Password manager and passkeys: here's how to secure your logins

Every account needs its own, long password. If you use the same password in more than one place, they're all exposed as soon as one of them leaks. Nobody remembers eighty different passwords. A password manager does that for you. Where possible, replace the password with a passkey, which fake sites can't abuse.

What a password manager does

• It creates a long, random password for every service: at least 15 characters, or a passphrase of five or six random words.
• It stores everything encrypted in a vault.
• It fills in the password on the right website, and only there.
• It often warns you about duplicate or leaked passwords, and can also store codes for two-step verification and passkeys.

You only need to remember one: the master password of the vault.

Types

Well-known examples are Bitwarden, 1Password, KeePassXC and Proton Pass, alongside the managers built into browsers and phones. This isn't an endorsement. When choosing, pay attention to: does it work on all your devices, can you share vaults and remove someone from them again, can you secure the vault with two-step verification, is there emergency access, and can you export your data if you want to switch?

The master password

• Make it a passphrase of five or six random words, chosen by the generator and not by yourself. A song lyric or saying is easy to guess.
• Use it nowhere else and only type it into the manager's own app or extension.
• Turn on two-step verification for the vault. That's not a reason for a shorter master password: if the provider gets hacked, your master password is the only protection for your stolen vault.
• Forgetting it is often permanent, because the provider can't recover it. Write it down on paper, without noting what it's for, and keep it at home in a safe place, together with your manager's recovery code.
• Turn on automatic locking after a few minutes of inactivity.

Sharing within a team and emergency access

• It's better to give everyone their own account. If you do need to share a login, use a shared vault per topic and only give access to those who need it. Never share via email, chat or a spreadsheet.
• If someone leaves, remove them from the vault and change the passwords they could see.
• Arrange emergency access for when you're unavailable: many managers let a trusted person in after a waiting period. Or keep the recovery details in a sealed envelope with a second person.

Passkeys and security keys

A passkey replaces the password. It's a key pair: the secret part stays on your device or in your password manager, the website only stores the public part. You unlock the passkey with your fingerprint, face or PIN; that happens on your own device.

• Doesn't work on a fake site. A passkey belongs to the real domain, and your browser checks that. On a lookalike site there is no passkey, so there's nothing to accidentally fill in or approve.
• Nothing to crack. If the website leaks, the attacker only gets public keys.
• A security key is a small device for the usb port or to hold against your phone, with passkeys that can't be taken off it. Always register at least two keys and keep the backup key in a different place.
• If your passkey is stored in a password manager or in your phone's account, it travels to your other devices too. Protect that account extra well in that case.
• Your password often still keeps working as well. So keep it long and unique.

At WebOké

You can read more about strong passwords in Secure passwords and what to do with a leaked password, and at the NCSC in How do I choose a password manager? and How do you choose an MFA method?