Legitimate login portals use HTTPS. If your browser warns you that a connection is unsecure, leave the page immediately.
: Accessing someone's private account without permission is a federal crime in many jurisdictions (such as the CFAA in the US), punishable by heavy fines and jail time. xploitz net hackearunfacebook link
Two-factor authentication is the single best safety net you can have. With 2FA enabled, even if an attacker steals your password using a tool like Xploitz, they won't be able to log in because they lack the second verification factor (a code sent to your phone, a biometric scan, or a security key). Legitimate login portals use HTTPS