passkeys, 2FA and password managers: what each provides

2FA adds another proof alongside the password: a code-generating application, physical key or SMS code. A stolen password is insufficient without that factor. Its limit is dependence on retaining the device or code.

Passkeys go further: a key pair on your device authenticates through phone or computer unlocking, without typing a password. Bound to the real site, a passkey does not work on a fake website: platform-impersonating phishing stops being a practical risk. Where available, it is both the most convenient and safest option.

Password managers solve the preceding problem: dozens of different passwords without memorising them. They store encrypted credentials, generate random passwords and fill them only on the correct site. Without a manager, the constant temptation to reuse passwords turns a small breach into a major incident.

2FA without headaches: app, key and rescue codes

Enable a second factor in this priority order:

1. Primary email. It links everything else; protect it first.
2. Authenticator app or physical key. TOTP apps work without mobile coverage and provide a convenient starting point; physical WebAuthn keys are most fraud-resistant because they cannot be typed into a fake site.
3. Backup codes. Most services generate one-use codes when 2FA is enabled. Download, print and store them in a physically secure place. They are your exit if you lose your phone.
4. SMS only as reinforcement. It helps when no alternative exists, but should not be the sole second factor.

Enable 2FA on the password manager too, and on recovery email. A manager with a weak master password and no second factor is a safe with an open door. Transfer the code app before deactivating your old line when changing phones: many lost logins happen there rather than through sophisticated attacks.

Password managers: rules for confident use

One golden rule: a different password per account, with only one master password to memorise. Make it long, composed of unrelated words and different from anything used before. You neither see nor remember the others; the manager generates them.

Require five features: encryption at rest, multifactor authentication to open the manager, password generation, warnings for known breached passwords and export when moving elsewhere. The NCSC buying guide lists them, forming a simple checklist before paying.

Two habits matter:

• Do not save passwords on other people’s equipment. Browser autofill on a library, friend’s or rehearsal-room computer is a trap.
• Check autofill. Modern managers fill only on the correct domain; a similar-looking site asking you to type the password is precisely when to distrust it.

Account recovery: prepare before losing access

Account recovery matters when you lose your phone, forget the master password or lose email access. Prepare calmly and rehearse once rather than improvise at two in the morning.

Configure these beforehand:

• Current recovery details: An alternative phone and backup email distinct from the account being protected.
• Printed backup codes for each 2FA service, in an envelope, with another copy away from home.
• A known rescue channel. Many providers support identity-based or trusted-contact recovery; enable it while in full control, because afterwards you cannot.
• Master password outside the manager. Handwritten or memorised: the manager cannot remind you itself.
• Notification contact. Record whom to alert about impersonation: platforms, distributor and, where appropriate, authorities.

Test for real: use a different device to recover email access and one more platform. If it takes more than ten minutes or needs unavailable details, there are steps to fix now, not afterwards.

A fresh start in one afternoon

A plan fitting one work session that, once completed, requires no further effort:

1. Hour 1: Protect primary email with 2FA and save backup codes.
2. Hour 2: Install a manager, import passwords and change reused ones, starting with money and publishing accounts.
3. Hour 3: Enable available passkeys and app-based 2FA on music platforms, shops and social accounts.
4. Hour 4: Review each service’s recovery details, download new codes and archive them on paper.
5. Finish: Copy critical passwords into the manager and check other material remains protected by the backups described in library organisation.

This disables the commonest account-theft route. What remains—deception inducing you to surrender the password—is the next guide’s subject.

Next step

Even a protected account can be attacked through its owner: Artist Scams: Phishing, Fake Promoters, Fake Contracts and Plugin Malware.