Protect your Apple ID and iCloud Mail with two-factor authentication, trusted devices, and privacy-first settings.
Good to know
Your iCloud Mail is tied to your Apple ID — securing it protects your photos, backups, purchases, and all Apple devices.
1. Enable Two-Factor Authentication
Apple's two-factor authentication sends verification codes to your trusted devices. It's essential and cannot be disabled once enabled on newer accounts.
- On iPhone/iPad go to Settings → Your Name → Sign-In and Security → Two-Factor Authentication.
On Mac go to System Settings → Apple ID → Sign-In and Security. Ensure that all trusted phone numbers & device are your own.
Tip
It is important to make sure all trusted devices run the latest OS version to ensure maximum protection from exploits. Older & unsupported devices should be removed from the account.
2. Set Up a Recovery Key
A Recovery Key gives you full control over account recovery, but means Apple cannot help if you lose it.
- Go to Settings → Your Name → Sign-In and Security → Account Recovery & generate a 28-character Recovery Key. Write it down and store it in a secure physical location
Do NOT store it only on your Apple devices
Test the key by entering it once to confirm you recorded it correctly
3. Use App-Specific Passwords
- Required for third-party apps that access iCloud
Generate at appleid.apple.com → Sign-In and Security → App-Specific Passwords
Create a unique password for each third-party app
Revoke passwords for apps you no longer use
Never share these passwords with anyone
4. Review Trusted Devices
- Go to appleid.apple.com and review the Devices section
Remove any device you no longer own or recognise
Check that each listed device is actually yours
Sign out of old devices before selling or giving them away
Enable Find My on all active devices
5. Use Hide My Email and iCloud Private Relay
Apple offers powerful privacy features for iCloud+ subscribers that help protect your real email address.
- Use Hide My Email to create unique random addresses for sign-ups
Enable iCloud Private Relay to mask your IP address in Safari
Review and delete unused Hide My Email addresses periodically
Use Sign in with Apple wherever available
These features reduce your exposure to data breaches
6. Strengthen Your Apple ID Password
- Use a unique password of at least 16 characters
Never reuse your Apple ID password on any other service
Use iCloud Keychain or another password manager
Change your password immediately if you suspect compromise
Avoid using personal information in your password
Important
Worried your iCloud account may already be compromised? Read our companion guide: How to Tell If Your iCloud Mail Has Been Compromised.
Locking down other accounts?
These steps apply to any inbox — here's the complete email-security guide.
Secure any email accountWas this guide helpful?
Know someone who needs this? Send them the guide.
JD
Written by
Jordan DicksonFounder, CyberSecurityGuides
Founder of CyberSecurityGuides, writing practical, jargon-free guides that help everyday people recover from and protect against online attacks.
Reviewed by CSG Security Engineers