A lot of us have one password we use for almost everything, maybe with a "1" or a "!" on the end for the picky sites. And somewhere there's a document, a notebook, or a sticky note with the rest.
There's a good chance that password is already floating around the internet from some company's data breach, and if it works on one of your accounts, crooks will try it on all of them.
The fix is a password manager.
What a password manager does
You remember one strong password. The app remembers everything else. It makes up long, random passwords for every site, saves them, and fills them in for you on your phone and your computer. After the first week or so, you'll rarely type or reset a password again.
Which one to pick
Any of these is fine. Pick based on the devices your family uses:
- Everyone uses Apple devices: use the Passwords app that's already on your iPhone, iPad and Mac. It's free and simple, and it even works on a Windows PC through the iCloud for Windows app.
- A mix of iPhone, Android and Windows: use Bitwarden. The free version does everything most people need, on as many devices as you like.
- You want the most polished option and don't mind paying: use 1Password. It's what I use. There's no free version, but the family plan covers five people, and it works the same on iPhone, Android, Mac and Windows.
- Your family lives in Android and Chrome: Google Password Manager is built in and free, and it works on iPhone through the Chrome app.
One I'd skip: LastPass. It had a serious breach in 2022 in which attackers copied customers' password vaults. If you're still using it, switching is the first thing on your list.
Moving your passwords in
- Pick your master password. Make it long and memorable: three or four random words strung together works great. Write it down and keep it somewhere safe at home, with your important papers.
- Bring in what you've got. If your passwords are saved in your web browser or another app, look for Export in its settings, then use Import in your new password manager.
- Delete the export file right away and empty the trash. It's every password you own, in plain text. Don't email it to yourself. Don't leave it in Downloads.
- Change the important ones. Let the app generate brand-new passwords for your email, your bank, and your phone carrier. Email matters most: whoever controls your email can reset everything else.
- Do the rest as you go. Every time you log into a site, let the app save it. Within a month you'll have almost everything.
Passkeys: the password you never have to type
A passkey replaces your password with your face, your fingerprint, or your phone's passcode. Google, Apple, Microsoft, Amazon, PayPal and lots of banks already support them.
- There's nothing to remember and nothing to type.
- There's nothing to steal. A passkey can't leak in a data breach the way a password can.
- It can't be phished. A fake "your account is locked" website can't trick a passkey into working, because it only works on the real site.
How to start: next time a website or app asks "Create a passkey?", say yes. Your phone or password manager saves it, and from then on you just glance at your phone to sign in. Start with your email account.
Turn on two-step sign-in for the big ones
For accounts that don't offer passkeys yet, turn on two-step verification (sometimes called 2FA). After your password, you also confirm with a code or a tap on your phone. An authenticator app is safer than text-message codes, and most password managers can hold those codes for you.
Government sites do this too. The IRS and Social Security sign you in through ID.me or Login.gov. Set those up well before tax season, not the night before you need them.
Share with the family
Every option above lets you share passwords without texting them around. Make a shared group for the streaming services, the Wi-Fi, and the school portal. Change a password once, and everyone's copy updates.
While you're there, set up an emergency contact or legacy contact: someone you trust who can get in if something ever happens to you.
Checklist
- Pick a password manager and install it on your phone and computer.
- Import your saved passwords, then delete the export file.
- Change your email and banking passwords.
- Add a passkey to your email account.
- Turn on two-step sign-in for anything with money attached.
- Share the household passwords with your family.