Is a strong password enough?
A strong password protects one login step. Account security also depends on recovery, sessions, withdrawal controls, and connected apps.
Account Security Checklist
Harden The Account Before You Fund It.
Remove the shared password. Add a second authentication factor. Review every active session before deposits begin.
A strong password protects one login step. Account security also depends on recovery, sessions, withdrawal controls, and connected apps.
- 01PASSWORD
- 02SECOND FACTOR
- 03SESSION
- 04WITHDRAWAL
- 05RECOVERY
Direct answers
Login is only the first control.
Should every exchange share one password?
No. Use a unique password for every exchange account so one breach does not unlock the rest.
Is SMS 2FA enough on its own?
Prefer authenticator-based 2FA where supported. Treat SMS as a fallback risk, not the only second factor.
What should I review after a device change?
Remove the old device, review active sessions, test recovery, and refresh backup codes where needed.
First 10-minute actions
Close the obvious gaps before funding.
- 01Create a unique password for the exchange.
- 02Store it in a password manager.
- 03Secure the password-manager master account.
- 04Confirm recovery email access.
- 05Enable a passkey where supported.
- 06Turn on authenticator-based 2FA where supported.
- 07Save backup codes offline.
- 08Enable login alerts.
- 09Review active sessions and trusted devices.
- 10Configure withdrawal allowlist where supported.
Account controls
Work through each control one step at a time.
Unique password
Remove the shared password. Use a unique password for each account so one breach does not open the rest.
Password manager
Generate and store distinct credentials for exchanges, email, and automation accounts.
Passkey and 2FA
Use a passkey where supported. Prefer authenticator apps over SMS when both are available.
Recovery channel
Keep recovery email current, protect backup codes, and separate recovery from the signed-in device.
Device and session review
Review every active session. Remove devices and sessions you no longer recognize.
Withdrawal controls
Enable withdrawal allowlists and anti-phishing codes where the platform supports them.
API and connected tools
Review API connections. Give automation only the permissions the tool requires.
Phishing and fake support
Never enter passwords, 2FA codes, or recovery material into unsolicited chat, email, or form requests.
Local setup checklist
Harden The Account Controls
0 / 19 reviewed
Monthly review
Keep access current after setup day.
Monthly review
Review signed-in devices and active sessions.
Confirm recovery email, phone, and backup codes still work.
Rotate exposed passwords and unused API keys.
Confirm withdrawal allowlist and anti-phishing code settings.
Emergency response
Open the official domain yourself. Do not follow alert links from unknown messages.
Revoke active sessions and change the affected password.
Rotate API keys and review recent withdrawals or destination changes.
Preserve the alert time, screens, and support ticket reference.
Official Partner
Separate every crypto login with NordPass.
NordPass is an Official Partner for credential isolation. It does not approve transactions, replace 2FA, or protect a stolen recovery phrase.
Next controls
Continue from account controls to the next guide.
Crypto Security ToolkitReturn to the full access, transfer, API, and network map.Password Managers for CryptoReplace reused passwords with NordPass credential isolation.VPN for Crypto UsersHide the original IP before opening the exchange on public Wi-Fi.Wallet Recovery SecurityKeep recovery phrases outside account forms and cloud notes.Before You Send CryptoMove from protected access to transfer verification.Automation BoxConnect bots only after API permissions are limited.Best Exchanges to Buy USDTCompare exchanges after the account is hardened.Crypto Record KeepingKeep alert and session records with the wider ledger.
FAQ
Account hardening questions
Which crypto account should I secure first?
Secure the email account used for login and recovery first, then each exchange, wallet service, and automation account connected to it.
Should I store passwords or seed phrases in this checklist?
No. The checklist stores no sensitive values. It only marks whether a control has been reviewed in the current browser session.
What is the difference between a passkey and authenticator 2FA?
A passkey can replace or strengthen the password step on supported platforms. Authenticator 2FA adds a second factor after the password. Use what the platform supports and keep recovery paths current.
Why review withdrawal allowlists?
An allowlist limits where funds can leave the account. Combined with anti-phishing codes, it adds friction against rushed or spoofed withdrawal changes.
What should I do after a suspicious login alert?
Use a known official URL, revoke sessions, change the affected password, review API keys and withdrawal settings, and keep a record of the alert.
Final checklist