Any · Security

Stop emailing passwords and secrets

Email is not a vault. Passwords, OTP codes and API keys sitting in an inbox are the easiest win a hacker can get.

DifficultyEasy
Time10 min
RiskLow
ReversibleYes
PlatformAny
UpdatedAug 18, 2026

Written and tested by emdottech

What that means

Low risk. This fix only checks things, or changes settings you can switch back in the same place. This change is reversible — you can return to the previous state without professional help or data loss.

Moving secrets out of email in three stages — passwords and OTPs sitting in the inbox today, moved to a manager with 2FA and an authenticator app, then searching 'password' and deleting the old threads

Steps

01
- Move everything into a password manager (Bitwarden free, 1Password) — one master password to remember, everything else generated for you
02
- Turn on two-factor authentication for email, banking and anything that matters; prefer an authenticator app over SMS where possible
03
- Search your inbox for 'password', 'OTP' and 'verification', then delete those threads once the credentials are moved
04
- If a service has no 2FA option at all, treat that as a signal to find one that does

How to verify the fix

Your password manager holds the moved credentials, 2FA is on for critical accounts, and old password email threads are deleted.

If this didn't fix it

You can't access a service after moving its password — recover it via that provider's account-recovery flow before deleting anything else.

Next stop: the related fixes below, or start a guided diagnosis.

Still stuck? Diagnose my problem Browse all Windows fixes

Stop emailing passwords and secrets

Steps

✓How to verify the fix

!If this didn't fix it

Related fixes

How to verify the fix

If this didn't fix it