Stop Trying to Remember Your Passwords (And Use a Password Manager Instead.)

In the world of information security, the “CIA triad” is often used as a framework of objectives that must be met. (To be clear, it’s a mnemonic device and has nothing to do with the Central Intelligence Agency.)

• Confidentiality: access to data should be limited to the appropriate parties.
• Integrity: your data is accurate and has not been tampered with.
• Availability: you have access to the data when you need it.

When most of us think of cybersecurity, confidentiality is primarily what we’re thinking about, but integrity and availability are mission-critical also.

For many people, using a password manager is going to be an upgrade in all three categories, relative to what they’re currently doing.

Confidentiality

Just think of all the different accounts you have, which you would really not want accessed by a malicious party:

• Email accounts,
• Bank accounts,
• Brokerage accounts,
• Credit cards, mortgage lender, or other financial services,
• Credit bureaus,
• MyChart (or other patient portals) for your health care system(s),
• Login.gov,
• Venmo,
• Your providers of health insurance, car insurance, homeowners/renters insurance, umbrella insurance, etc.

The list just goes on and on. And there are probably 100+ other websites with less critical information, but which you’d still prefer somebody else not to access.

For anybody with normal memory capabilities, it’s impossible to remember a unique password for each of those websites.

So, many people resort to one password that gets reused across a bunch of different accounts. This is a train wreck waiting to happen. Credential stuffing is a common form of cyberattack, in which thieves use previously stolen credentials (username/password) on various other accounts. Once your password is stolen, it will be tried on a very long list of other websites. If you reuse the same password on many websites, you now have thieves accessing a whole bunch of your accounts all at once. This is an entirely avoidable scenario, so please don’t let it happen to you.

Alternatively, many people resort to short, easy to remember passwords (e.g., Boglehead123 for their Vanguard account or MagellanLynch1 for their Fidelity account). The problem is that easily remembered passwords are often easily guessed passwords.

The reality that you have to accept at this point is that you aren’t supposed to be able to remember all of your passwords. If you’re still trying to remember them all in your brain, you are almost certainly making major security compromises in order to make that happen.

A password manager allows you to create strong (lengthy and randomly-generated) passwords for each account, which are unique to each account, and it remembers them for you.

Another benefit with respect to confidentiality: a password manager will usually not offer to fill your password if the domain doesn’t match exactly. For instance, if you have a saved username/password for Schwab.com, and someday you accidentally find yourself on a different domain, which is designed to look exactly like Schwab’s website (and thus collect and maliciously reuse your credentials after you enter them), your password manager should not offer to fill your password (because it doesn’t see a saved password associated with the domain you’re currently on).

Integrity and Availability

Some people’s approach to password security is to record all of their passwords in a physical notebook, which is kept in their home. Assuming that the notebook is kept secure, that can do a reasonable job with respect to confidentiality. But that approach often falls short with respect to data integrity. At some point, ink becomes smeared. Or passwords get crossed out with new ones scrunched into the spare space nearby. Legibility declines and we can no longer read the password in question. Or something physically happens to the notebook itself: there’s a fire or natural disaster, or more likely, a beverage is spilled directly onto the notebook.

I’ve also seen that approach fail with respect to availability: whoops, we forgot to bring the notebook with us on vacation. Or your spouse just can’t read your handwriting.

Similarly, I’ve seen people take a post-it note approach to password management (i.e., just sticking post-its on or near their computer with various important passwords). While that approach has confidentiality problems if anybody else ends up near your computer, that approach also can easily fail the availability test if a post-it falls off and gets thrown away.

With a password manager, your passwords will be synced across your devices. As long as you can sign into your password manager, you will have access to your passwords. And no need to worry about your or your spouse’s handwriting.

Password Sharing

Password managers also allow for secure sharing between multiple people (e.g., two spouses on a shared family plan), which has benefits for confidentiality, integrity, and availability.

• Confidentiality: sharing passwords via a password manager is much more secure than sharing them with each other by text, for example.
• Integrity: if one of you updates the password, it will be automatically updated for the other.
• Availability: you can be in different physical locations, while both still having access to your shared passwords.

Which Password Manager?

I’m not going to officially recommend one password manager as opposed to another. Most all-Mac households seem to be happy with Apple’s built-in password manager (known as Apple Passwords on newer devices). 1Password or Bitwarden are also popular and well respected.

LastPass was also very popular, but due to a major breach in 2022, many of the top experts in the field recommend using a different provider. (And if you were using LastPass at the time, you should change every password that was stored in your vault. And if you are still using LastPass even after that breach, you should absolutely change your master password as well.)

As far as the password managers built into Chrome and Edge, opinions vary. Many people consider them to be somewhat of a tradeoff, providing convenience but less security (and fewer features) than a dedicated password manager. Other people argue that the latest versions are meaningfully improved and now essentially as secure as 1Password or Bitwarden.

If you go looking for comparisons of one password manager to another, I’ll just make two observations:

• Many of the articles you’ll find are actually sales pitches in disguise. Many password managers offer “affiliate programs,” whereby they pay a commission to a referring party for each new customer that signs up. If somebody can publish an article that ranks well in search results for “best password manager” or “password manager comparison” — and then the article gets many people to sign up for one of the providers that pays a commission, that can be a substantial revenue stream.
• Among cybersecurity enthusiasts, “should I use Bitwarden or 1Password” is akin to “should I tilt to small-cap value” for Bogleheads. They can talk about it forever, and there are ardent supporters on either side. There are real pros and cons of each. But the key thing to recognize is that either is a heck of a lot better than what many people are doing with their passwords.

Staying Secure with a Password Manager

I want to be clear that simply using a password manager doesn’t in itself make you much safer. Password managers make it convenient to use strong passwords, but if you have existing weak passwords and/or passwords that are reused at a bunch of different places, you have to take the step of updating those passwords to new passwords that are stronger and unique. (The password manager should have a password generator to easily create strong passwords for you.)

It’s also extremely important to recognize that, with a bunch of passwords stored in one place, that one place becomes absolutely mission critical. You need to keep malicious parties out of it. And you need to make sure that you will not be locked out of it.

That means that for your password manager, you want to:

• Use a very strong master password.
• Turn on multi-factor authentication.
• Only use strong methods of multi-factor authentication. (The safest would be a hardware security key such as a YubiKey, of which you have multiples. Hardware security keys will be a topic for another day. But as noted previously, an authenticator app is generally a safer option than MFA by email or SMS.)

When using a password manager, device security becomes even more critical than it would otherwise be. For example, if you take your laptop around with you, and you normally keep yourself signed into your password manager on that device (e.g., via a Bitwarden or 1Password browser extension), you have a very big problem if somebody else gets their hands on that device. For devices that leave your home (or even for devices kept at home, if other people are around on a regular basis), I recommend using a very short screen-lock time, as well as configuring the password manager to lock (thus requiring your master password to be reentered) when the screen locks or the device goes to sleep.

And with respect to not getting yourself locked out, it’s important to recognize that if you forget your master password, many password managers cannot recover it for you. You would be permanently locked out. That’s by design. It’s one part of what makes the system secure. But it means that you should probably have that master password written down on paper somewhere, such as a fireproof safe or in a safe deposit box.

Similarly, your recovery code (which serves as a backup if your normal MFA method is unavailable) should be printed on paper and kept somewhere safe.

If your recovery code and master password are both printed out and kept together in a safe deposit box, this would provide you (or your heirs, when the time comes) with a way to sign into your account.

Password Managers and Passkeys

As discussed previously, passkeys are generally an improvement over traditional passwords, for a variety of reasons (e.g., they’re more resistant to phishing). And your passkeys will generally be stored in a password manager, to be synced across your devices.

As I noted in previous articles though, it’s hard to explain exactly how that works in practice, because it will vary depending on what combination of technology you’re using (i.e., which operating system(s), which browser(s), which password manager(s), and whether or not you’re using hardware security keys such as YubiKey). There are too many possible combinations to give a complete set of answers for everybody.

• Apple Passwords can store passkeys on all Apple devices — and sync them across Apple devices.
• Google Password Manager can store passkeys on any device browsing with Chrome (and sync across all such devices).
• Edge Password Manager can store/sync passkeys on any devices browsing with Edge.
• Third party password managers (e.g., Bitwarden or 1Password) can store passkeys and sync them across devices on which the software is installed (or accessible via an installed browser plugin).

Imagine for instance that you have two devices: a Windows desktop on which you browse exclusively with Chrome and an iPhone on which you browse exclusively with Safari. And you don’t use a third-party password manager. In that case, it would be Google Password Manager storing the passkeys on your desktop and Apple Passwords storing them on your iPhone. And they would not “see” each other’s passkeys. (But even that is okay, because you can just set up multiple passkeys for each website.)

Conversely, if in the above situation you browsed with Chrome on both devices, then Google Password Manager would be syncing the passkeys across the two devices.

Or let’s say you have a desktop Mac and an iPhone. And you use Chrome on both. Then either Apple Passwords or Google Password Manager could be used to store and sync your passkeys. Google Password Manager seems to try to make itself the default when browsing with Chrome, but you can adjust your settings to turn that off (and thus use Apple Passwords) if desired.

And in any of the above cases, if you have a third party password manager (e.g., Bitwarden or 1Password) that you use on all devices, that password manager could instead be used to store/sync passkeys.

But the key things to know are that:

1. It’s okay if you have some passkeys stored in one place and others stored in another place (as in the first example), because you can have multiple passkeys for each website.
2. Anywhere you are storing passkeys and/or passwords should be kept as secure as possible (i.e., using a strong password that is not used elsewhere and using strong multi-factor authentication).