Password and account security for creators so your portfolio is not hijacked

Why creators are worth hijacking

Illustration, photography, music and design careers now run through a handful of accounts: email, a domain registrar, a portfolio or shop, social profiles, a newsletter tool, cloud storage, and sometimes a distributor or print-on-demand service. Those accounts are connected. If an attacker resets your email, they can often reset everything else.

The harm is not only financial. A changed portfolio can confuse clients. A compromised shop can sell files you did not approve. In a climate where AI-generated lookalikes circulate quickly, a broken or impersonated profile also makes it harder for people to find the work you actually published. For the wider picture, see how to protect yourself from AI forgeries and illustrators: timestamp portfolio work before you post it online.

Account security does not date a file. It reduces the chance that someone else can rewrite the public trail around that file.

A practical account-security routine

You do not need a corporate security team. You need a short list of habits that cover the accounts that can unlock the others.

1. Unique passwords, stored in a manager. Reusing a password from a forum or an old shop account is still the most common way a portfolio disappears. A password manager generates a long unique password for each site and fills it on your devices. You memorise one strong master password (and, ideally, keep a printed recovery kit somewhere safe, not in the same bag as the laptop).

2. Turn on two-factor authentication (2FA), preferably an app or a security key. SMS codes are better than nothing and worse than an authenticator app or a hardware key, because phone numbers can be ported. Add 2FA first on email, the domain registrar, the host or portfolio, and any store that pays you.

3. Protect the mailbox that resets everything. If you have an old Yahoo, iCloud or ISP address still listed as the recovery email on important accounts, change it to a mailbox you still control, and put 2FA on that mailbox too. A privacy-focused mailbox such as Proton Mail (affiliate link) can be that recovery address; official materials describe end-to-end encryption. It still needs a unique password and 2FA, and it is not a dated record of your files.

4. Check whether your addresses have appeared in known breaches. Have I Been Pwned lets you search an email address against public breach data. Never type your password into that site. If a login appears, change it and do not reuse it.

5. Lock down domain and DNS access. The registrar account for yourname.com can take a portfolio offline even if the site builder is fine. Use a unique password, 2FA, and a registrar lock if it is offered.

6. Separate “public posting” from “files you keep”. Social apps are for publishing copies. The originals stay in a folder you back up, with a dated record of the versions you post. See is Google Drive or Dropbox version history proof a file existed? and the creator timestamping hub.

7. Have a recovery path. Save backup codes for 2FA. Note how you would recover a manager vault if your phone were stolen. If you use a zero-knowledge manager, the vendor often cannot reset your master password for you.

What a password manager can and cannot do

A manager can:

• Store logins, and often passkeys, in an encrypted vault.
• Generate unique passwords and fill them in a browser or app.
• Sync across devices so you are not tempted to reuse a short password.
• On some products, warn you if an email or domain appears in a data-breach feed, or offer masked email aliases and a built-in authenticator.

A manager cannot:

• Stop an attacker who already has a logged-in session, a stolen 2FA code, or recovery access to your mailbox.
• Undo a post or a sale made from a hijacked shop before you notice.
• Prove that a file is yours, or that a portfolio image existed before a copy appeared elsewhere.
• Replace a dated record of the work itself.

If an account is taken over, you will be glad you still have the original files and a TimeBind of what you published. If the files are safe but the account is weak, you will be glad you can recover the profile. You want both.

If an account is hijacked, what still helps

Act quickly on the usual steps: change the password from a device you trust, revoke sessions, contact the platform, and warn clients if a shop or inbox was used to message them. Those steps are about recovery.

Separately, you may need to show that a piece of work existed before the account was used to post or sell something else. That is a file-record problem:

• Keep the original files offline or in a backup you control.
• Keep a TimeBind of the versions you actually published or delivered.
• Keep export or platform receipts where they exist (order reports, Instagram data downloads, and so on). Those are useful context; they are not the same as a fingerprint of the file.

See how to prove a file existed before a date and how to prove someone copied your work. A TimeBind does not prove you own the account, and it does not detect AI. It shows that an exact file existed no later than the recorded time and still matches.

If personal details harvested from data-broker sites made an impersonation easier, a slow, ongoing reduction of public personal data can help, but it is not a substitute for 2FA. See how to protect yourself from AI forgeries.

Everyday habits that close the obvious holes

• Do not share a portfolio login in a chat thread. Use the manager’s sharing feature, or create a staff seat, if someone else needs access.
• Be wary of “your shop will be closed” emails. Open the site by typing the address you already know, not by clicking the email.
• Review connected apps and leftover admin users when a collaborator leaves a project.
• When you retire a public email address, update the recovery details on every important account before you close it.
• Date the files you care about before a crisis. You cannot fingerprint last year’s original if the only copy lived in the account that was just wiped.

Creators who also send large delivery packs can pair this with protecting a design before sending it to a client or protecting your music before sending. For a public-facing portfolio, see illustrators: timestamp portfolio work before you post it online.

Start a dated record of the files you publish

Your first Pooled TimeBind is free, with no credit card required. After that, TimeBinds start from US$5, and an ASAP TimeBind is US$15. Click here to start, or see plans and pricing.