Password managers and 2FA for private investigators

If someone gets into your email, they can usually get into everything else: password resets for your cloud storage, your case software, your data-provider accounts and your bank all arrive there. For a private investigator, a compromised email account can mean exposed case files, a client’s report forwarded to the subject, or a fake invoice sent to your clients from your real address.

Two measures prevent most account takeovers: unique passwords kept in a password manager, and two-factor authentication. CISA’s Secure Our World campaign puts both at the top of its short list of steps for individuals and small businesses. This guide explains how to set them up, in what order, and which kinds of two-factor authentication to prefer.

Passwords: what current guidance says

NIST’s digital identity guidelines (SP 800-63B, now in revision 4) set the standard many organizations follow, and they’ve moved away from the rules most people remember:

• Length beats complexity. Long passwords and passphrases are what matter. Revision 4 (final, 2025) sets a minimum of 15 characters when a password is the only factor and 8 when it’s used with a second factor, and asks services to allow much longer ones.
• No forced composition rules. Services shouldn’t require a mix of character types.
• No routine expiry. Services shouldn’t force periodic changes; passwords should be changed when there’s evidence of compromise.
• Check against breached passwords. Services should reject passwords known to be compromised.

What this means for you: use a long, unique password for every account. The only way to do that across dozens of accounts is a password manager.

Password managers

A password manager generates a strong, unique password for each site, stores them encrypted, and fills them in for you. You remember one strong master password (or passphrase) and protect the manager itself with two-factor authentication.

Why it matters for PIs:

• One breached website can’t unlock your other accounts, because nothing is reused.
• A good manager only fills a password on the real site, which helps protect you from phishing pages that look like your email or bank login.
• You can store other sensitive items securely: data-provider logins, software license keys, recovery codes.

Choosing one: look for end-to-end encryption of your vault (the provider can’t read it), two-factor authentication on the vault, apps for all your devices, a good security track record, and sharing features if you work with a partner or staff. Most reputable managers meet these.

Your master password: make it a long passphrase you haven’t used anywhere else. Several random words is easier to remember and harder to guess than a short, complicated password. Write it down once and keep that copy somewhere physically secure until you’ve memorized it.

Getting started without disruption:

1. Install the manager on your computer and phone.
2. Add your email account first, then change its password to a new, generated one.
3. Add accounts as you log in to them over the next few weeks, changing the password on each important one as you go.
4. Check whether your addresses appear in known breaches (Have I Been Pwned is a free, widely used service) and change any passwords from affected sites first.

Two-factor authentication

Two-factor authentication (2FA, or multifactor authentication, MFA) means a password alone isn’t enough to log in. You also need something else: a code from an app, a physical key, or approval on your phone. CISA calls MFA one of the most effective ways to protect accounts.

Not all 2FA is equal. From strongest to weakest:

1. Security keys and passkeys (phishing-resistant). A hardware key (a small USB or NFC device) or a passkey stored on your phone or computer, using the FIDO/WebAuthn standards. The key checks which website it’s talking to, so a fake login page can’t capture anything useful. CISA describes FIDO-based authentication as the strongest, phishing-resistant form of MFA. Passkeys can also replace passwords entirely on sites that support them.

2. Authenticator apps. An app on your phone generates a six-digit code that changes every 30 seconds. Much stronger than SMS and widely supported. The weakness: a convincing fake login page can ask you for the code and use it immediately.

3. Push notifications. Your phone asks “Is this you trying to log in?” Convenient, but attackers exploit it by sending repeated prompts until someone taps “approve.” Services that show a number you must match are better. Never approve a login you didn’t start.

4. SMS text codes. Better than nothing, but the weakest option. Codes can be intercepted, and attackers can sometimes take over your phone number by convincing your carrier to move it to their SIM (“SIM swapping”). CISA advises using SMS only when nothing stronger is available. If you must use it, ask your mobile carrier about adding a port-out PIN or account lock.

What to protect first

Turn on the strongest 2FA each service supports, in this order:

1. Email. It can reset everything else.
2. Password manager.
3. Cloud storage and backups (where evidence and reports live).
4. Case-management software and client portals.
5. Investigative data providers. These accounts can search for people, and misuse can have legal consequences for you.
6. Banking, payments and accounting.
7. Phone carrier account (to reduce SIM-swap risk).
8. Domain registrar and website hosting, if you have a business website and email on your own domain.
9. Social media, especially any accounts used for research.

Recovery codes and lost devices

When you turn on 2FA, most services give you recovery codes. Store them in your password manager and somewhere offline (a printed copy in a safe place). If you use security keys, register at least two and keep the spare somewhere safe. Losing your only second factor can lock you out for days, which is a real problem in the middle of a case.

Some services, especially end-to-end encrypted ones, can’t restore your data if you lose both your password and your recovery key, because they never had access to it. That’s a feature, but it makes storing recovery keys properly essential. See zero-knowledge encryption, explained.

Staff and subcontractors

If anyone else works on your cases:

• Everyone gets their own account. No shared logins.
• Everyone uses a password manager and 2FA; make it a condition of access.
• Share credentials, when you must, through the password manager’s sharing feature, never by text or email.
• Remove access the day someone stops working with you.

Phishing: the attack 2FA is meant to stop

Most account takeovers start with a message: “Your mailbox is full,” “A document has been shared with you,” “Unusual sign-in detected.” Take a moment before you log in through a link. Go to the site directly or use your password manager, which won’t fill in a password on a lookalike site. Treat unexpected requests for codes as an attack; legitimate services don’t ask you to read your 2FA code to anyone.

A one-hour plan

1. Install a password manager and set a strong master passphrase.
2. Turn on 2FA for the password manager.
3. Change your email password to a generated one and turn on the strongest 2FA it offers.
4. Save recovery codes in the manager and on paper.
5. Repeat step 3 for cloud storage and case software.

The rest can happen over the next few weeks as you log in to each account. For the wider picture, see data security for private investigators.

Spotted an error? Tell us by email and we'll correct it.