Start Here · iPhone · Your path
Passwords and 2FA
One strong password per account, and codes off your SMS. Work down the list — each step builds on the ones above it.
Start here
-
Install a Password Manager
⏱ 45 min ★ Impact: Critical
The single most important change on this list.
-
Password Manager: the private alternatives
From the replacement table, kept up to date.
-
Authenticator: the private alternatives
From the replacement table, kept up to date.
-
Passwords and codes out of Google
De-Google Your Life · Chapter 5
-
Two-Factor Codes You Won't Lose
Off text-message codes and onto an authenticator app, out of apps that won't export, and a backup you've actually restored — so losing your phone doesn't mean losing your accounts.
Off text-message codes, and a backup of your codes you've tested.
beginner⏱ 60 min -
Moving into Proton Pass, and using it
Proton Suite: The Definitive Guide · Chapters 3–5
If you choose Proton Pass.
-
Proton Authenticator, and locking down the account
Proton Suite: The Definitive Guide · Chapters 6–7
If you use a Proton account.
Run it yourself
Optional, and a bigger step: host it on a small server at home so the data never leaves your house. Do these in order — each one assumes the last.
-
Plan the server: threat model, hardware, networking
Be Your Own Cloud · Chapters 1–4
Decide whether self-hosting suits you before buying anything.
-
Self-Hosting Trade-offs
What you gain against what you take on, stated plainly before you invest.
-
Homelab Hardware
Six starting points by cost, power draw and what each is good for.
-
Installing Ubuntu Server for a Home Lab
From USB stick to a headless, static-IP, auto-patching box you can SSH into — the machine every self-hosting guide assumes you already have.
beginner⏱ 60 min -
SSH: Key-Only Login and Sensible Hardening
Turn off password authentication, lock down root, and stop the log noise — the twenty minutes that closes the most-attacked door on any server.
beginner⏱ 25 min -
Docker and Compose, Properly Installed
The right repository, the docker group and what it actually grants, a Compose file you can read, and the update routine that keeps a homelab from rotting.
intermediate⏱ 45 min -
Storage
Be Your Own Cloud · Chapter 7
-
Reverse proxy, HTTPS and local DNS
Be Your Own Cloud · Chapter 8
-
Reverse Proxy and HTTPS, Set Up Once
Chapter 8's Nginx Proxy Manager from empty folder to a trusted padlock: the shared proxy network, a DNS-only API token, one wildcard certificate for every service, and a way to test it all before Pi-hole exists.
Every service page assumes this is done.
intermediate⏱ 45 min -
Secrets and .env files
Be Your Own Cloud · Chapter 9
-
Vaultwarden
Be Your Own Cloud · Chapter 11
-
Vaultwarden: Going Deeper
Chapter 11's password vault deployed step by step: the exact proxy settings, a hashed admin token that doesn't sit in plain text, two-factor, and the extra backup that doesn't depend on your server at all.
beginner⏱ 45 min