Category: Passwords

Password managers and strong passwords.

  • Password Sharing for Families: How to Do It Safely

    Password Sharing for Families: How to Do It Safely

    Families share a lot of accounts: streaming services, utilities, Wi-Fi, insurance portals, school apps and more. Too often, passwords end up texted, written on sticky notes or reused so everyone can remember them. There are safer ways to share.

    This guide explains how families can share passwords securely, plan for emergencies and set up children’s accounts thoughtfully.

    Why Insecure Sharing Is Risky

    • Texts and chats can be read by anyone with access to the phone or account
    • Notes and spreadsheets can be lost or seen by visitors
    • Reusing a simple “family password” across accounts means one breach exposes many
    • Changing a shared password becomes hard when nobody knows where it is used

    Shared Vaults in Password Managers

    Many password managers offer family plans with shared folders or vaults. You choose which logins to share and with whom. When you update a password, everyone with access gets the new one automatically. See the password manager guide.

    Tips for Shared Vaults

    • Create shared folders by purpose, such as “Household” or “Streaming”
    • Keep personal accounts private
    • Review who has access periodically
    • Remove access when someone moves out or a relationship changes

    Accounts Families Often Share

    Account type Sharing approach
    Streaming Use family or profile features, follow service terms
    Wi-Fi Use a guest network for visitors. See home Wi-Fi security.
    Utilities and insurance Shared vault entry
    School portals Each parent’s own login if possible
    Banking Separate logins or official joint access features

    Where a service supports separate user accounts or authorized users, use those instead of sharing one login. That way, each person has their own credentials and activity can be tracked.

    Emergency Access

    If you were unavailable, could someone you trust reach important accounts? Many password managers offer emergency access features that let a designated person request access after a waiting period. Alternatively, store instructions and recovery codes in a secure place known to a trusted person. Consider including digital accounts in estate planning discussions with appropriate professionals.

    Kids’ Accounts

    • Use family features on phone platforms to manage children’s accounts
    • Teach kids to use passphrases. See strong passphrases.
    • Explain why they should not share passwords with friends
    • Turn on two-factor authentication for teens’ important accounts
    • Talk about phishing and scams. See phishing red flags.

    When Relationships Change

    When a household changes, review shared vaults, change passwords on shared accounts, remove devices from accounts and check recovery email addresses and phone numbers.

    Two-Factor Authentication with Shared Accounts

    Shared accounts with two-factor authentication can be tricky if codes go to one person’s phone. Some password managers can store authenticator codes in the shared entry, or the account owner can manage codes. Decide what works for your household. See two-factor authentication setup.

    Common Mistakes

    • Texting passwords
    • Using one password for every family account
    • Forgetting to remove access after changes
    • Having no emergency plan

    A Note on Older Relatives

    Helping older parents manage accounts is common. Rather than knowing their passwords, consider a shared vault where they share specific logins with you, or official features such as trusted contacts and authorized users at banks. This respects their independence while letting you help. Talk openly about scams, since older adults are frequent targets.

    A Note on Recovery Contacts

    Some services let you add a recovery contact who can help you regain access if you are locked out. Choose people you trust and keep the list current. Recovery contacts usually cannot see your data, only help verify your identity.

    Comparison Table

    Sharing method Security Convenience
    Texting passwords Low High
    Written notes Low to moderate Moderate
    Shared vault High High
    Separate accounts High Varies

    Questions to Ask as a Family

    • Which accounts do we all need?
    • Who manages each account?
    • How would we reach accounts in an emergency?
    • How will we handle changes when someone leaves?

    Starting Small

    Move your three most-shared logins, such as Wi-Fi, streaming and utilities, into a shared vault this week.

    A Note on Shared Devices at Home

    A family computer or tablet used by several people should have separate user profiles where possible. Avoid saving personal passwords in a shared browser profile. Lock the device when not in use, and teach kids to sign out of accounts on shared devices.

    Final Family Checklist

    • Shared vault created
    • Household logins moved in
    • Personal logins kept private
    • Emergency access set up
    • Kids’ accounts reviewed
    • Access reviewed after changes

    A Note on Digital Legacy Planning

    Some platforms offer legacy contact or inactive account features that let you decide what happens to an account if you pass away or stop using it. Setting these up, along with a password manager emergency access plan, makes things much easier for family. Store any instructions somewhere secure and tell a trusted person where to find them.

    Starting Small

    Start with one conversation at dinner about which accounts the household shares.

    Frequently Asked Questions

    What is the safest way to share passwords with family?

    A shared vault in a reputable password manager is a common approach.

    Is it okay to share streaming passwords?

    Follow each service’s terms; many offer family or household plans.

    How can my spouse access accounts if something happens to me?

    Use emergency access features or a secure written plan.

    Should kids use password managers?

    Older kids can benefit, especially with family plans.

    What should I do when a roommate moves out?

    Change shared passwords and remove their access.

    The Bottom Line

    Share passwords through a password manager’s shared vaults, use separate accounts where possible, plan emergency access, teach kids good habits and review access when life changes.


    Editorial note: Lock and Login is independent and reader-supported. This guide is based on research into manufacturer documentation, published specifications and widely accepted best practices; we have not been paid to mention any product. If we add affiliate links in the future, they will be clearly disclosed per our Affiliate Disclosure.

  • Strong Passphrases: How to Create Passwords You Can Remember

    Strong Passphrases: How to Create Passwords You Can Remember

    Most of your passwords should be long, random strings generated and stored by a password manager. But a few passwords you must remember and type: your password manager’s master password, your computer login and perhaps your phone or email password. For these, a passphrase is often the best answer.

    A passphrase is a password made of several words. Done well, it is long, hard to guess and easier to remember than a jumble of symbols. This guide explains how to create one.

    Why Length Matters

    Password strength depends heavily on how many possible combinations an attacker must try. Length increases that number dramatically. A long passphrase of several random words can be stronger than a short password with symbols, and easier to remember.

    Current guidance from security organizations such as the National Institute of Standards and Technology emphasizes length and checking passwords against lists of known compromised passwords, rather than forcing frequent changes or complicated composition rules.

    The Key Is Randomness

    The words in a passphrase must be chosen randomly, not by you. Humans are bad at randomness: we pick song lyrics, quotes, names and patterns that attackers can guess. A phrase like a famous movie line is weak, even if long.

    Random Word Methods

    One well-known method uses dice and a numbered word list. You roll dice to pick each word, so the choice is truly random. Many password managers also include passphrase generators that pick random words for you.

    How to Create a Passphrase

    1. Use a generator or dice method to pick several random words
    2. Aim for more words for more important accounts, such as your master password
    3. Separate words with spaces, hyphens or another character if you like
    4. Do not rearrange words to make them more meaningful
    5. Practice typing it several times
    6. Write it down once and store it securely until memorized, then decide whether to keep the copy in a safe place

    Adding Numbers and Symbols

    Some sites require numbers, capitals or symbols. Add them in a simple way, such as capitalizing one word and adding a number between words. The randomness of the words provides most of the strength.

    Where to Use Passphrases

    • Password manager master password
    • Computer login
    • Phone backup and email account, if typed often
    • Wi-Fi network password. See home Wi-Fi security.

    For everything else, let your password manager generate random passwords. See the password manager guide.

    What to Avoid

    • Personal information: names, birthdays, pet names, addresses, sports teams
    • Common phrases, lyrics or quotes
    • Keyboard patterns
    • Reusing a passphrase on multiple sites
    • Small variations of an old password

    Do You Need to Change Passwords Regularly?

    Many experts now advise against forced periodic changes for strong, unique passwords, because frequent changes lead to weaker patterns. Change a password if a site is breached, if you suspect compromise or if you reused it.

    Checking for Breaches

    Many password managers and browsers alert you when saved passwords appear in known breaches. If a password is flagged, change it on that site and anywhere you reused it.

    Combine with Two-Factor Authentication

    Even a strong passphrase can be phished. Two-factor authentication adds protection. See two-factor authentication setup.

    Common Mistakes

    • Choosing words yourself instead of randomly
    • Using too few words
    • Reusing a passphrase
    • Storing the master password inside the vault it protects

    A Note on Password Hints and Security Questions

    Security questions are often weak because the answers, such as your first school or mother’s maiden name, can be found online. Where sites require them, treat answers like passwords: give random answers and store them in your password manager. Avoid password hints that reveal the password.

    A Note on Writing Things Down

    Security advice used to say never write passwords down. A more practical view is that a written note kept somewhere physically secure at home is far safer than a weak or reused password. The main risks with written passwords are people with physical access, so store any written record carefully.

    Questions to Ask Yourself

    • Which passwords do I actually type from memory?
    • Are any of them reused anywhere?
    • Is my master password long enough?
    • Do I have two-factor authentication on my most important accounts?

    Starting Small

    Start with your password manager master password and email password. Once those are strong, move on to the rest with generated passwords.

    A Note on Device PINs

    Your phone PIN protects everything on the device, including saved passwords, email and passkeys. Use a longer PIN or an alphanumeric passcode rather than a short, guessable one, and avoid patterns or birthdays. Biometrics are convenient, but the PIN is the fallback that matters.

    Comparison Table

    Password type Best for How to create
    Random passphrase Passwords you type Dice or generator
    Random string Everything else Password manager
    Device PIN Phone unlock Longer, non-patterned
    Security answers Account recovery Random, stored in manager

    Final Passphrase Checklist

    • Words chosen randomly
    • Enough words for the account’s importance
    • Not reused anywhere
    • Practiced until comfortable
    • Stored securely until memorized

    Frequently Asked Questions

    How many words should a passphrase have?

    More words mean more strength. For a master password, err on the longer side.

    Are spaces allowed?

    Many systems allow them; others require a different separator.

    Is a passphrase better than a random password?

    For passwords you must remember, often yes. For others, random generated passwords are fine.

    Should I write down my passphrase?

    Writing it down once and storing it securely can help until memorized.

    Can I use the same passphrase for my computer and password manager?

    It is better to use unique passphrases.

    The Bottom Line

    Use random-word passphrases for the few passwords you must remember, let a password manager handle the rest, avoid personal information and add two-factor authentication.


    Editorial note: Lock and Login is independent and reader-supported. This guide is based on research into manufacturer documentation, published specifications and widely accepted best practices; we have not been paid to mention any product. If we add affiliate links in the future, they will be clearly disclosed per our Affiliate Disclosure.

  • Password Manager Guide: How They Work and How to Choose One

    Password Manager Guide: How They Work and How to Choose One

    Most people have far more online accounts than they can remember strong, unique passwords for. The result is predictable: reused passwords, small variations of the same password, or notes on paper and in phone apps. When one site is breached, reused passwords let attackers try the same login elsewhere, a technique often called credential stuffing.

    A password manager solves this by generating and storing a unique password for every account, so you only need to remember one strong master password. This guide explains how password managers work, what to compare and how to switch without locking yourself out. We have not tested or ranked specific products here; instead, this is a framework for making your own choice.

    How Password Managers Work

    A password manager is an encrypted vault. You unlock it with a master password, and sometimes with a device biometric or a hardware key. Inside, it stores logins, and often notes, card details and other sensitive information.

    Many reputable managers use what is called a zero-knowledge design. That means your vault is encrypted on your device before it syncs, and the company does not hold the key needed to decrypt it. If the company’s servers were breached, attackers would get encrypted data rather than readable passwords. The strength of that protection depends heavily on your master password, which is why it matters so much.

    Autofill

    Most managers offer browser extensions and mobile apps that fill logins automatically. Autofill is also a security feature: a manager usually fills credentials only on the website address they were saved for, which can help you notice a lookalike phishing site. If your manager does not offer to fill on a page where you expect it to, stop and check the address. See phishing red flags.

    Password Generation

    A good generator creates long, random passwords. Since you never type them, length costs you nothing. For the few passwords you do type, such as the master password, a long passphrase is easier. See strong passphrases.

    Types of Password Managers

    Standalone Managers

    Dedicated apps that work across browsers and operating systems. They often include features such as secure sharing, breach alerts, emergency access and support for passkeys.

    Browser and Operating System Managers

    Major browsers and phone operating systems include built-in password managers. They are convenient and free, and for many people they are a big improvement over reuse. Their limitations can show up if you use several browsers or switch between ecosystems, such as a Windows computer and an iPhone.

    Self-Hosted and Offline Options

    Some people prefer managers that store the vault in a file they control or on a server they run. These give more control but require more technical care, especially for backups.

    Features to Compare

    Feature Why it matters
    Cross-platform apps Works on every device you use
    Encryption design Whether the company can read your vault
    Two-factor support Protects the vault account itself
    Secure sharing Share logins with family without texting them
    Emergency access Lets a trusted person reach the vault if needed
    Breach alerts Flags reused or exposed passwords
    Passkey support Stores modern passwordless logins
    Export options Lets you leave without losing data
    Security audits Independent review of the company’s claims

    When reviewing a company, look for published security documentation, independent audits and a clear account of any past incidents and how they were handled. A company’s response to a problem tells you a lot.

    Choosing a Master Password

    Your master password should be long, unique and memorable to you. A passphrase made of several random words works well. Never reuse it anywhere else, and do not store it inside the vault it protects. Many people write it down once and keep it somewhere physically secure at home until it is memorized.

    Turn on two-factor authentication for the password manager account. See two-factor authentication setup.

    Recovery Planning

    Because of zero-knowledge design, many companies cannot reset your master password for you. Before you rely on a manager, set up whatever recovery options it provides, such as a recovery code, a trusted device or emergency contacts. Store recovery codes offline in a safe place.

    How to Switch to a Password Manager

    1. Pick a manager and install it on your main computer and phone
    2. Create a strong master password and turn on two-factor authentication
    3. Import passwords saved in your browser, if the manager supports it
    4. Delete the old saved passwords from the browser once the import is verified, so they are not stored in two places
    5. Start with your most important accounts: email, banking, phone carrier and the password manager itself
    6. Change reused passwords to unique generated ones as you go
    7. Over the next few weeks, update other accounts as you log in to them

    Your email account deserves special attention, because it can be used to reset other passwords.

    Family and Shared Use

    Family plans and shared vaults let households share streaming, utility and Wi-Fi logins without texting passwords. They also make it easier for a trusted person to help in an emergency. See password sharing for families.

    Common Mistakes

    • Using a weak or reused master password
    • Skipping two-factor authentication on the vault
    • Not saving recovery codes
    • Leaving old passwords stored in the browser and the manager
    • Never updating reused passwords after importing them

    Frequently Asked Questions

    Is it safe to keep all my passwords in one place?

    For most people, a reputable manager with a strong master password and two-factor authentication is much safer than reusing passwords. The risk is concentrated, so protect the vault well.

    Are built-in browser password managers good enough?

    They can be a solid step up from reuse, especially if you use one ecosystem. Standalone managers may suit people who use several browsers or devices.

    What happens if I forget my master password?

    It depends on the manager. Many cannot reset it, so set up recovery options early.

    Should I store credit cards in my password manager?

    Many people do for convenience. Consider your comfort level and use two-factor authentication.

    Do password managers support passkeys?

    Many now do. See passkeys explained.

    The Bottom Line

    A password manager lets you use a unique, strong password everywhere while remembering only one. Choose one that works on all your devices, protect it with a long passphrase and two-factor authentication, plan for recovery and update your most important accounts first.


    Editorial note: Lock and Login is independent and reader-supported. This guide is based on research into manufacturer documentation, published specifications and widely accepted best practices; we have not been paid to mention any product. If we add affiliate links in the future, they will be clearly disclosed per our Affiliate Disclosure.