Let's be real: "Fluffy2019!" is not a secure password, even though it meets the "one capital letter, one number" requirement that every website still inexplicably uses.

Here's what actually works:

For parents: Use a password manager. Full stop. 1Password and Bitwarden both have family plans that let you share certain passwords (like the Netflix login) while keeping others private. Yes, it feels like one more thing to manage, but it's genuinely the only way to have strong, unique passwords for every account without losing your mind.

For kids: They need to learn password hygiene early, but they're not ready for a full password manager at 8. Start with:

By middle school, kids can graduate to their own password manager vault that you have access to. This teaches them the system while you maintain oversight.

The actual format that works: Passphrases beat complex passwords every time. "PurpleDinosaursEatPizza47" is both easier to remember and more secure than "P@ssw0rd!". Teach your kids to think in sentences, not words.

Two-factor authentication (2FA) is that annoying extra step where you need your phone to log in. It's also the single most effective security measure you can implement.

Turn it on for:

The kid factor: For younger kids, this means they'll need you to log in on new devices—which is actually a feature, not a bug. You'll know when they're trying to access their account from somewhere new. For teens, you can set them up with an authenticator app on their phone, which gives them independence while maintaining security.

Every platform has parental controls. Almost nobody configures them properly. Here's the hierarchy of what matters:

iOS: Screen Time is built in and surprisingly robust. You can:

Android: Family Link gives you similar control, though it's slightly less intuitive. The key is linking their Google account to yours during setup—retrofitting it later is a pain.

Windows/Mac: Both have parental control systems, but they're honestly not great. Focus on browser-level controls and app-specific restrictions instead.

Gaming platforms: Every major gaming system has parental controls, and they're all slightly different:

Roblox: This deserves its own section because it's where most families get burned. Set up Roblox parental controls properly:

YouTube: The choice between YouTube and YouTube Kids matters. YouTube Kids is heavily restricted but also kind of soul-crushing in its limitations. For kids 9+, regular YouTube with Restricted Mode enabled and supervised accounts is usually the better call.

Router-level filtering (like Circle, Bark, or your ISP's parental controls) can block categories of content across all devices. They're useful for:

They're less useful for:

Technology can only do so much. The real security comes from kids understanding why these measures exist and what they're protecting against.

For elementary schoolers: Focus on the concept that accounts and passwords are like house keys. You don't give your house key to strangers, and you don't share passwords with friends—even best friends. Talk about how people online might not be who they say they are, without resorting to scary "stranger danger" rhetoric that doesn't actually match how modern predators operate.

For middle schoolers: This is when social engineering becomes the real threat. They need to understand:

For high schoolers: Shift to threat modeling and critical thinking. They should understand:

Beyond parental controls, there are privacy settings that matter:

Location sharing: Turn it off by default on everything. If an app needs location to function (like Maps), set it to "While Using" not "Always."

Photo metadata: Your photos contain GPS coordinates by default. Teach kids to be aware of this before posting.

App permissions: Regularly audit what permissions apps have. Does that random game really need access to contacts, camera, and microphone? Probably not.

Social media privacy: Even if your kid isn't "supposed" to have social media yet, they probably do. Instagram, Snapchat, and TikTok all have privacy settings that should be configured properly:

In-app purchases are designed to be frictionless—which is exactly the problem. Here's the hierarchy of safety:

Gift cards are your friend here. Load up their account with a specific amount for Roblox, Fortnite, or whatever they're into. When it's gone, it's gone. This teaches budgeting and prevents the $800 surprise.

Because it will. Accounts get hacked, kids click on phishing links, someone's going to accidentally buy $50 of Minecraft skins. Here's your response plan:

For compromised accounts:

For unauthorized purchases:

For privacy breaches:

How much should you monitor? This is where families diverge based on values, kid personality, and age.

The spectrum:

There's no right answer, but here's the thing: monitoring without conversation breeds sneakiness. Kids will find workarounds. The goal isn't to catch them doing something wrong—it's to teach them to make good decisions when you're not watching.

For most families, the sweet spot is:

Device security isn't about building an impenetrable fortress—it's about creating enough friction that your kids pause before making risky decisions, and enough visibility that you know when something's wrong.

Your action plan for this week:

Your action plan for this month:

Security isn't a one-time setup—it's an ongoing practice. But getting the basics right now means you're not dealing with a hacked account, a $500 surprise charge, or a privacy nightmare later.

And if you need help figuring out what security measures make sense for your specific situation—like whether your 10-year-old really needs their own email or how to handle Discord for your teen—ask about your specific situation. Every family's different, and the best security setup is the one you'll actually maintain.