Recover my account

PlayVault / Protect your accounts / Security checklist

Account protection checklist

Secure Your PSN and Xbox Accounts: A Full Checklist

Your PlayStation Network account and the Microsoft account behind your Xbox profile both have protections you switch on yourself: two-step verification, saved backup or recovery codes, passkeys, device lists and console PINs. Set them up in one sitting, in the order below, starting with the email you sign in with. Each step names the official setting and where to find it.

See which protections applyJump to the setup order

Everything here is done by you, on your own account, in official PlayStation or Microsoft settings. We never ask for passwords or codes.

How PlayVault works

Sony's and Microsoft's own routes

Every step points to the provider's own sign-in screens, help pages and recovery forms.

No codes, no passwords

We never ask for passwords, recovery codes or two-step codes. There is nothing to type here.

Independent guide

PlayVault is not affiliated with Sony or Microsoft; screens change, so follow what your account shows.

Which setup is yours?

Choose the account or console you want to protect first. Each route lists the settings that matter most for it; the full order follows below.

Route 1: your PlayStation accountSettings in Account Management
What do you want to protect?

I play on PS5 and want my PSN account locked down.

  • Turn on 2-Step Verification
  • Save the backup codes offline 10
  • Choose a passkey or Password at Checkout, not both

In Account Management, under Security, turn on 2-Step Verification and keep the backup codes away from your devices. Then pick one purchase lock: PlayStation says Password at Checkout doesn’t work on an account with a passkey.

Your protections, step by step

Choose what you want to protect. Each route lists the official setting and where it has a catch.

The setup order, in full

Do it in this order with your phone and a pen nearby; each step builds on the one before. You need to be signed in to your own accounts. If you already can't sign in, start with the PSN sign-in guide or the Xbox lockout guide instead.

  1. Secure the sign-in email first. PlayStation warns that someone who gets into your email may be able to reset passwords for other accounts, so protect that inbox in your email provider's own settings.
  2. Change weak game passwords. PlayStation recommends a strong, unique password for each account, so PSN and your Microsoft account should each have their own.
  3. Turn on two-step verification on both accounts. PSN offers an authenticator app or text message. Microsoft recommends keeping three pieces of security info on the account, so add more than one.PSN: Account Management → Security → 2-Step Verification Status → EditPS5: Settings → Users and Accounts → Security → 2-Step VerificationMicrosoft: account.microsoft.com/security → Manage how I sign in → Two-step verification → Turn on
  4. Save your codes offline. PSN gives you 10 backup codes, each usable once. Microsoft's recovery code is a single 25-digit code, and creating a new one stops the old one working. Write them down and keep them away from the phone you sign in with: once you can't sign in, you can't check PSN backup codes online.PSN: Account Management → Security → Backup Codes
  5. Add a passkey if your devices support it. PlayStation says passkeys work on most phones with iOS 16+ or Android 9+ and on the latest Safari, Chrome or Edge. PlayStation doesn't say how 2-step and backup codes work alongside a passkey; keep your backup codes saved anyway.PSN: Account Management → Security → Sign in with Passkey → Create a PasskeyMicrosoft: Advanced security options → Add a new way to sign in or verify → Face, Fingerprint, PIN, or Security Key
  6. Clean up devices. Microsoft lists your devices at account.microsoft.com/devices; its help page doesn't say removing one signs it out, so sign out on a console while you still have it. PSN can't remove a single console remotely; its Deactivate All Devices option removes every console at once and works once every six months.PSN: Device Management → PlayStation Consoles → Deactivate All Devices
  7. Lock purchases and shared consoles. On Xbox, choose Ask for my PIN or Lock it down, and remove your saved password from a console others use. On PS5, set a login passcode. Turn on Password at Checkout only if you don't use a PSN passkey.Xbox: Profile & system → Settings → Account → Sign-in, security & PIN → Change my sign-in & security preferencesPS5: Settings → Users and Accounts → Login Settings → Set a PS5 Login PasscodePS5: Settings → Users and Accounts → Account → Payment and Subscriptions → Purchase Settings

What's already switched on?

Press each one you've done in your own settings. Don't type any details here.

Press what's done to see what to do next.

It follows the setup order above. Nothing you press leaves this page.

Limits to know before you lock down

Passkey or checkout password, not both: PlayStation's own page says “Password at Checkout is not compatible with your account if you have passkeys set up.” If you use a passkey, rely on the PS5 login passcode and check Purchase Settings yourself.

Signing out from the web doesn't reach everything either. This is what Microsoft describes for its sign-out-everywhere option:

What Microsoft's sign-out everywhere reaches You sign out everywhereOn the web, for your wholeMicrosoft account. Within 24 hoursBrowsers and apps that use theaccount are signed out. Xbox consolesNot included: sign out on each one.
Microsoft's sign-out reaches browsers, apps and other places within 24 hours, except an Xbox console. On PSN, Sign Out on All Devices sits at the bottom of the Security page.
StepWhereLimit to know
Two-stepPSN Security page; Micro­soft's Security tabMicro­soft is phasing out text-message codes, so add an app
CodesPSN Backup Codes; Micro­soft recovery code10 PSN codes, hidden once you're locked out; one 25-digit Micro­soft code, cancelled by a new one
PasskeyPSN Sign in with Passkey; Micro­soft Advanced security optionsNot with PSN Password at Checkout
DevicesPSN Device Manage­ment; Micro­soft's devices pagePSN: all consoles at once, every 6 months; Recent activity: 30 days
Console locksPS5 Login Settings; Xbox Sign-in, security & PINSet on each console: a PS5 passcode, an Xbox PIN or password

How the two accounts differ, term by term and timer by timer, is on PSN and Xbox security settings compared.

What no one can do for you

These settings live inside your own accounts, and only you should sign in to change them. PlayStation warns about messages asking you to sign in through a link or share account information to fix an issue; our phishing guide shows what those look like. If you see trophies, purchases or messages you don't recognize, go to what to do when someone else is using your PSN.

When the usual route won't work

  • You set up a PSN passkey and Password at Checkout. PlayStation says the two aren't compatible, so the checkout password won't protect you. Use the login passcode and keep an eye on Purchase Settings.
  • One old PlayStation console is still signed in. PSN can't deactivate it on its own remotely. Deactivate All Devices removes every console at once and can be used once every 6 months. Signing out of all PSN devices covers the steps.
  • You signed out everywhere on the web, but an Xbox still shows your profile. Microsoft's sign-out takes up to 24 hours and skips Xbox consoles. Sign out on the console itself, or see an unknown console signed in to Xbox.
  • You lost your phone before saving codes. PlayStation says you can't check backup codes online once you can't sign in. Go to the lost-phone guide for PSN 2-step or its Xbox counterpart.
  • You made a new Microsoft recovery code. The previous code stops working the moment the new one exists, so replace the printed copy too.
  • A sign-in you don't recognize is older than a month. Microsoft's Recent activity only shows the last 30 days, so a sign-in older than that won't be listed. Look at it at least once a month, and right away if Microsoft emails you about unusual activity.

Questions about securing your accounts

Which protection should I turn on first if I only have five minutes?

Secure the email you sign in with, then turn on two-step verification for the game account. PlayStation sends password reset emails to your email address and Microsoft can send sign-in codes there, so protecting that inbox protects everything else.

I use a family member's console. Which settings matter most?

Set a PS5 login passcode, or choose Ask for my PIN or Lock it down on Xbox, and sign out when you're done. You can also remove your saved Microsoft account password from that console, so it asks for it at every sign-in.

Does signing out everywhere on the web sign out my Xbox?

No. Microsoft says its sign-out reaches browsers, apps and other places within 24 hours, except an Xbox console. Sign out on each console you no longer use.

What should I do with my backup codes after I write them down?

Keep them somewhere offline and private, away from the phone you sign in with. PlayStation notes you can't look them up online once you're locked out, and a new Microsoft recovery code replaces the previous one.

How often should I review these settings?

Microsoft's Recent activity only shows the last 30 days, so a sign-in older than that won't be listed. Look at it at least once a month, and right away if Microsoft emails you about unusual activity. Look at your device lists and how many PSN backup codes you have left, and check again after selling a console or changing phones.

Can PlayVault set these protections up for me?

No. These settings live inside your own accounts, and only you should sign in to change them. We explain where each option is and link the official help page for each.

Sources

Verified October 2026 against the PlayStation, Microsoft and Xbox support pages above. Menu names can vary by console software and region; follow what your own account shows.

We use cookies.
We use cookies to collect data to improve your experience on our website. Read our usage policy cookies You can your preferences at any time.