Secure your Apple Account

Confirm your account and password

1. On iPhone or iPad, open Settings → your name. On Mac, open System Settings → your name. Confirm the account email or phone number belongs to you.
2. Confirm you can find this account in your password manager. If the password is reused or exposed, replace it with a unique generated password using the device instructions below. Save the replacement.

Use the password-manager guide if you need help saving a unique password. You do not need to replace an already unique, unexposed password just to finish this check.

Official instructions

Enable two-factor authentication and check trusted numbers

1. On iPhone/iPad, open Settings → your name → Sign-In & Security → Two-Factor Authentication. On Mac, use System Settings → your name → Sign-In & Security → Two-Factor Authentication.
2. If two-factor authentication is off, follow the setup prompts to turn it on. Confirm it shows as enabled.
3. Inspect trusted phone numbers. Add and verify a current number before removing one you no longer control. If practical, add a second reliable number that remains reachable if your main iPhone is lost.

Only approve a sign-in request you initiated. Never read a verification code to someone who contacts you. A trusted number is a way to receive codes; it does not give its owner ordinary access to your account.

Official instructions

Review devices signed in to your account

1. Open Apple Account and select Devices, or scroll through the device list under your name in Settings/System Settings.
2. Open each entry and identify the device. Remove devices you no longer own after signing out of them, and investigate entries you cannot recognize.
3. If a device is missing or stolen, use the Emergency checklist before removing it from your account.

Removing a missing device can affect Find My and theft protections. An unfamiliar device is a reason to follow the account-recovery guide, rather than treating it as ordinary cleanup.

Official instructions

Add a recovery contact

1. Choose a trusted person with a compatible Apple device and ask if they are willing to help with account recovery.
2. On iPhone/iPad, open Settings → your name → Sign-In & Security → Recovery Contacts → Add Recovery Contact. On Mac, use System Settings → your name → Sign-In & Security → Recovery Contacts.
3. Follow the prompts and confirm the person is listed as added. If an invitation is required, wait for acceptance before marking this task complete.

A recovery contact can provide a recovery code without gaining access to your account. Apple lists device, age and iMessage requirements in the linked instructions. Older software may place this option under Account Recovery. Record the contact’s name in your private notes, not any recovery code.

Official instructions

Enable Stolen Device Protection if you use an iPhone

1. On your iPhone, open Settings → Face ID & Passcode or Touch ID & Passcode → Stolen Device Protection. Update iOS and set up the listed prerequisites if the option is unavailable.
2. Turn protection on. For protection regardless of location, choose Always under Require Security Delay, if offered.
3. Reopen the setting to confirm it is enabled. If you do not use an iPhone, mark this task not applicable.

This requires a supported iOS version, a passcode, biometrics, two-factor authentication, Find My and the location prerequisites Apple lists. Choosing Always means some account changes require a delay even at home and some actions require biometrics without a passcode alternative. Read those tradeoffs before choosing it.

Official instructions

Confirm your recovery plan and schedule a review

1. Check that you can unlock your password manager and reach at least one trusted number if your main device is unavailable.
2. Record your recovery contact’s name and where your recovery information is stored. Keep passwords and codes off this tracking checklist.
3. Create a calendar reminder three months from today to recheck trusted numbers, devices and your recovery contact.

If you already use a recovery key or hardware security keys, keep their recovery arrangements accessible separately from your main device. These optional features need their own recovery planning; they are not required to complete this guide.

Keep Automatic Verification enabled

Automatic Verification privately verifies your device and account to participating apps and websites, reducing CAPTCHA challenges. It is enabled by default and does not replace your password or two-factor authentication.

1. On iPhone/iPad, open Settings → your name → Sign-In & Security → Automatic Verification. On Mac, use System Settings → your name → Sign-In & Security → Automatic Verification.
2. Confirm it is on; turn it on if it is off.
3. Reopen the setting to confirm your choice. You may still see CAPTCHAs on sites that do not support it.

Apple’s Automatic Verification instructions

Choose a Legacy Contact

A Recovery Contact helps you regain access while you are alive. A Legacy Contact can request access to certain account data after your death. Legacy access does not include iCloud Keychain passwords or passkeys, or purchased media and subscriptions. Choose someone you trust with this responsibility; any one Legacy Contact can make decisions about the account data after access is granted.

1. Choose your contact and discuss the role with them. They do not need an Apple device or Apple Account.
2. On iPhone/iPad, open Settings → your name → Sign-In & Security → Legacy Contact → Add Legacy Contact. On Mac, use System Settings → your name → Sign-In & Security → Legacy Contact.
3. Follow the prompts. Share the access key using the offered method, or choose Print a Copy. Confirm your contact received it and knows where to find it.
4. Save another copy with your important records. Confirm the contact is listed and the access key is retrievable.

Your contact will need the access key and documentation of your death to request access. Documentation requirements vary by country or region. Do not write the access key on this progress checklist.

Apple’s Legacy Contact instructions

Set up Contact Key Verification if it fits your needs

Contact Key Verification helps detect sophisticated attacks against iMessage and lets you verify contacts. It does not prevent ordinary phishing or text-message scams. It requires compatible software on all devices signed in to iMessage, iCloud Keychain, two-factor authentication, and device passcodes or passwords. Managed Apple Accounts are not supported.

1. Read Apple’s requirements. Update your devices first. If a device cannot be updated, Apple requires signing out of iMessage on that device before enabling this feature.
2. In Settings or System Settings, open your name → Contact Key Verification. Turn on Verification in iMessage and follow the prompts.
3. Ask a contact who also uses the feature to open your conversation in Messages. Open conversation details and choose Verify Contact on both devices.
4. Compare the codes in person, over FaceTime or another secure call. If they match, choose Mark as Verified and confirm the verification mark appears. If they do not match, stop sharing sensitive information until you resolve the mismatch.

Keep Apple’s verification-alert instructions available if a future alert appears. Do not treat an alert as something to dismiss automatically.

Decide whether a Recovery Key is right for you

Recommended starting choice: keep the Recovery Contact setup above. You do not need a Recovery Key to complete this guide.

Enabling a Recovery Key turns off Apple’s standard account recovery process. If you lose access and cannot provide the required recovery factors, you can be permanently locked out. Apple cannot supply a lost key. Read Apple’s Recovery Key instructions before deciding.

1. Decide whether you can maintain secure copies outside this Apple Account. If not, mark this option Skipped or Revisit later and keep your current recovery arrangements.
2. If you choose to proceed, prepare safe storage locations first. Do not store the key in Apple Passwords, iCloud Photos, Notes or iCloud Drive; losing the account can make those copies inaccessible.
3. On iPhone/iPad, open Settings → your name → Sign-In & Security → Recovery Key. On Mac, use System Settings → your name → Sign-In & Security → Recovery Key. Follow the setup prompts.
4. Print or write down the key, store the copies securely, and complete Apple’s confirmation step. Confirm you can retrieve a copy and reach your trusted phone number without relying on the lost device.
5. Record only the storage locations in your private records. Keep the key itself off this tracking checklist.

If you already have a Recovery Key, check its storage and your trusted number rather than generating a replacement unnecessarily. A Recovery Key is different from the Legacy Contact access key; label your private records clearly.