---

name: password-and-2fa-setup description: "Set up a sane password and two-factor-authentication baseline that's genuinely secure and actually sustainable — a password manager, unique passwords where it counts, and 2FA on what matters. Use when asked to improve my password security, set up a password manager, how do I use 2FA, or make my accounts more secure. Produces a prioritized rollout (secure the crown-jewel accounts first), a password-manager setup, a 2FA plan by method strength, backup-code and recovery safeguards, and a realistic order so it gets done, not abandoned."

Password & 2FA Setup

Perfect security advice that nobody follows is useless. This sets up a baseline that's both strong and livable: a password manager doing the remembering, unique passwords on the accounts that matter most, and 2FA where it counts — rolled out in priority order (email and finances first) so you actually finish instead of giving up at account number three.

What This Skill Produces

• A prioritized rollout — secure the crown-jewel accounts first (email, banking, primary logins), then work outward
• A password-manager setup — choosing and setting one up, a strong unique master password, importing/replacing weak reused ones
• A 2FA plan by strength — authenticator app or hardware key over SMS where possible, on the accounts that matter
• Recovery safeguards — backup codes stored safely, recovery contacts, and avoiding lock-yourself-out mistakes
• A sustainable order — a realistic sequence so it gets done, not abandoned halfway

Required Inputs

Ask for these if not provided:

• Where you are now — reused passwords? a manager already? any 2FA?
• Key accounts — email, banking, work, socials, anything sensitive
• Comfort level — how technical, and how much effort you'll sustain
• Devices — phone/computer platforms (affects manager and 2FA choices)
• Concerns — a specific breach, getting locked out, or general hardening

Framework: Crown Jewels First, Manager Does The Work

1. Secure email first. It's the reset hub for everything — a unique strong password + strong 2FA here protects all the rest.
2. Let a password manager remember. Unique, long passwords everywhere are only possible if software stores them; set one up with a strong master password (and 2FA on the manager).
3. Add 2FA where it counts, by strength. Prefer an authenticator app or hardware key; SMS is better than nothing but weaker. Prioritize email, finance, and primary accounts.
4. Protect against lockout. Save backup/recovery codes somewhere safe, set recovery options, and keep a second 2FA method — so security doesn't lock you out.
5. Sequence it sustainably. Do the highest-value accounts now, then chip away — a finished baseline beats a perfect plan abandoned.

Output Format

Security baseline: [current state] · [comfort level]

Order of operations

1. Email: unique password + [authenticator/hardware] 2FA + save backup codes.
2. Set up a password manager (strong master password + 2FA on it).
3. Banking/finance: unique passwords + strongest available 2FA.
4. Work + primary logins: same.
5. Everything else: replace reused passwords over time.

2FA by strength: hardware key ≥ authenticator app > SMS (use SMS only if that's all there is). Don't lock yourself out: store backup codes safely · set recovery options · keep a second 2FA method.

Quality Checks

• Email/crown-jewel accounts are secured first
• Recommends a password manager for unique passwords
• 2FA guidance ranks methods by strength (app/hardware over SMS)
• Includes backup-code/recovery safeguards against lockout
• Rollout is prioritized and sustainable, not all-at-once
• Tailored to the person's current state and comfort

Anti-Patterns

• All-or-nothing overhaul that gets abandoned.
• Ignoring email while securing minor accounts.
• Manual "clever" passwords instead of a manager.
• SMS-only 2FA presented as strong.
• No backup codes — locking yourself out.

Example Trigger Phrases

• "Help me set up better password security — I reuse the same one everywhere."
• "How do I set up a password manager?"
• "Walk me through enabling 2FA on my important accounts."
• "Which is safer, SMS codes or an authenticator app?"
• "I want to secure my accounts without locking myself out."