No jargon. No judgment. Just simple, warm guidance for spotting scams, protecting your accounts, and staying safe online — whether you're 9 or 90.
Most cybersecurity advice is written for people who already understand cybersecurity.
Tap any topic to see a few practical tips you can use today.
Almost every phone or text scam follows the same four moves.
You can break the pattern at any step. Hang up, call the person back.
Scam calls work because they create panic and urgency.
These trusted organizations track active scams and publish alerts.
See what's exposed. Fix what's vulnerable. Protect your accounts.
A data breach happens when a company's data is stolen — usernames, emails, and sometimes passwords end up in the hands of criminals. It happens to big, well-known companies too, and it's not your fault.
Have I Been Pwned is a free, independent tool used by security professionals worldwide. It lets you check whether your email address has shown up in a known breach — without ever asking for your password.
You're leaving Common Sense Cyber for a trusted external tool. We don't send, store, or see your email address.
A password manager creates and remembers a long, unique password for every account, so you only have to remember one. Reusing passwords is one of the biggest risks online — if one site is breached, criminals try that same password everywhere else.
Two-step verification — also called MFA or 2FA — adds a second check after your password, so a stolen password alone isn't enough to break in. It's one of the single best things you can do to protect an account.
A passkey replaces your password with your device's fingerprint, face, or screen lock. Instead of typing anything, you approve the sign-in on a device you already trust.
Passkeys are built to resist phishing: they're tied to the exact website or app they were created for, so a fake look-alike site simply can't use them — even if it tricks you into visiting.
Look for "Passkey" in the security settings of accounts like Google, Apple, and Microsoft — more services are adding support all the time.
The best time to set up account recovery is before something goes wrong. A few minutes now can save you from being permanently locked out later.
Answer honestly — nothing here is sent anywhere. It stays on this page, on your device.
You're doing a great job protecting your accounts. Keep it up, and revisit this checkup occasionally as your accounts change.
You've got a solid foundation. A couple of small changes below would make a real difference.
A few important gaps could leave your accounts vulnerable. The steps below are a great place to start — you don't have to do them all today.
Five quick real-world scenarios.
You're not alone, and it's not too late to act.
This opens your email app with your message pre-filled.
Real experiences help other visitors recognize the same warning signs. Every story is reviewed before it's posted, and you're welcome to stay anonymous.
This opens your email app with your story pre-filled. Nothing is posted automatically — a real person reviews every submission before it goes on the site.
How we handle information on this site, in plain language.