A strong password is long, random and different for each account. Use a different password for each account. Then one stolen password cannot open everything. You can add a second lock. Two-step verification asks for a second proof that it is really you. The proof can be a code sent to your phone, in addition to your password. It can stop a criminal who has your password from getting into your account. It is also called two-factor authentication, 2FA or multifactor authentication.

A passphrase is a password made of several unrelated words. A password manager is a program that makes, stores and fills in your passwords, so you only remember one strong one. Simple passwords like "password" or 12345 are easy to guess. Do not use them. Your birthday, your pet's name and your family's names make poor passwords, because they are easy to find out. Software updates fix security weak spots, so install them when your device asks. Automatic updates install themselves. You do not have to remember to do it.

Cookies are small bits of data a website saves in your browser. They can remember your login, for example. Cookies can also be misused to link your visits and searches together, which is a privacy concern. Browsers let you block, limit or delete cookies. Privacy settings let you choose who can see your profile and posts. Public Wi-Fi is open to anyone, so be careful what you do on it. On public Wi-Fi, avoid using sensitive accounts like banking or making purchases.

Not everything online is true. People can post false or misleading things, and misinformation can spread. Anyone can publish online, so it is useful to check who is behind a page. A good first step with a surprising post is to stop and notice how it makes you feel before sharing it. The SIFT method has four moves: Stop, Investigate the source, Find better coverage, and Trace claims back to the original. Check what a claim looks like on other trusted sites to see if they agree. Lateral reading means leaving an unfamiliar site and opening new tabs. You see what trusted sources say about it.

A padlock or https at the start of a web address shows that a site's connection is secure. Scammers make fake websites that try to steal passwords or other personal information. Phishing is when criminals try to get you to open harmful links, emails or attachments that ask for your personal information. A message that pushes you to act right away is a common sign of phishing. A message that asks you to send personal or financial information is a warning sign too. If you think a message might be a scam, do not click or open anything in it.

If you get mean messages, you can block the sender. You can report mean or cruel posts to the website or app. If you see someone being cyberbullied, do not join in and do not stay silent: tell an adult. If something online upsets a friend, help them and speak up to a grown-up you trust. If something online makes you feel sad, scared or confused, tell a trusted grown-up. Telling a grown-up about something that worried you online is the right thing to do. You should not be in trouble for telling.

Words to know

• cookies: saved data bits
• authentication: proving identity
• misinformation: false things spreading
• phishing: tricks for information