Security Resources I Actually Trust

There’s no shortage of security “resource lists” online, and most are link dumps padded for search engines. This one is different on purpose: every item below is something I actually keep bookmarked or point colleagues and family to, with an honest note on what it’s good for and where it bites. If a resource isn’t here, it’s usually because I don’t reach for it — not because I couldn’t find another link to pad the page.

Check whether you’re already exposed

Have I Been Pwned — Start here, today. Run by security researcher Troy Hunt, it tells you whether your email or phone number has turned up in a known data breach. It’s the first thing I have people do, because it turns an abstract worry (“am I at risk?”) into a concrete to-do list (“these four accounts are exposed — fix them”). Use the “Notify me” feature so it warns you about future breaches automatically. The catch: a clean result doesn’t mean you’re safe, only that nothing public has surfaced. Treat it as a smoke alarm, not a guarantee. If you get a hit, my breach-recovery guide walks through what to do in order.

Password managers (my short list)

A manager is the single most useful tool on this page. These are the three I’d actually recommend; I explain the trade-offs in detail in my full comparison.

• Bitwarden — My default recommendation. Open-source, independently audited, and the free tier is genuinely enough for most people. Where I send anyone who just wants one safe answer.
• 1Password — The most polished experience, and the one I’d set up for someone who finds all of this stressful. Its “Secret Key” design is a real security advantage. No free tier, though.
• Proton Pass — My pick for the privacy-minded: Swiss-based, open-source, with built-in email aliasing. Younger than the other two, but maturing fast.

Authoritative sources (where the real guidance lives)

When advice online contradicts itself, these are the sources I trust over any blog — including mine.

• NIST Digital Identity Guidelines (SP 800-63B) — The US standards body whose modern guidance reshaped how we think about passwords: favour length, screen against breach lists, and stop forcing 90-day rotations. Dense reading, but it’s the primary source behind most good advice you’ll see, mine included.
• NCSC password guidance (UK) — The UK’s National Cyber Security Centre writes for normal humans rather than auditors. If NIST is the law, NCSC is the plain-English explainer. Their “three random words” guidance is the friendliest on-ramp to passphrases I know.
• OWASP — Aimed at developers and people who build systems rather than end users. If you’re responsible for storing other people’s passwords, this is where you learn to do it properly (hashing, salting, what not to roll yourself).
• OWASP Authentication Cheat Sheet — A more practical, technical companion to the above for anyone implementing logins.

A plain-English glossary

The jargon trips people up more than the concepts do. The ones worth knowing:

Entropy. A measure of how unpredictable a password is — the real currency of strength. Higher entropy means harder to guess. Length raises it far faster than swapping letters for symbols does, which is the whole argument for length over complexity.

Two-Factor Authentication (2FA / MFA). A second proof of identity on top of your password — ideally an authenticator app or hardware key rather than an SMS code. It means a stolen password alone often isn’t enough to get in. I rank the methods in the 2FA guide.

Credential stuffing. Automated testing of passwords leaked from one site against thousands of others. The single reason password reuse is so dangerous, and why a manager matters.

Phishing. Tricking a person into handing over credentials, usually via a fake login page reached from a message. The most successful attack going — here’s how to spot it.

Passkey. A modern, phishing-resistant replacement for passwords, tied cryptographically to the real website so it can’t be used on a fake one. Likely the future of logging in — explained in passkeys, plainly.

Where to go next

If you only do one thing from this page: run your email through Have I Been Pwned, then install a password manager. That pair removes more real-world risk than anything else here. When you’re ready to go deeper, the Security Guide is the orientation map, and the blog goes into each topic properly. And any time you want to sanity-check a password, the tester runs entirely in your browser — nothing you type ever leaves your device.