How to Secure Your Yahoo Mail Account

Everything you'll set up lives in one place. On a computer, sign in to Yahoo, click your profile icon (top-right) and choose Manage your account, then open the Security tab. The section you want is Ways of signing in — that's where two-step verification, passkeys, your phone numbers and your password all live.

This is the single biggest upgrade: with it on, a stolen password alone won't get anyone in. Under Ways of signing in, open Two-step verification and switch it on, then:

1. Choose Authenticator app when asked which method you prefer — its codes are generated on your device and can't be SIM-swapped like a texted code
2. Scan the QR code with your authenticator app, then enter the 6-digit code it shows and continue
3. If you only have one verified contact on file, Yahoo will make you add a second — choose Add contact info, pick Email, and add a private recovery address. A Proton Mail address is the most secure choice here: it's end-to-end encrypted, so it can't be quietly read or reset the way a big-tech inbox can. Enter the code Yahoo emails you to verify it
4. With two verified contacts in place, continue to the end — you'll see a confirmation that 2-step verification is on

Keep a text or email code as a backup only — not your main method.

Your recovery options decide how you get back in if you're ever locked out — so make them as hard to abuse as possible. The single most important change: lean on a secure email rather than a phone number. Phone numbers can be SIM-swapped, where an attacker ports your number to their own SIM and intercepts every code sent to it.

1. Under Ways of signing in, make sure your recovery email is a private, encrypted address — a Proton Mail address is the strongest choice. A passkey is good to keep as well, but a secured Proton email is the better recovery anchor
2. Then remove your phone number to shut down SIM-swap attacks: open Phone numbers and delete it

One catch: if two-step verification is on and you only have two recovery options, Yahoo won't let you remove the phone until you've added a second email first. Add another verified email you control, then remove the number.

Finish with a long, unique password you don't use anywhere else — especially important given Yahoo's breach history. Under Ways of signing in, open Password and set a new one: aim for 16+ characters, and don't base it on anything personal.

The easiest way to do this well is to let a password manager generate and remember it for you, so it's always long, random and never reused.