A guide for beginners

Securing your accounts on iPhone and Mac

Stop someone from stealing your Instagram account, your email address, your Apple account or any other online account, even if they discover one of your passwords.

Guide verified on 15 August 2026 against official documentation from Apple, Meta/Instagram, Cybermalveillance.gouv.fr, CISA and NIST.

Start with the 5 rules

The five rules, one sentence each

  1. A different password for every account.
  2. Use a password manager.
  3. Turn on two-factor authentication wherever you can.
  4. Protect your email address and your Apple account first.
  5. Never give out a password or a login code.

Contents

  1. 01

    The 5 rules to remember

    The whole guide fits into five sentences.
  2. 02

    How an account actually gets stolen

    In most cases nobody "hacks" your iPhone.
  3. 03

    Start with your email address

    It is the key that opens every other door.
  4. 04

    Securing your Apple account

    It protects your iCloud data, your devices and your synced passwords.
  5. 05

    Using Apple's Passwords app

    The password manager is already installed on your devices.
  6. 06

    Creating good passwords

    Length matters. Uniqueness matters more.
  7. 07

    Turning on two-factor authentication (2FA)

    Something you know, plus something you have.
  8. 08

    Understanding passkeys

    Sign in with Face ID, without a password.
  9. 09

    Securing Instagram step by step

    Seven steps, in order.
  10. 10

    Avoiding phishing

    The message wants you to act fast. Slow down.
  11. 11

    Physically securing your iPhone

    Your phone already holds everything else.
  12. 12

    What to do if your iPhone is stolen

    Three reflexes, in this order.
  13. 13

    What to do if an account is hacked

    Three situations, three procedures.
  14. 14

    A 20-minute security checklist

    Work through the list in order. Your boxes are saved.
  15. 15

    Advanced level

    Once everything else is done.
  16. 16

    Checking your iPhone with MVT

    Looking for spyware traces in an iPhone backup, with Amnesty International's tool.
  17. 17

    Official sources

    The recommendations and settings paths in this guide were verified against these sources.

Recommended order of priority

Starting from scratch? Work through your accounts in this order.

  1. Email account
  2. Apple account
  3. Passwords app
  4. Instagram
  5. Banking, shopping, social media
  6. All other accounts

The rule above all others

A password manager and 2FA do not just make passwords harder to guess. Above all they move you from "one compromised password = all my accounts are at risk" to "one compromised account = the problem stays in that account". That compartmentalisation is what makes the enormous difference.

Perfect security does not exist. The goal is to make a compromise far harder, and above all to stop a single stolen password from handing an attacker control of your entire digital life.

Every recommendation links back to official documentation.