Do you keep your passwords in a notebook? On scraps of paper near the computer? You’re not alone. Many people, especially those of us who didn’t grow up with the internet, find passwords hard to manage. Every website wants a “strong” one. Some insist you change them regularly. And it’s easy to forget which one you used last time.
But there is a better way — and it’s easier than you think.
🧠 The Password Problem
The more websites and apps we use, the more passwords we need. It’s tempting to reuse the same password everywhere — but that creates a big security risk. If just one site is hacked, all your accounts could be in danger.
Others write passwords down in notebooks or on sticky notes, but that has its own problems:
- The password might be out of date after a change.
- It might be missing important details like the website or username.
- The username might not be an email but something obscure — like a membership number — making it hard to remember which login goes with which site.
- The notes could be lost or seen by someone else.
What if there was a way to remember just one strong password, and have the rest looked after securely and automatically?
✅ What Is a Password Manager?
A password manager is a secure “vault” that stores all your passwords and login details. You only need to remember one master password — the key to unlock your vault. The manager can then:
- Automatically fill in login details when you visit websites.
- Suggest strong, unique passwords for new accounts.
- Sync across your devices (computer, phone, tablet).
- Store other sensitive information like PINs, health card numbers, or secure notes.
It’s like a digital version of your password book — but encrypted, backed up, and locked with a key only you know.
🔒 How Secure Is It?
Zero-Knowledge Encryption
A good password manager uses zero-knowledge encryption. That means your data is encrypted on your device before it is sent anywhere, and the company storing it cannot read it — even if they wanted to. (See: Australian Cyber Security Centre – Password Managers)
Local Decryption Only
Your passwords are only unlocked on your device, after you log in with your master password. Even if someone broke into the company’s servers, all they would get is unreadable gibberish.
What If Someone Gets My Master Password?
That’s a valid concern. Just like a house key, if someone gets your master password, they could open your vault. That’s why it’s important to:
- Use a strong master password — a passphrase works well here (e.g. four random words strung together). You can write it down and keep it somewhere secure, just not near your computer. (See: EFF – Creating Strong Passwords)
- Enable Two-Factor Authentication (2FA) on your password manager account — more on this below.
🛡️ Two-Factor Authentication (2FA / MFA)
Two-Factor Authentication (2FA) — sometimes called Multi-Factor Authentication (MFA) — adds a second check beyond your password. Even if someone steals your master password, they still can’t get in without this second factor.
The two most practical options are:
- SMS code — a one-time code sent to your phone by text message. Convenient, but the least secure option, as phone numbers can sometimes be hijacked.
- Authenticator app — a free app on your phone (such as Google Authenticator or Microsoft Authenticator) that generates a time-based code every 30 seconds. More secure, and works even without mobile reception.
For most people, setting up an authenticator app is the recommended choice. Setting up 2FA on your password manager is one of the most important steps you can take. (See: eSafety Commissioner – Protecting Personal Information)
🧾 Family Sharing and Planning Ahead
👪 Securely Share Passwords
Password managers can let you share selected logins with a partner or family member, without revealing the actual password. Useful for shared accounts like banking, government services, or streaming.
🧬 Digital Estate Planning
What happens to your accounts if something happens to you? Some managers support emergency access — a trusted person can request access to your vault after a waiting period you define. You can also write down your master password and store it securely with your other important documents.
🔐 What About Passkeys?
Passkeys are a newer, more secure way to log in without a traditional password. Instead of typing something in, you use your fingerprint, face recognition, or a PIN — just like unlocking your phone.
How Does It Work?
When you set up a passkey, your device generates a pair of cryptographic keys. The private key stays on your device; the website holds the public key. When you log in, the website sends a challenge, and your device signs it with your private key — proving your identity without ever sending a secret across the internet.
Passkeys are more secure than passwords because:
- Nothing is typed that could be seen or intercepted.
- They only work with the exact website they were created for — phishing sites can’t use them.
- There’s nothing to remember or forget.
Do Passkeys Require Bluetooth?
Sometimes, yes — but only in one specific scenario. If you want to use a passkey stored on your phone to log in on a different device (like a shared or borrowed computer), the two devices use Bluetooth to confirm they are physically close together. This prevents remote attackers from using your passkey from across the world. If you’re logging in on your own phone or computer where the passkey is stored, no Bluetooth is needed.
Using Passkeys on Shared Computers
Say you’re at a U3A meeting or on a family member’s computer. If the website supports passkeys, a QR code may appear on screen. You scan it with your phone’s camera, confirm with your fingerprint or PIN, and the computer logs you in — without typing a single character, and without leaving your credentials behind. This works in private browsing windows too.
Passkeys and Password Managers
Many password managers can now store and use passkeys as well as passwords, so you get the convenience of one app for both.
📋 Choosing a Password Manager
There are several good options — here’s a brief comparison:
| Name | Cost | Platforms | Passkey Support | Notes |
|---|---|---|---|---|
| Bitwarden | Free (fully) | Windows, Mac, Linux, Android, iOS | ✅ | Open-source, independently audited, highly trusted |
| 1Password | Paid | All major | ✅ | Polished, good for families |
| Dashlane | Free & Paid | All major | ✅ | Clean interface, includes breach alerts |
| Built-in browser (Chrome, Edge, Safari) | Free | Same browser only | ⚠️ Limited | Fine to start, but limited for families or multiple accounts |
⚠️ Browser password managers (built into Chrome, Edge, Safari, etc.) can be handy, but have limitations:
- They may struggle with multiple accounts on the same site.
- They only work in that specific browser.
- They offer limited sharing and no emergency access features.
🚀 Getting Started
You don’t need to switch everything over at once. Try this approach:
- Choose a password manager — Bitwarden is a good free starting point; 1Password is worth considering if you want a more polished paid experience.
- Install it on one device — your main computer or phone.
- Let it save passwords as you go — it will offer to save each login as you use websites normally.
- Build your vault gradually — no need to enter everything at once.
- Set up 2FA on the password manager itself — use an authenticator app for best results.
- Ask for help if needed — a family member or Tech Café volunteer can walk you through it.
You’ll soon wonder how you managed without it.
⚖️ A Word of Caution — and Balance
Password managers aren’t perfect, and it’s fair to know the trade-offs:
The risks of using one:
- A single point of failure — your master password must be strong and well protected.
- Password managers are an attractive target for attackers (there have been breaches — which is exactly why zero-knowledge encryption and 2FA matter so much).
The risks of not using one:
- Writing passwords down and losing or misplacing the paper.
- Forgetting which email or username belongs to which site.
- Reusing the same password everywhere, making all accounts vulnerable at once.
- Being more likely to fall for a lookalike (phishing) website.
For most people, the risks of not using a password manager outweigh the risks of using one. It’s not a perfect solution — but it’s a big step forward.
📚 Want to Learn More?
Credible sources:
- 🇦🇺 Australian Cyber Security Centre – Password Managers
- 🇦🇺 eSafety Commissioner – Protecting Personal Information
- 🌍 EFF – Creating Strong Passwords
- 🌐 World Password Day — First Thursday in May
✅ In Summary
Password managers may sound technical, but they’re built to make life easier. Instead of dozens of passwords, you remember just one. The rest is automatic, secure, and surprisingly simple.
Start small — pick a reputable password manager, enable 2FA with an authenticator app, and write your master password down somewhere safe. Ask for help if you need it.
Strong passwords are important — and now, they don’t have to be hard to manage.
About the image
“VOLKSWAGEN: QUEL MILIONE BUTTATO IN PASSWORD DIMENTICATE” by automobileitalia is licensed under CC BY 2.0.