@Robotanical:
That's a good rule to follow. Offline password manager, too.
@RiftChems:
My simple rule to stay safe: diff passwords for everything stored in a password manager, constantly check connected devices on critical platforms/IP logs of logins. Never click links from any email or DM.