How to Store Your Passwords Securely
Choose a password manager, protect your saved logins, and keep a safe recovery backup. Simple steps for your phone and computer.
How to Store Your Passwords Securely
A 4-minute guide · Safety
You create a good password, then wonder where to put it. A sticky note? Your phone's notes app? That little box asking whether your browser should remember it?
The goal is simple: keep your logins somewhere you can reach when you need them, with protection against someone else opening them.
Give your passwords a home
A password manager is a protected vault for your logins. It can create passwords, save them, and fill them in when you sign in. That makes it easier to use a different password for every account.
Protect the vault's own login carefully. If your manager uses a master password, choose a long, unique passphrase. Turn on two-factor authentication where available: an extra check alongside your password. NIST explains password managers and account protection.
Built-in or separate app?
Both can be reasonable choices. The UK's National Cyber Security Centre says saving passwords in your browser or device's password manager is safe on your own devices. A separate app can be useful when you use several different browsers or operating systems. NCSC's guide to managing passwords
Apple Passwords is a password manager too. Apple documents end-to-end encryption for passwords synced through iCloud Keychain. That means the contents are protected so Apple cannot read them. Apple's iCloud Keychain security overview
Paying for a separate app does not automatically make your passwords safer. Choose a maintained tool that works on your devices and that you feel comfortable using.
Protect the device that opens the vault
Encryption protects stored information, but an infected or unlocked device can still put accounts at risk. No password manager makes it safe to install suspicious software or hand someone access to your screen.
Build these habits into your routine:
- Use a device passcode or password. Set the screen to lock automatically and lock it when you step away.
- Keep software updated. Include your operating system, browser, password manager, and its browser extension.
- Install carefully. Use the provider's official website or your device's app store. Avoid unexpected downloads and pop-ups telling you to install a security fix.
- Keep sign-in approvals private. Do not share verification codes or approve requests you did not start.
On a public or borrowed computer, do not save your passwords. On a shared household computer, use separate device user accounts and sign out when finished.
What about notes and paper?
Avoid leaving passwords in ordinary documents, email drafts, screenshots, chat messages, or visible sticky notes. Those copies can be opened, forwarded, or photographed. A locked note may have security features, but a password manager is designed specifically to manage logins.
Paper can be a practical backup if you protect it physically. Keep written recovery information in a locked drawer or safe, away from your device. Anyone who can read or photograph it may be able to use it. Check any account rules about writing down passwords. NCSC's advice on written passwords
Move one login today
You do not need to reorganize every account at once. Try this:
- Open your chosen password manager on your own device.
- Save one account's correct website address, username, and password.
- Confirm that the saved login works on the real website.
- If the password is weak or reused, change it through the website's settings and update the saved entry. Saving an old password does not strengthen it.
- Remove unnecessary copies from notes or photos after checking the saved entry. If a password was exposed, replace it; deleting a copy cannot undo exposure.
Make a recovery plan
Before relying on a vault, read its recovery instructions. Some services provide a recovery code, an emergency kit, or a trusted-contact option; others have limited recovery if you forget your master password.
Keep the recovery information somewhere secure that you can access without opening the vault. A backup stored only inside the account it unlocks will not help if you are locked out.
Your first step: save one login securely, check that it works, and know how you would recover access.