Best Results Organizing

Last week, in Not Your Mama’s Passwords: Passphrases, Passkeys, and the Future of Logging In, we saw how much has changed since we all made our first online passwords. Now, creating a strong password requires more characters, more variety, and more possibilities for making them secure, memorable, and useful. We also looked at passkeys, those secure digital handshakes that are even more powerful than passwords, and we got a greater understanding of what goes into multi-factor authentication.

So now we’ve got these big, strong, hunky passwords, passphrases, and passkeys, what do we do with them once they’re created? Organize them, of course!

HOW SHOULD YOU ORGANIZE YOUR PASSWORDS?

Having something and not being able to find it is just as bad as never having had it in the first place.

Have you ever lost or forgotten a password you really needed?

 

So, let’s start with a different question: how shouldn’t you organize your passwords?

• Don’t count on your memory! — When a password is first created, everyone thinks they’ll remember it, but time and disuse (as well as stress) can make the memory of a password foggy. One too many half-remembered attempts can lock you out altogether.
• Don’t re-use the same password for everything in order to lessen the likelihood that you’ll forget. — As we saw last week, a re-used password is an invitation to ne’er-do-wells.
• Don’t leave passwords on sticky notes around your desk for others to see (or for tiny humans or furry friends to accidentally carry off) — The security of where you keep your passwords can be just as important as the security around their creation.

The main ways to organize your passwords are either analog or digital.

ANALOG PASSWORD MANAGEMENT

You can use a password notebook or even an address book to log your passwords as you create them, alphabetically by the website’s name or URL.

A simple, nondescript option can hide in plain sight. For example, this faux leather, hardcover Clever Fox Password Spiral Book with alphabetical tabs, measures 4.7″ x 5.7″ and comes in more than a dozen colors. There’s a pocket for loose notes and an elastic band to keep it from accidentally opening to view.

Each entry block has spaces for the website/URL, user name, password, and a hints or clues.

Importantly, the cover (once the label is removed) does not betray the contents and the average onlooker would likely mistake it for a journal. This one costs about $15 at Amazon.

There are a variety of similar options. What you really don’t want is a novelty version with a cute phrase or design that lets on that it contains passwords.

Even if you normally only used a password notebook at home, the minute you need or want your passwords to be as portable as your phone (such as when you’re traveling), if your notebook can’t go incognito, the information within will be at risk. 

Advantages of an Analog Password Notebook

The main advantage of a notebook for storing and organizing your login credentials is that you already know how to use one.

Every time you create a new password, you just reach for your password notebook and write it down. You don’t need any technical skills, just diligence. 

Disadvantages of an Analog Password Notebook

And there’s the first drawback. It requires diligence. How often have you been prompted to make a new password while in a hurry? You think you’ll remember it and do nothing, or you write it on the nearest piece of paper. Either way, you’ve got trouble.

There are other drawbacks of a tangible, analog password notebook:

• It has no backup — If you lose your password notebook, spill coffee on it, drop it down a subway grate, leave it on the hood of your car as you drive away, or otherwise destroy it, you’re stuck clicking “forgot my password” for the next several months (or years) until you recreate every password for every site you visit. Worse, if you’re traveling, not being able to log into your accounts to access reservations or financial sites could put a serious crimp in your plans.
• It’s not secure — If you do lose your password book (or if it’s stolen), someone has access to your entire financial and personal life. It’s not that big deal if someone logs into your Netflix account, watches to their heart’s content, and messes up your algorithm. But if someone can log into your bank, investment, and shopping accounts (especially the ones in which you have a credit card on file), you’ll be in a world of hurt.
• It’s not really searchable — Yes, you can use the alphabetical tabs, in general, so Apple and Amazon will stay in the A’s, but you don’t live your life in alphabetical order. You don’t encounter websites in alphabetical order, either, so whatever you add later will be out of order, making it harder to find what you seek.
• It runs out of space — Password notebooks have limited pages, so when you run out, you’ll  need a second (and then a third) notebook. The additional cost of one notebook every several years isn’t a huge barrier, but not knowing whether the right password is in the first book or the second (and so on) is inconvenient, and again, having to take two notebooks any time you travel from home or office doubles your chances of loss.
• It’s hard to keep organized when you need to update passwords — You should update passwords every so often; some sites require it. The problem? If you use a pen, you need to cross out the prior password and squish the new password into the space. If you’ve run out of space in that entry, you could cross everything out and write the login credentials in a different entry box, but now you’re not only going to be out of alphabetical order, but if you don’t do a good enough job crossing out the old information, you may someday stop at the first entry and think it’s valid. (If you use pencil instead of pen, you may struggle with legibility, and eventually, with erasing a hole through the paper!)

You could create a spreadsheet with all of this information to make it digital, adding lines and then using the sorting function to keep the websites/apps in alphabetical order. However, printing the document (which may get unwieldy the more passwords you add) yields the same problems regarding security.

I won’t tell you that an analog password notebook is never a good choice. Some seniors and many people averse to technology will find it easier to commit to using an analog tool.

While it’s better than no system at all, an analog password notebook lacks the nuance and robust resources of a digital version.

DIGITAL PASSWORD MANAGEMENT

A digital password manager is simply a piece of software; on your mobile device, it works as an app. On your computer, it’s a free-standing program that generally integrates with your web browser. Its job is to sit and wait until you need to create or access login credentials.

Advantages of Digital Password Managers

There are more advantages to digital password managers than most people realize. A modern, sophisticated password manager can:

• Remember thousands of passwords so that you don’t need to do it.
• Generate strong, unique passwords automatically — Most can generate options based on the requirements of the site for which you’re creating a password and your preferences.

So, if BlahBlah.com requires 16 characters, capital and lowercase letters, a number, a special symbol, and a dash of fairy dust, but you also prefer passwords that don’t include capital “I” or lowercase “l” because they look the same to you (just in case you ever need to actually read the password), you can make an adjustment.

If you tell it to generate a password with all of the site requirements, but you want it to look more like a passphrase, not only can a digital password manager do so, but if one of the words reminds you of a horrible ex-boyfriend, you can “regenerate” the password with a click of an on-screen button. Next!

But digital password managers can do so much more, like:

• Store more than just passwords, including passkeys, Wi-Fi credentials, credit cards, secure notes, software license keys, recovery codes, and passport/ID information.
• Warn you of weak, re-used, or compromised passwords (as we discussed last week).
• Prevent the reuse of passwords across multiple websites and apps during the creation/generation stage.
• Auto-fill usernames, passwords, passkeys, and payment information so you can minimize the time you spend typing and optimize your productivity.
• Sync securely across all of your digital devices, including computers, phones, and tablets.
• Provide safe sharing capabilities with spouses, family members, co-workers, or trusted advisors. 
• Save time by reducing password re-sets due to lost or misread passwords.

In summary, digital password manager can organize your digital life by helping you create, maintain, and access your login credentials (and more) in one secure, searchable system across all of your devices.

Disadvantages of Digital Password Managers

I’m not going to tell you that digital password management is perfect. As with any system, there are some demerits and hiccups, and each person has to weigh the costs and benefits. The imperfections of digital password managers can include:

• Learning curves — If you’re constantly online, this is barely a blip; you’ll either intuit or learn whatever you need to in order to start using it immediately. However, for folks who find computers and mobile devices a source of frustration, the concept of digital management, if not any one password manager’s functions, may cause more annoyance than it helps.
• Temporary inconvenience — While creating/entering new passwords is easy, importing all of your passwords from a different digital password manager or from analog lists may not be instantaneous.
• Single point of failure — Digital password managers depend on a master password, known only to you. There’s no clickable “forgot my password” for the key to your keys, and though there are recovery methods, you actually have to put them in place for them to be available. Without your master password or recovery methods arranged, it’ll be difficult or impossible to access your vault.
• Browser auto-fill isn’t always 100% successful — Every once in a while, particularly on mobile, you may encounter a situation where you have to manually copy-and-paste (or view-and-type) your username and password from the digital password manager into the website login section.
• Cost — While most digital password managers have free tiers, you will likely have to pay for all the bells and whistles. 
• Subscription fatigue — Most software-as-a-service entities have moved from one-time payments to subscription models. If you’re the type of person who wants to pay once and never again, this may be a mindset hurdle.
• Trust — You’re giving the keys to the kingdom to a piece of software. When you’re trusting a third party with all of your highly sensitive information, it’s vital that you choose a reputable company whose security is undeniable.

While any/all of these can be drawbacks, they are almost certainly outweighed by the advantages of digital password management.

THE MOST POPULAR DIGITAL PASSWORD MANAGERS

You have a variety of choices when it comes to digital password management.

Built-In Password Managers

Let’s start with the digital password managers you already have.

Apple Passwords (Part of iCloud Keychain)

Apple’s Passwords is built in to all Apple devices, interacting with iOS apps, Mac apps, and the Safari browser. I’m a fan, especially because it’s free and works like a charm, but I’m the first to admit it’s not feature-full in the way many third party apps are. 

Contrary to popular belief, Passwords can work in Chrome and on Windows computers, but it’s not turnkey. You have to download the official Apple extension to sync your passwords and autofill logins.

• On a Windows PC, download the iCloud for Windows app from the Microsoft Store, turn on “Passwords,” and install the iCloud Passwords Chrome Extension.
• On a Mac, install the same iCloud Passwords Chrome Extension from the Chrome Web Store.
• On an iPhone/iPad, go Settings > Passwords > Password Options and turn on AutoFill Passwords to select Chrome as a trusted autofill provider.

You’ll still need an Apple ID to authenticate yourself with a verification code when you set it up. 

Google Password Manager

Google Password Manager is built in to the Chrome browser on all desktop and mobile platforms and every Android app.

One problem I’ve noticed is that it’s not uncommon to have more than one Google identity, and that can cause frustration. If you created a Google account in 1999 and built a life for yourself as ILikePuppies1959@gmail.com, but created ProfessionalLeader@gmail.com in 2010, you may have different accounts linked to each Google identity.

You may use Chrome and want to log in to Website A, only to find that Google Password Manager’s login for Website A is associated with your other Google account. On the plus side, Google won’t make you log out; just click on your little avatar and log in as the appropriate profile. 

Third-Party Digital Password Managers

One benefit of a third-party digital password over a built-in one is easier cross-platform compatibility without dealing with QR codes or fiddly Apple vs. Android/PC fussing.

But the truth is, every digital password manager, including the ones from Apple and Google, have trade-offs: personal aesthetic preference, user user convenience, cost, styles and methods of security protections, backup/synchronization and preferred features.

Bitwarden

Bitwarden has a very generous free plan, making it a budget-friendly option. The Personal Premium plan is $19.80/year and includes premium features like an integrated authenticator, secure password and file attachment sharing, emergency access for trusted contacts, security reports, and the ability to share vault items with one other user. Families get up to six premium accounts, unlimited sharing, unlimited collections, and a shared vault for $47.88/year. 

Bitwarden is open source, so anything you do decide to pay goes toward further development and not lining the pockets of evil billionaires.

Some users feel the interface isn’t as polished as some of its competitors, and that the family and sharing tools aren’t always intuitive. Additionally, there are complaints that if you update a password, it may create a new entry instead of modifying a pre-existing one, leaving both the correct and outdated passwords in place.) 

1Password

1Password has a 14-day free trial, after which it’s $36/year for individuals and about $60/year for families, with additional team, business, and enterprise-level plans. 

1Password is beloved for it’s easy-to-use interface, family and shared-vault features, and a security dashboard that alerts you to weak and reused, and monitors the dark web for compromised passwords. It autofills logins across mobile apps and browsers with biometric unlock via fingerprint, face, or iris. 

One standout feature is Quick Access, which can be used to search for anything you’ve saved in 1Password, including medical records and software license keys. Quick Access automatically identifies the app or website you have open and suggests relevant items from your vaults, providing a fast and convenient way to sign in to your accounts. 

Unfortunately, there’s no free version and it’s slightly more expensive than its (un-discounted) competitors. (Also, while the software is user-friendly, the website a bit intimidating.)

Proton Pass

Proton Pass has a strong privacy focus and is part of the Proton ecosystem. Like Bitwarden, it’s open source.

On top of the basic password generator, the feature-rich free plan works in the browser, on mobile, and in desktop apps, and includes unlimited logins, notes and credit cards, unlimited devices, 10 hide-my-email aliases, passkey support, alerts for weak and reused passwords, and an easy password import function. 
 
Pass Plus, at $2.99/month or $35.88/year, also includes unlimited hide-my-email aliases, a built-in 2FA authenticator, secure vault and link sharing, dark web monitoring, file attachments, emergency access for trusted contacts, a custom domain and additional inboxes for aliases, and command-line interface. Pass Family is $59.88/year includes everything in Pass Plus for up to 6 accounts, plus an admin panel for your family. There’s also Proton Unlimited, which gives you Proton Pass, Proton Mail, Proton Calendar, Proton VPN, and Proton Drive, all for $119.88/year.

Keeper

Keeper is one of the more expensive options at $42.99/year for a personal plan with unlimited storage, sync, and devices, unlimited identity and payment storage, fingerprint and FaceID login, web app and browser storage, and 24/7 support.

A family plan is $91.99/year for up to five users, providing the same features as a personal plan, plus shared passwords for WiFi and streaming services, unlimited shared folders, records and permissions, 10GB  of secure file storage, and emergency access for estate planning. (Note: family members cannot access each other’s vaults.) In addition, there are also student plans at 50% off, and personal and family military plans with separate pricing options.

Keeper has a strong security reputation and rich business features, but a regular plan does not include dark web monitoring or secure storage, which require add-ons at extra cost.

For casual users, Keeper can be a little feature-heavy.

Dashlane

Dashlane has a very polished interface and is beginner-friendly, but it no longer offers a free plan (though there is a 14-day free trial). The usual Premium price is about $65/year, though a current 40% discount brings it to $39.12/year.

In addition to unlimited devices, dark web monitoring, and the usual password generation and monitoring tools, the Premium plan includes passwordless instant login (without typing), securely shared access, a built-in virtual private network (VPN) for when you’re on public Wi-Fi, and live AI-powered scam protection. 

The Friends & Family plan covers 10 users and has a family dashboard.

NordPass

NordPass, from the makers of NordVPN, starts with a free lifetime plan with essential features like password generation, autosave, autofill, biometric/MFA access, password import capability, secure storage, and 24/7 support, but if you want access on multiple devices, a password health dashboard, a data breach scanner, file attachments, and the NordPass authenticator, you’ll have to upgrade to Premium (usually $35.88/year, but currently $19.08/year for the first 12 months, a 46% savings).

The “Family” Plan (good for friends and family) has all of the same features as premium for up to six users for $35.88/year (usually $71.88). Both the Premium and Family plans have a 30-day money back guarantee and both 1- and 2-year plans.

Other well-known options like Roboform and Aura may be worthy of your consideration, too. This post was a survey of options, not recommendations.

Fancy Words: Zero Knowledge Architecture and Encryption

Digital password manager marketers talk about these two features.

Zero knowledge architecture means that your data is encrypted and decrypted exclusively on your local device, ensuring only you can access it. But guess what? All six of these third-party password managers has it, as should every leading password manager. But because these companies can’t access your information, it’s vital that you always know and remember (and never re-use) your master password!

Oh, and encryption? They all tout having AES-256 encryption, except for NordPass, which uses XChaCha20 (yes, I’m serious) encryption, which is a newer, highly regarded encryption algorithm.

Essential Digital Password Manager Features

• Intuitive user interface — Because if you don’t get it, you won’t use it.
• Strong encryption — Duh!
• Multi-factor (including biometric) authentication for your vault/master login
• Strong password generation according to your specifications
• Passkey support
• Cross platform support — If it doesn’t sync across all of your devices, something is going to fall through the cracks.
• Browser extension for auto-fill, so the minute a login screen pops up, your browser should detect the need for credentials and fill them in, awaiting only your approval by click.
• Easy search and organization tools
• Mobile app
• Secure backup and recovery options
• Import/Export Tools — Because the last thing you need is for your passwords to be spread across multiple digital password managers

Bonus Features

• Security alerts and/or a password health dashboard for compromised or reused passwords
• Secure sharing capabilities to let family members (or team members at work)
• Emergency access login for trusted contacts
• Secure notes
• Document storage with high (or no) limits
• Dark web monitoring
• VPN included in subscription
• 24/7 Customer Support

And of course, consider the costs — look for a free trial (or better yet, a free tier) to make sure you find it intuitive. Whatever you pick, don’t just think in terms of a monthly cost, but also the annual cost and total cost over a “lifetime” of  use. 

A digital password manager means that you no longer have hundreds of login credentials and related information on sticky notes and in notebooks, un-synced browsers, and spreadsheets. And definitely not in your memory.

Instead, everything can live in one organized, searchable, encrypted repository.

Keep Your Digital Password Managers Organized and Maintained

As discussed last week, dealing with the backlog of weak, compromised, and reused passwords will take a while. Once all your strong passwords are migrated into your new system, block time to periodically check (and update) compromised passwords and delete outdated, unnecessary ones.

MORE RESOURCES

For more on helping you select a digital password manager, try these resources. 

Cyb3R_Sm@rT!: Use a Password Manager to Create and “Remember” Strong Passwords (CISA.gov)

Trusting the Tech: Using Password Managers and Passkeys to Help You Stay Secure Online (National Cyber Security Centre, UK)

The Best Password Managers of 2026 (Security.org)

The Best Password Managers for 2026 (PC Magazine)

Best Password Managers for Android 2026 (ZDNet)

The Best Password Managers (Wirecutter)

Just don’t let analysis paralysis keep you from getting started. Any reputable password manager that you use consistently will improve your security more than whatever you were doing before.

---

In the first post in this series, we focused on creating better passwords and passphrases, because what made a good login credential in 1997 (or even 2017) just doesn’t work today.

Today, we looked at password management systems for these new and improved security credentials.

Next time, we’ll examine how we prove who we are online with the new digital identity platforms increasingly used by federal governments.

Those of us of a certain age remember the first time we had to create a password, and for many years, lots of people used the same password for everything. As we edged from the 20th century into the 21st, we got “smart” about using smart passwords so they’d be harder to crack.

This short video from comedian Michael McIntyre may reflect your early password experiences.

Have you found that it’s become even more frustrating in recent years?

You don’t just need a password. There are passwords, passkeys, two-factor authentication, multi-factor authentication, facial and thumbprint recognition, and so much more. You may think you know everything there is to know about passwords; but even if you do, are you actually doing what you know you ought? And are there people in your life (like teens, grandparents, or technophobes) who could use a little support?

Today, we’re going to look at all the things you need to know and the various actions to consider taking to make sure your vital data is organized, safe, and protected.

Let’s start with the classic, the good old password.

HOW TO MAKE A GOOD PASSWORD

Do you know what makes up a solid password?

A Good Password is Strong

A good password is a strong password, one with serious muscle, one that’s hard to break or crack. The experts say that a strong password should have the following characteristics

• Sufficient Length — A strong password should be 16 characters. (I remember fondly when they asked for eight; then 12 characters were recommended. Sigh.) The shorter your password, the chance of a hacker figuring it out increases exponentially.
• Complex Makeup — Generally, it’s recommended that a strong password should be a mix of both uppercase and lowercase letters, numbers, and symbols that you can type from the keyboard. (Don’t use emoji.)
• Randomization — It’s a lot harder to guess 1dK5d8P91e65nNwf82et than PaperDoll123456. 
• Uniqueness — Never reuse passwords across different accounts. Yeah, I know. We are all guilty of it, but the easier it is for a bad guy to hack one of your passwords, the easier it is to get into your others. If you must re-use passwords, aim to only do so on with sites that have no real impact on your life. 

The problem with this recipe for strong passwords is that we are human. We’re lazy. We don’t want to keep creating new passwords. And complex, random passwords are hard to remember. But do you know what’s harder? Dealing with a hacked bank, investment, or Amazon account.

Instead of creating a random block of letters, numbers, and characters, you can keep the randomization but make the password a little easier to remember.

via GIPHY

Create a Passphrase Instead of a Password

Instead of one block of letters or numbers, develop a sequence of unrelated words.

For example, WinterWonderland, while possessing 16 characters, would not be a great passphrase because the words are thematically related. GrotesqueBroccoli, while reflecting my feelings about a particular vegetable, aren’t commonly used together. Even better would be something even longer, more bizarre, and unrelated, like YuckySweaterRodentNoise.

One advantage of a passphrase is that if you’re hand-copying it (from a password notebook, or typing on a computer but retrieving it from an app on your phone), it’s much easier to see and parse a string of words than il7-0oO-nmn-MWN, especially if you’ve got eyes that were in their prime in the 1980s. 

Think about the characters you choose.

The above example prompts a tip that the experts never mention. Because various letters and numbers, like a capital “I” (as in “I am”) and a lowercase “l” (as in “login”) are indistinguishable from one another in some fonts, as can be the number 1 and an exclamation point.

Capital “O” (as in “order”) and “0” (zero) can be confused for one another, and some lowercase letters, like “r,” “n,” and “m,” and uppercase letters like “M,” “N,” and “W” can also be hard to differentiate. 

Avoid predictable password information.

First, don’t use common dictionary words like “password” or keyboard sequences like qwertyiop. Duh!

Similarly, don’t use your personal information. Your password shouldn’t have your birthdate, phone numbers associated with you, names of your pets or the street on which you live.

If you need to be able to remember a password and won’t be safeguarding it in a digital password manager, an alternative method might be to pick information that’s personal to someone unassociated with you. Everyone knows I’m a fan of Jane Austen, so someone trying to hack me would find it easy to pick obvious things like Pemberley or Rosings, but if you have a favorite book or movie character that wouldn’t be easy for someone on the internet (or an evil ex) to suss out, consider stealing their fictional personal information.

Consider combining the above tips with a foreign language.

While I am only fluent in English, I have studied Italian, French, and Spanish, and know a smattering of Yiddish. Picking words from another language to come up with a lengthy but easy-to-read/remember passphrase might help you more easily read and remember it to safeguard access to your data.

Let a digital password manager do the heavy lifting for you.

Often, you can designate the features you want, so that if it needs (or you want) the number of characters to be even more than 16, or you prefer a readable passphrase over one with garbled numbers and letters, it will accomplish that for you.

Hacker Reality Check

The longer and more complex your passwords, the harder it will be to crack them. Hive Systems annually creates a table of the characteristics that increase your chances at organizing and preserving your dat privacy. Here’s their most recent table.

Courtesy of Hive Systems

This table confirms what we know: “Fluffy” and “123cookie” just aren’t going to cut it.

HOW TO FIX THE PROBLEMATIC PASSWORDS YOU ALREADY HAVE

If you have a digital password manager, it may prompt you with warnings regarding some of your passwords because they are:

• Weak — Such passwords are likely not long, complex, or random enough to be effective.
• Compromised — This status indicates that passwords have shown up on the dark web in a hack, likely one of a large corporation, like a retailer or insurance system (like the Change Healthcare cyberattack in 2024).
• Reused — An internal scan of passwords shows your app that you’ve used the same password repeatedly.

While working with a client recently, we saw that her iPhone’s Passwords app listed 610 passwords with a scary exclamation point on a red background indicating that 236 passwords had a security concern. Of those, about 122 were shouting “COMPROMISED PASSWORD” in red letters, with another 100 or so listed as “reused password.”

(Again, it’s not a huge problem to reuse passwords solely for sites you’re merely using to gain access to articles; but if such a site allows comments on articles, would you want to risk a hacker making you look like a fool or scammer by commenting with your identity?)

Closing your eyes to this problem isn’t a solution. In this case, the only way out is through.

Schedule a date with yourself — perhaps weekly, to deal with the backlog, and then perhaps quarterly for maintenance — to address your password hygiene. Treat it the same way you do (or should do) to periodically update your operating system and apps, clean your desktop, pare down  your inbox, etc.

Again, consider letting a digital password manager create replacements for you. It will be faster and easier than trying to come up up with something unique for any/many of your passwords.

WHAT IS A PASSKEY AND WHY IS EVERY SITE ASKING ME FOR ONE?

Have you noticed in the last year or so that every time you log into a web site, it asks you if you want to set up a passkey? Are you ever prone to thinking, “I just logged in with my password. Isn’t that already a passkey? What’s the difference?”

A password is your super-secret word or phrase that you create and then memorize (or write down, somewhere). It’s like the secret password that might have gotten you into a speakeasy in the 1920s.

(Trust me, this is worth watching for a laugh, especially if this whole topic stresses you out.)

But there’s the problem. You, a flawed (but adorable, I’m sure) human, must come up with the secret password and then protect it. This makes it vulnerable — to memory loss, password loss, phishing, hacking, and data breaches.

A passkey is different. It’s an un-phishable digital credential that’s tied directly to your device. Instead of typing a word, phrase, or string of gobbledygook, you unlock your account through a handshake between your device and the website, usually through some kind of biometric scan on your device (like FaceID on your phone, or thumbprint/TouchID on your device or keyboard), or a device/screen PIN. If you’re already logged into your computer or phone, you may be all set!
 
Passkeys differ from passwords in several ways.

Passkeys Are More Secure than Passwords

With a password, you’re sharing a secret with the server for whatever site you’r trying to log into. The thing is, secrets like these get revealed or betrayed all the time, either on our side, by our faulty memories or poor record-keeping, or on the server’s side, by getting hacked. Either way, access to your account is either lost or exposed.

Passkeys, however, use what’s called public-key cryptography. That’s a fancy way of saying that rather than having one key (your password) that fits in a lock on the other side, it’s more like in an old movie, where they’d go into a bank vault and the customer and the banker would each have a key for the safe deposit box.

Your private key is always securely locked inside the security chip of your device, while only the public key, which is totally useless-to-hackers, is maintained by the website.

Passkeys are More Resistant to Phishing Attempts

Have you ever been tricked (or almost tricked) into typing your password into a fake website, one made to look like the one you really want? Passkeys link your login effort to only a legitimate app or website, so if you try to log in to a faked website, your device will say, “No way, José!” and refuse to authenticate.

No handshake. Do not pass GO, and the phishers will not get $200 dollars.

Passkeys Are More Convenient than Passwords

Aren’t you tired of having to REMEMBER passwords?

Aren’t you tired of typing passwords?

Well, with a passkey, you don’t have to. If you’re already logged in to your device, access feels like magic. If not, logging in is limited to a simple scan of your beautiful face or a tap of your finger or thumb. It’s quick, and your face or thumbprint can’t make a typo, so your success rate will be higher. 

Passkeys Are Unique

We’ve already established that people reuse their passwords, which means that if you reuse the same password on ten shopping sites and a hacker gets your password once, they can probably guess it on a lot of other major sites.

Conversely, each passkey gets generated uniquely for whatever individual account at which it’s being set up.

Passkeys Are Loss-Proof

If you lose your phone, get a new computer, or your toddler puts your iPad in the dishwasher, you’re not out of luck.

Passkeys are synced across cloud services, like your Google Password Manager or your iCloud Passwords app, so access can be restored by setting up a passkey to the new device.

Passkeys (Usually) Eliminate the Need for Multi-Factor Authentication

I don’t know about you, but I’m so tired of having to check my email and/or my phone for a email or text code that I then have to type in. With a passkey, two-factor authentication is built-in, so you’re all set.

Passkeys Bypass Password Fatigue 

Have you ever just given up and done something else because you can’t bear to type in another password? (If you have a digital password manager and your passwords are organized and frequently pruned, probably not, but if you’re go the analog route 100% of the time or you’ve let your password management go rogue, this may sound familiar.)

So, the next time a website asks, “Would you like to set up a passkey?” you can feel confident in saying, “Why yes, thank you. I would very much like to set up a passkey! How nice of you to ask.”

A NOTE ABOUT AUTHENTICATION AND DIGITAL IDENTITY PLATFORMS

In addition to passwords and passkeys, you may have found websites asking you to use additional forms of identity authentication.

Authentication

Do you cringe when you hear people talking about two-factor authentication? You know it has something to do with security, but maybe you’re having trouble wrapping your head around it? Just like you don’t need to know how to rebuild a carburetor to be a good driver, you only need to know a little to make this aspect of security feel accessible.

For example, you’re almost certainly used to providing a security code, usually a series of numbers, that gets sent as a text or email. 

This process is an example of two-factor authentication or multi-factor authentication. We’re not going to get too deeply into the weeds on this, but very basically:

• Two-Factor Authentication (2FA) requires exactly two authentication steps, like using login credentials (a user name and password combo) plus that security code texted to you.
• Multi-Factor Authentication (MFA) requires two or more authentication steps.

So, 2FA is a type of MFA, but not all MFA is 2FA. 

In order to classify a method as Two-Factor Authentication or Multi-Factor Authentication, the “factors” have to come from different categories. For example:

• Knowledge — In order to log in, you have to provide something that you know, like a password, passphrase, code, or PIN, which means you have to keep your password information organized.
• Possession — This step involves something that you have, like your mobile device, your computer, or a hardware security key. (Again, not to get too geeky, but that’s a physical device used for MFA or password-less logins. If you actually want to know more about hardware security keys, you can read PC Magazine’s The Best Hardware Security Keys for 2026.) The key proves your identity using advanced cryptography when you:
  • insert it into a USB port in your computer
  • tap it wirelessly via near-field communication (NFC) against your phone or tablet
  • connect via Bluetooth (for devices that don’t have USB ports or aren’t NFC-capable)
• Inherence — This fancy word means something that you are, or that is inherent to you and nobody else. This is where FaceID or a fingerprint scan on your phone or your keyboard come in handy, because only you have your face or your fingerprints. Well, mostly. Per Apple, identical twins can sometimes unlock one another’s FaceID! 

Digital Identity Platforms

As technology gets more advanced, the bad guys avail themselves of more technology. This means that modern authentication needs to get more advanced, too. Just as the Michael McIntyre video of the top of the post made the point about our old-timey passwords requiring us to add capital letters, then numbers, then symbols, so too are we facing more complex requirements beyond simple passwords and multi-factor authentication.

Because of this, there’s a whole honking sub-category of authentication through digital identity platforms.

In two weeks, we will look at two very special kinds of login credentials we need to set up in the United States to help ease our access to federal government websites in order to pay our taxes, check our benefits, and travel. We’ll also look at a companion platform in Canada. But first…

COMING ATTRACTIONS

While long passwords are good, long blog posts on complex (and sometimes scary) technology topics are not. So, this week’s post is shorter than usual. (Really! It it’s 20% shorter!)

Next week, we’ll explore how to organize your passwords to make them accessible (to you) so you need never worry about forgetting them or making your kids crazy trying to figure them out.

 
We’ll cover:

• Analog methods for tracking your passwords
• The built-in digital password managers you already own
• The most popular third-party digital password managers and what makes each stand out
• The advantages and disadvantages of digital password managers
• The key features every digital password manager should have — and some bonus features you might not know about

We’ll also explore how to safely share your passwords with family members and trusted advisors.

And the week after that, we’ll end July with the aforementioned look at those digital identity platforms, which I’ve come to think of as “the password for your passwords.”

---

Until next time, please feel free to share any unique tricks or strategies you have for creating passwords, and any thoughts you have about this strange world of passwords, passphrases, and passkeys.

How do you feel about your password security?