Paper Doll

Posted on: October 19th, 2026 by Julie Bestry | 7 Comments

October 19-25, 2026 is National Estate Planning Awareness Week. In 2008, Congress established this as an annual event, in part because so many Americans do not have wills or other estate documents, and often do not understand the elements involved.  

We’ve previously talked about important documents to have when someone is alive, in case of emergency, like a:

  • Power of Attorney
  • Healthcare Proxy
  • Advanced Care Directive or Living Will

To refresh your memory on these documents, see past Paper Doll’s classic post How to Create, Organize, and Safeguard 5 Essential Legal and Estate Documents.

Most people understand how these are used during someone’s life. However, there is often confusion as to how things will work after a death.

Recently, while organizing a client’s vital documents, I asked some general questions regarding the basics of the paperwork: filling trusts, naming beneficiaries, changing the status on accounts, etc., and the client said, “Thankfully, we don’t have to worry about any of that. I have a will!” 

The reading of the will in Monseiur Verdoux (1947), in the public domain

If you watch old movies about such things, there’s usually a death, a sobbing person falling to their knees, a funeral, and then a formal reading of the will, at which point a portly lawyer turns the assets over to whomever is there — loved ones, a mysterious woman in a veil, a beloved dog. In movies, after a few shocking disclosures, everyone leaves the room owning what they were bequeathed. 

Yeah, no. That’s not how it works.

In most cases, assets are transferred from the person who is deceased to the new owner(s) in one of two ways, either through a process called probate or as the result of specific probate-avoiding actions, like setting up trusts, joint ownerships, or direct transfers (like registering an asset as Transfer-on-Death or Payable-on-Death).

Over the next few posts, we’re going to cover these concepts, including how to properly set up accounts, ownership, and beneficiaries of assets to reduce the emotional and financial stress on those who are left behind.

WHAT IS PROBATE?

You’ve certainly heard about probate before. You know it has something to do with wills and what happens when someone dies, and that may be the limit of your familiarity. 

Most adults who haven’t ever dealt with probate tend to nod sagely when someone else is discussing it, and hope nobody will ask them questions. (In that way, it’s similar to being in an algebra class. Look interested, but not so interested that anyone will ask you to weigh in.) Don’t let embarrassment or uncertainty lead you to miss out on the opportunity of easing the entire process.

In the simplest terms, probate is a legal process where a court supervises the distribution of the assets of a deceased person.

Probate exists because no matter what the will says about who gets what, the government (under the guise of the probate court) has a vested interest in making sure that all of the estate’s debts (if there are any) get paid off before any heirs collects assets. The court also needs to make sure that taxes are paid and that assets are properly transferred. 

Probate doesn’t only happen when there’s a will. If someone dies intestate — that is, without having left a will — and there are interested parties (heirs), an estate usually goes through the probate process as long as the value of the personal property of the estate (not counting a house or other types of real estate) is above specific dollar value.

Plus, if someone does die without a will, the probate code determines who gets what. That means, for example, if someone dies while going through a nasty divorce but doesn’t have a will, the court will give a lot of their assets to the not-yet-ex instead of to the non-profit or beloved friends they might have wished to receive those things.

How To Start Probate

As a reminder, Paper Doll is a professional organizer and not an attorney, so nothing in this post series should be taken as legal advice. Rather, it should serve to give you a better understanding of what to expect when you organize your important documents and information to make the estate management process easier.

  • Name an executor — The testator (that’s the person making the will — also known as the last will and testament) names an executor, the person who controls someone’s assets after death, carries out the deceased’s wishes, and distributes the assets. The executor can be a spouse, an adult child, a friend, or even an individual hired for the purpose.
  • Submit the will to the probate court — The executor submits the original, signed will to the office of the probate court clerk in the county where the deceased person lived. So, if Great Uncle Phil lived in Polk County, Iowa but you’re his executor and you live in Hawaii, you’ll need to submit everything to Polk County.
  • Submit a certified copy of the death certificate to the probate court clerk’s office. Typically, the funeral home will provide the family of the deceased with multiple copies of the death certificate. You can always get more from your state’s Office of Vital Records.
  • Fill out a sworn petition to probate the will — The word “petition” is just a fancy legal term for request or application. The petition form will include information about:
    • the testator (again, that’s just the deceased)
    • an estimation of the total value of their assets — Later in this series, we’ll talk about how to organize that information so the amount submitted can be accurate.
    • the names, addresses, and relationships (to the deceased) of anyone named in the will, or if there is no will, the same information for any relatives who might be entitled to inherit.

Note: in some counties, the petition to probate a will has to be drafted and filed by an attorney, so check with the Probate Court Clerk before trying to use or submit any online forms on your own. 

Probate Lawyer Scrabble Photo by Melinda Gimpel on Unsplash

The court will charge fees for the probate process; if you have to hire an attorney, there will be fees for that, too. Know that that all estate-related fees can be paid (generally, reimbursed) from the deceased assets.

What Happens Next

Once you file all the paperwork with the probate court, you’ll be schedule for a hearing in front of a probate court judge. Unlike anything you’ve ever seen on Perry Mason or Law & Order, this is not likely to have much dramatic effect. Assuming nobody objects to the person named as executor, the judge will officially appoint the named person to do it.

If there are objections (let’s say Big Brother and Little Sister have a longstanding beef), the judge may name a more neutral party, like an attorney, to serve as the executor. Either way, whoever takes on the role with make an oath to “faithfully” pay the owed debts and distributed whatever assets are left over according the wishes the deceased expressed in the will. 

The Executor’s Role

Next, the judge will give the executor a legal document called Letters Testamentary, and yes, it sounds like something out of an 18th-century English novel. Just go with it. In some jurisdictions, it may be called letters of administration. It’s just a document authorizing the executor to act on behalf of the estate. 

Again, it’s a legal document. Don’t fold it into quarters and stick it at the bottom of your purse with the half-eaten bag of gummy bears. Don’t clip it to the sun visor of your car. Make a folder for it and put in the VIP (very important paper) section of your filing cabinet. Scan it and keep a copy on your phone so you can refer to it when aren’t at your home or office.

One of the rights of being an executor is actually an obligation: to withdraw all the money from the deceased’s bank accounts and then deposit it in a new account for the estate. This way, the executor can pay the debts and distribute any financial assets to the heirs.

Once the executor has notified all creditors, paid all debts and/or filed objections to creditors’ claims with the court, and distributed the assets, the estate can be closed. This involves filling out and signing a form documenting all payments made from the estate and sending it to all beneficiaries named in the will. If everyone gives the okey-dokey and feels the accounting is correct, they also sign the form. Finally, the form gets submitted to the probate court judge for approval and the estate can be officially closed.

Can you see the advantage of organizing your assets so that your estate can avoid, or at least minimize, probate?

SMALL ESTATE AFFIDAVITS AS AN ALTERNATIVE TO PROBATE

A small estate affidavit isn’t the deed to a tiny house.

“Small estates” are those valued at a relatively low amount. Heirs can collect the assets/property without going through a formal probate process by securing something called a Small Estate Affidavit.

Depending on the state, that “small” amount may be $10,000-$25,000, like in Alabama, Georgia, New Hampshire, and Vermont, or it could be what some of us would not consider small at all, like $150,00-$400,000 in states like Arizona, California, and Wyoming. Most states fall somewhere in the middle. For example, in Tennessee, where Paper Doll resides, the limit is $50,000.

There are usually special requirements for filing small estate affidavits:

  • the assets must have been owned solely by the deceased. That means that jointly-held assets don’t count.
  • real estate is excluded.  Almost all states deny the transfer of real estate to heirs via a small estate affidavit.
  • there are waiting periods after the date of death. Almost all states require you to wait some amount of time, generally 30-45 days, before the affidavit can be obtained.
  • your executor or proxy will have to get their signature on the affidavit notarized. 

There’s an additional hiccup with small estate affidavits. During the normal probate process of a well, the probate court determines if there are creditors owed anything for the deceased’s outstanding deaths and makes sure they get paid.

Because there’s no parallel process with small estate affidavits, the individual filling out the affidavit generally has to report any known debts and take responsibility for them. This is why many people who could avoid the costs and effort that probate entails don’t seek this alternative.

It can also just be a bother. Earlier this year, I found that one of my clients was receiving mail at her address regarding two sets of stock holdings in the name of her deceased father. Although he had a will for which my client was the executor, by the time he died (about five years earlier), the family had not known/felt that he had any assets making the probate process with it. He’d arranged for joint ownership of bank accounts, and no longer owned property, as he was living in a nursing home. At the time of his death, the two stock holdings weren’t at the forefront of anyone’s mind.

Had my client’s father named her (or anyone) as a beneficiary for those stock holdings, she could easily have transferred the funds by supplying a copy of the death certificate. However, because he had never named a beneficiary, my client had to jump through several hoops in order to secure (and pay for) a small estate affidavit, submit it to the stock transfer agent, transfer the account ownership to her name, and finally arrange to sell the stock and receive the proceeds. It took time and effort (for both of us) and money just to ensure a transfer of assets reflecting what his will had originally stated — than anything of his was to go to his daughter.

As you can see, not planning ahead can be a headache for loved ones left behind. 

  

WHY YOU WANT TO AVOID PROBATE

I don’t mean to scare you. The emotional weight surrounding death, either of a loved one or of all of our eventual shuffling off this mortal coil, is heavy. Rather than add the unwanted (and unexpected) weight of the financial and legal aspects of passing, it’s better to get to know and understand the big picture so that you can take actions early enough to smooth the entire process.

So, why avoid probate or at least lessen the complexity?

Lower Costs

Probate can be pricey!

Attorney fees, executor fees, appraiser fees and notary fees all add up. Executors can’t always be expected to donate all of the time necessary to accomplish probate tasks. And, sad to say, courts don’t run on good vibes. If you go through probate, you’ll likely have to shell out for:

  • Filing fees — While they vary by state and county, most initial filings costs between $200 and $500 for a standard probate petition filing.
  • Attorney fees — Probate attorneys generally charge hourly fees, and an “easy” probate may take 30+ hours at anywhere from $200-$500/hour; alternatively, attorneys may have flat package fees for uncomplicated probate. Note, however, some states have statutes governing attorney fees as a percentage of the estate’s gross value. For example, in California:
    • 4% on the first $100,000
    • 3% on the next $100,000
    • 2% on the next $800,000, and
    • 1% on the next $9 million! 
  • Executor fees — Executors have a right to compensation. While family members may choose note to charge the estate for their labor as executors, they have the right to do so. Plus, in states that have statutory attorney fees for probate, executors are due equivalent payment as a percentage of the estate’s gross value.
  • Appraiser fees — In order to determine the fair market value of assets, appraisers bring their expertise to the valuation of everything from real estate and businesses to jewelry, antiques, artwork, and collectibles. And appraisals are usually required as part of the formal inventory of an estate’s holdings.
  • Accountant fees — If an estate generates income (like from rent, dividends, interest, or business holdings), someone has to prepare the the taxes!
  • Notice and publication costs — Executors incur costs for mailing formal notices to creditors and publishing notices to creditors.
  • Certified copies of court orders — While these are small charges, generally from $5-$25 per copy, the executor will need several copies to show title companies, banks, transfer agents, and other financial institutions.

The more fees there are, the less value remains in an estate. If you’re Scrooge McDuck with oodles of gold, it may not make a material difference, but for most people, keeping costs down is essential.

Why let an estate’s value be eaten up and depleted by fees you can avoid? 

Save Time

Even in the best of times, probate can take months — sometimes years — to work its way through the courts. During the early COVID pandemic, courts were closed, and once they re-opened, with so many employees working from home without access to physical documents, the process was extended.

Even in normal times, during certain seasons the courts slow down as staffers are on vacation and during holidays. It’s not uncommon for it to take months just to get a probate court hearing date in large metropolitan locations.

In addition to court backlogs, probate can be slowed by other factors, like:

  • Mandatory creditor notice periods — States requires executors to notify any creditors and potential creditors and provide a window (often 3-6 months) in which to file claims against the estate. (Creditors, like credit card companies, are easy to notify. Other potential creditors may be unknown, so it’s common to post in the classifieds of Penny Saver newspapers, even almost nobody reads them.) Even if the estate doesn’t have any debts, that notice period is obligatory, and the executor can’t distribute any assets until the window closes. The process is really complicated and varies by state, debt type, and method, so if you’re eager to learn more take a peek at Probate Notice to Creditors and Claim Deadlines by State, and then maybe take an aspirin.
  • Sales of real estate and other property required by a will or to satisfy debts — And it’s not just the sale. A property first needs to be appraised, and then it may need to be maintained/remodeled/made “safe for habitation.” If the property wasn’t covered by insurance at the time of death, it must get covered before the property can be sold. Except if the will didn’t grant the executor the authority to sell the property, the whole process could require the court’s approval, and that means scheduling (and then waiting, and then having) another hearing, just to be allowed to accomplish these tasks. And then someone has to be willing to purchase the property! Oy! (Where’s that aspirin?)
  • Tax preparation and filings — Depending on the size of the estate, a federal estate tax return using Form 706 (including schedules A through W!) might be due 9 months after the person dies. And if the estate, itself, earned any income during that period (like from investment dividends, rental income, or a business), then the estate may have to file a federal income tax return. Plus, some states have their own estate tax and inheritance tax, so preparing returns and waiting for government entities to process them can takes several months depending on how complex the tax situation is. 
  • Contested wills — You’ve seen the ripped-from-the-headline cable movies. You’ve heard the gossipy stories. Everything seems like it’s going along smoothly and then someone objects to the will. It can be a creditor, an heir, or mysterious “other” and they might challenge whether the will is valid at all. Siblings argue that Grandma had no mental capacity to make the will or that another individual used “undue influence” to get a will revised. Sometimes, someone argues that an old will is real and a newly-found one is not (or vice versa). It can takes years for contested wills to complete probate!

Where you live can also determine how quickly the probate process goes. In the United States, probate takes an average of 9-24 months; if the deceased had no will, the process generally takes 2-4 extra months, although it can be longer. In Florida and Texas, probate may be completed in six months to a year; in New York and California, 1-2 years is more common. 

Probate timing benchmarks by state, 2026

Chart: Catalina Structured Funding, “How Long Does Probate Take? State-by-State Timelines for 2026,” https://www.catalinastructuredfunding.com/blog/how-long-does-probate-take

The longer probate takes, the longer the delay before assets can be distributed to beneficiaries. Doesn’t it make sense to avoid or at least minimize the probate process?

Ensure Family Privacy

Did you know that probate proceedings are a matter of public record?

That means anyone, from your ex-mother-in-law to Gladys Kravitz can access the details of your estate holdings and know who the recipients of assets are. Maybe you’d rather the world didn’t know that Cousin Floyd left you stock in Playboy Enterprises. When you avoid probate, you get to maintain your family’s privacy.  

Reduce Stress

Grief is difficult and unwieldy. When families are in mourning, loved ones feel surges of grief at unexpected times; it’s why you feel “waves” of grief, and why it’s important to keep from being pulled under.

Why add to the emotional pain of loss with a complex and lengthy probate period when you can make inheriting many of the assets easy?


Next time, we’ll explore the specific ways you can avoid probate, or at least limit the process, labor, and costs. 

In general, there are three main categories of ways to avoid probate:

  • Own property jointly
  • Create (and then fill and fund) revokable living trusts
  • Arrange for beneficiaries (through Payable-on-Death/Transfer-on-Death assignments)

That last bullet may seem like something you only do with life insurance or retirement accounts, but there are easy, no- and low-cost ways to transfer ownership of everything from bank accounts to stock holdings, and even cars and houses, and we’ll walk through them all.

As we go through this series, we’ll also look at how to organize information about your assets to make the probate process (or avoiding the probate process) so much easier for you and your loved ones.

Posted on: October 12th, 2026 by Julie Bestry | 14 Comments

Recently, I caught up with a friend I hadn’t seen in a while. We chatted about what I’d been doing (working with clients, visiting Paper Mommy, and not blogging) and what he’d been doing (work, complaining about work, and doomscrolling). I mentioned that when the world gets too much for me, that’s my cue to clean out my junk drawer (as in Is Your Junk Drawer a Drunk Drawer? 3 Steps to An Organized Junk Drawer) or otherwise dig into some project that will absorb me, physically and mentally.

He was dubious. (I understand. Not even organizers want to organize all the time.) Then I shared the New York Times‘ Wirecutter column, 118 Things to Do Instead of Doomscrolling.

As an alternative to reading about war, crime, politics, and the whole general <waves arms around in dismay> everything, the piece promotes varioius typical and offbeat tasks. There’s advice to read and write, cook and make art, play games, train pets, learn origami, write a thank you note, and tend to houseplants. The piece also suggests learning to make latte art, chatting with a farmer about their favorite produce, and rewriting the end to your favorite book/play/movie/TV show.

I wasn’t exactly shocked that amid the more entertaining and physically active pursuits, the only organizing tasks that made it onto the list were at #39 (organizing the medicine cabinet) and #43 (do some “soft decluttering”). However, I was surprised to find that podcasts weren’t listed among these uplifting methods of distraction.

Podcasts abound, and it seems as though almost everyone has one! (Paper Doll does not. I like being a guest on podcasts, which is much like playing with someone else’s baby — all fun and very little ongoing responsibility.) I realized that it’s been four years since I posted Paper Doll Picks: Organizing and Productivity Podcasts and Paper Doll on the NAPO Stand Out Podcast: Why Paper Still Matters, so it’s definitely time for an update, especially as so many of my friends and colleagues have entered the podcast space.

Listening to (or watching) podcasts focused on organizing- or productivity-related topics has a variety of advantages. In addition to providing an alternative to doomscrolling, keeping your mind active, introducing you to new resources, and giving you something to talk about when the conversational well runs dry, a good organizing or productivity podcast can help you solve problems you hadn’t considered having achievable solutions.

In this post, I’d like to introduce (or re-introduce) you to some podcasts I think you’ll find appealing.

SIMPLE ENOUGH

My friend and colleague Miriam Ortiz y Piño of More Than Organized in Albuquerque, New Mexico is a Renaissance woman. Like me, she’s an inaugural Certified Professional Organizer®. She’s also a Money, Mindset, and Marketing Coach, and a Streamlined Money Breakthrough Business Coach, and I had the pleasure of being one of her clients early in the pandemic when we were all trying to figure out the art of the “pivot” during unprecedented times.  

Now, as a few months ago, Miriam is a podcaster!

Simple Enough: Organizing, Productivity, and Mindset for Entrepreneurs is the perfect extension of Miriam’s expertise as an organizer and business coach. Here’s her own description of what she brings to her audience:

Do you have no shortage of ideas or ability, but still feel buried under decisions, half-finished projects, clutter, and systems you started but never quite finished? Simple Enough is for entrepreneurs, creatives, and overthinkers who want a calmer, clearer way to organize their space, decisions, mindset, and life – without forcing themselves into someone else’s system.

Miriam takes the conversation beyond the “how do I fix this” and gets to the nitty-gritty of “why did this get like this in the first place?” because she knows that there are always underlying issues, and until you figure those out, the problem (or the clutter) will keep coming back.

If your get-up-and-go has got-up-and-went, and you’re having trouble finding the motivation and clarity to achieve your personal and professional dreams, dial up a few of Miriam’s recent podcasts to see how her perspective can help you find some of your own. Check out some episodes like:

As Paper Doll, I hold special affection for the episode, How to Organize Paperwork So You Can Find What You Need, but you could also dive into a more iconoclastic episode, The Organizing Rules You Never Need to Follow.

 

Find Miriam’s Simple Enough podcast at her Substack on the web or in the Substack app, or on YouTube, Apple Podcasts, Spotify, Pocket Casts.

RETHINK TIME, a Podcast by Time Timer

Longtime Paper Doll readers know how much I adore Time Timer as a resource: for teachers, parents, and therapist when working with children, for people with ADHD, and for anyone who has a complex relationship with time. I’ve written about Time Timer’s timers, app, and approach numerous times, most recently in:

So, I was delighted when I learned that Time Timer was starting REThink Time.

Hosted by Christen Barbercheck, REThink Time looks at time, not merely from the perspective of how to use it more efficiently, but how to make it less challenging and more rewarding. In Time Timer’s own words:

We will explore how we teach, support, and experience time in classrooms, therapy spaces, and everyday life. Whether you’re a teacher, a parent, or struggle managing time yourself, we will be interviewing experts in the fields of education and neurodiversity to share real-life strategies you can use in everyday moments—so time feels more understood to everyone in your life.

I’ve really been impressed with how REThink Time combines expert talk on technology, education, ADHD, neurodiversity, and the wider workplace to provide true understanding and real-world applications of innovative solutions. It’s easy for experts to talk about abstract theory, but I suspect most people hunger for ways to make their lives (and the lives of their children or the people they support) more satisfying. REThink Time delivers!

Although the premiere episode did share the history of Time Timer in From “How Much Longer?” to a Global Tool: The Time Timer Origin Story, this podcast is not a commercial for the company. 

I particularly recommend the most recent episode, Outsmart Your ADHD Brain. Christen interviewed Jeff Copper, a cognitive engineer, attention coach, and founder of DIG Coaching Practice about ADHD, working memory, and task initiation. 

 

You can watch on REThink Time on YouTube or listen on Spotify.

SURFING THE QUICKSAND

I first knew Kathy Vines, my colleague, friend, and one-time NAPO-conference roommate, as a professional organizer, productivity coach, and founder of Clever Girl Organizing. And she IS a clever girl!

But Kathy is also a speaker, author, certified smarty-skirt (my own term!), and the host of Surfing the Quicksand. Now in its second season, this GenX-friendly show is, in Kathy’s words,

“a podcast for helping midlife women get a little more organized, productive, healthy, sane, and unstuck, one chat at a time.”

Boy, do I get that!

Organizing our lives means so much more than the tangible “stuff.” It’s the relationships, the career and life paths, the decision trees, and everything you remove or add to your life, or the way you rearrange aspects of it, to make your time on this planet more fulfilling.

(For those of you watching Ted Lasso‘s fourth season, you may have noticed Mae reading Mary Oliver’s moving poem, When Death Comes, over the final shots; rather than being depressing, as the poem name might imply, it’s about living your live to the fullest, and I think we can well imagine that getting “unstuck” from the quicksand is key to that endeavor.)

I can’t say it any better than Kathy’s own media kit. So, if you’re interested in any of the following: caregiving, career shifts, identity changes, health and wellness, financial planning, household responsibility, productivity, wellness, personal development, organization, reinvention, and practical life tools, this podcast is for you.

Season 1 had a whopping 41 fascinating, meaty episodes, and Kathy is already a half a dozen episodes deep into season 2, so you’ve got your choice of topics. You can start at the beginning or pick and choose the episodes that call to you. Personally, I’ve had the most fun with the episodes where Kathy interviewed Paper Doll friends and colleagues (often mentioned in the pages ofthis blog), including:

One of my favorite episodes was a recent one where Kathy sat down with one of my besties, Deb Lee.

Deb’s a genius at productivity, tech, and making a person feel valued and heard, and when I listened to Deb and Kathy chat on the podcast while driving up a mountain to my client day, it was so warm and inclusive that forgot I was listening to a podcast and not on a three-way phone call! Sample the episode, The Onion Years: Peeling Back the Layers of Caregiving.

  

Surfing the Quicksand is available on YouTube, Spotify, and Apple Podcasts, and you can keep up with the show at the Surfing the Quicksand site above, or on Facebook and Instagram.

As a professional organizer, I’m usually disinclined to promote tangible goods, but if you’re in deep need of T-shirts, hats, water bottles, or totes (or are stymied for holiday gift options), you may want to check out the Surfing the Quicksand merch shop.

OLD FAVORITES — PODCASTS WORTH REVISITING

In addition to these new (or new-to-you) podcasts, I’d love to call your attention and share some love for some other beloved podcasts. 

Getting to Good Enough

I was always a huge fan of my friend and colleague Janine Adams’ and Shannon Wilkinson’s Getting to Good Enough show, which was billed as  “A podcast to help you let go of perfectionism so you can live life with more ease, less stress and a lot more laughter.”

From 2018 through 2023, Janine, a fellow professional organizer and founder of Peace of Mind Organizing, and Shannon, a life coach, offered up a gentle “You Are Enough” NPR-style hug in a world of loud, pro-achievement, miracle morning, hard-core press podcasts. So, as a recovering Type A+ (who has, over decades, barely chilled to a Type A-), I was crestfallen when Janine and Shannon stepped away from their podcasts booths. 

Then, last year, much like my beloved Ted Lasso (which also went off the air in 2023), Janine and Shannon unexpectedly announced that they were coming back! Also like Ted Lasso, Getting to Good Enough revels in finding a compassionate approach to living your life.

If you’ve never listened, you might want to go back to the beginning and alternate new episodes with working your way through the backlog. If you’re excited but didn’t realize the show was back, there’s no time like this cozy autumnal season to get back in the anti-perfectionist groove.

From the very first 2018 episode, Done is Better Than Perfect, to Imposter Syndrome: Why It Happens (and What Actually Helps) to Getting Unstuck After a Mistake, you’re going to find something that floats your boat.

The recent The Beauty of a Good Checklist had me nodding along as I listened and drove, and I soaked up What it Takes to Take a Break at the airport as I jetted off to visit Paper Mommy last month. 

 

I should note while almost all podcasts have show notes worth checking for key points and resources, Janine and Shannon provide particularly good (and organized) notes.

You can watch Getting To Good Enough on YouTube (though only the episodes since the show’s return have actual video of Janine and Shannon), or listen on Apple Podcasts, Spotify, Pocket Casts, or as an RSS feed.

Get Organized With Dr. Frank Buck

I’ve promoted the excellent Get Organized! with Dr. Frank Buck podcast many times in the past (and have been a guest on several occasions), most recently last year in Take Note: Paper Doll’s Guide to Organized Note-Taking (Part 1). Frank’s zippy episodes deliver practical advice at the intersection of productivity, organization, technology, and his original area of expertise, education. 

Some nifty episodes recently have included:

Frank continues to deliver weekly episodes on all the topics that drew me to share his material, but a recent show, 12 Apps That’ll Make You an Organized College Student reminded me of how great this podcast is with keeping up with both essential principles and new solutions.

 

You can listen to Get Organized! with Dr. Frank Buck on Apple Podcasts, Castbox, Overcast, Pocket Casts, Spotify, and an RSS feed, but I encourage you to tune in to the show on YouTube, at least when Frank is discussing technology, to get the full effect. 


 

Of course, there are so many podcasts out there to stir your passion for getting organized, being more productive, and keeping you from doomscrolling, and this is only a taste. However, after taking a short sabbatical from blogging in August and September, Paper Doll HQ is aiming for somewhat shorter posts.

Note, I said shorter and not short. I am who I am, and like Ted Lasso, I am built out of words, and will continue to share so, so many of them with you readers. And if this post inspired you to listen to podcasts and think more about Ted Lasso, well, here’s a list of the 18 Best Ted Lasso Podcasts.

It’s good to be back in the blogging groove and to be back with Paper Doll readers again!

Posted on: July 27th, 2026 by Julie Bestry | 10 Comments

Are you over it? Do you feel like you’re all prepared, password-wise?

Two weeks ago, in Not Your Mama’s Passwords: Passphrases, Passkeys, and the Future of Logging In, we did a deep dive, examining:

  • how the characteristics of a good password have changed over the years
  • what it means to have strong passwords nowadays
  • all the elements to consider when picking your login credentials (Did I at least convince you that having capital I and lowercase L (I vs. l), and zeros and O’s (0 vs. O vs. o) might be confuse your eyeballs as you age?)
  • the advantages of a passphrase over a traditional password
  • how to fix weak, compromised, and re-used passwords
  • the advent of passkeys and the many reasons why they’re advantageous (and getting more popular)
  • what the difference is between 2-Factor Authentication (2FA) and Multi-Factor Authentication (MFA) and how you can use those methods to the advantage of your digital security.

Then last week, in Paper Doll’s Guide to Managing Passwords for the 21st Century, we had a bit of a reality check as to how we can no longer hope to remember our passwords and why keeping them on sticky notes isn’t (and was never) a good idea. We looked at:

  • the advantages and disadvantages of analog password management and whom they are likely to serve best
  • the advantages and disadvantages of digital password managers (the solution that’s best for most of us)
  • the most built-in digital password managers you may already have
  • the most popular third-party digital password managers (plus their features and costs)
  • essential features of digital password managers, and some bonus features you might want to check out
  • resources for learning more about digital password management.

So, I’d get it if you think you know everything there is to know about organizing your passwords for a more orderly digital life. 

Except…maybe not quite yet?

Having access to your login credentials and using your fingerprint or FaceID to prove to a website that you have the right to access your digital stuff should be enough. <sigh> But as we go along, for some sites, that’s still not enough.

The question for this point in the 21st-century is: How do you prove that you are really you?

  

WHAT IS DIGITAL IDENTITY VERIFICATION?

If you’ve tried to log in to Social Security, EFTPS, the Veterans Administration or any of a number of government websites in the last few years, you may already know that having a password isn’t enough. Because of this, in recent years, new kinds of digital identity verification platforms have been developed. 

In the simplest of terms, digital identity verification is the process by which you can prove that your identity is real — that you are really you — without necessarily having to interact in person. Instead of a company making you come in for in-person identification — like how you have to go to an airport to interview for TSA Pre-Check — government agencies, organizations, and businesses can now outsource the collection of that biographical and biometric data digitally, remotely, and match it against trusted, verifiable sources.

These outsourced sites require you to jump through some reasonable hoops to sign up and prove your identity so that when you go to log in to your actual destination (like the Social Security Administration), it’s like there’s a drawbridge with a guard asking you to prove that you are who you say you are before you can go any further.

You just have to have the right answers.

 

The two best-known sites for digital identity verification, particularly for use federal and state agencies, are ID.me and Login.gov.

ID.me

ID.me was started in 2010 by two U.S. Army Ranger veterans. It’s a secure digital identity verification service that has been described as acting “like a driver’s license for the internet.”

Once you prove who you are to ID.me, it won’t help you buy alcohol or get you on an airplane, but it will unlock access to your accounts with government agencies and programs, healthcare portals, and online store discounts that are dependent on you having a particular kind of status.

How to Get Validated By ID.me

To get validated by ID.me, there’s a one-time set-up where you create a single, unique set of login credentials and confirm the sign-up via email, then choose a multi-factor authentication method. (You also get to create a VERY complex recovery code you can use in case you ever lose your device and/or phone number.)

And, of course, you have to verify your identity.

On the plus side, you won’t have to answer those pesky security questions like you used to have to do to get your credit score. (This is a boon to anyone who no longer recalls their address when they were twelve or the lending company for their first car loan.) But you will need the following basic identifying information:

  1. your email address — Select one that you check frequently and that you can access during the sign-up process. (So, don’t use your work email if you can’t access it from home, or vice versa.)
  2. your Social Security number — Alternatively, if you do not have an SSN but do have an Individual Taxpayer Identification Number (ITIN), use that.
  3. your valid state or federal ID, like a driver’s license, passport book or passport card
  4. a reliable multi-factor authentication (MFA) method — This may be the ability to receive a security code via text message, an authentication app (like Google Authenticator), a security key, or backup code.
  5. your phone, tablet, or computer with a camera — You will be asked to take photos of your ID and of your face to verify your identity. You may not want to do this at 2 a.m. after you’ve rubbed off half your eye makeup or mussed your hair to the point that you’re no longer recognizable, so consider this before starting the process. 

Once you have everything in hand and provide your identifying information, you will be prompted to either take a brand-new selfie or join a brief video call in order to prove that the photo on  your driver’s license matches the photo of your face. I hope, for your sake, your driver’s license photo doesn’t look like Nick Nolte’s famous mug shot.

Be ready to create your ID.me password. Yes, you need a password for the site that let’s you log in to other sites with passwords you already have. And yes, I recognize how ridiculous that sounds. 

And, of course, you’ll have to abide by wisdom we’ve previously discussed regarding letters, numbers, special characters, randomization, length, etc.

The process is only slightly laborious, fairly painless, and free, and you will only ever have to do it once.

 

Where Can You Use ID.me?

More than 21 federal agencies and at least 45 state government agencies in the United States use ID.me as a trusted credential service provider to allow you to safely access information, manage your benefits, and help stop fraud. Government agencies using ID.me include:

Various individual states use ID.me for their Departments of Labor or Unemployment, Departments of Revenue/Taxation, and Health & Human Services programs, like state Medicaid and SNAP. You can access a list of all federal and state agencies using ID.me at https://www.id.me/government.

But it’s not just the government that wants to verify your identity. Various businesses offer discounts based on status, and that status is built into your provable identity with ID.me. For example, if you go to ID.me and select Shop instead of Government at the top of the screen, you can use your ID.me Wallet to prove your status as a:

  • current member of the military
  • veteran
  • nurse (or other medical professional)
  • first responder
  • teacher
  • student
  • government employee

and access a variety of discounts on product categories including clothing and accessories, health and beauty, sports and outdoor equipment, travel and entertainment, lifestyle items ranging from publications to meal delivery to toys, technology and office equipment, home and auto supplies, pet supplies, and delivery services. 

Two Ways to Log On Using ID.me

In order to log in using ID.me, there are two main methods. The first represents my own experience, because I like to jump through hoops.

I pay quarterly estimated taxes for my business through the Electronic Federal Tax Payment System (EFTPS). When I first signed up, more than a decade ago, I had to submit an application and then wait for the government to send me a PIN and an enrollment number in the mail. Only once I received it could I create a password, after which, every time I logged into EFTPS to pay my taxes, I would have to provide my email address and password, as well as that PIN.

Then, several years ago, I was prompted to sign up for either Login.gov, ID.me, or a third verification platform that no longer exists. At the time, ID.me seemed the easiest, so that’s what I picked. Now, when I go to EFTPS and start to log in, I’m immediately sent to ID.me, where I log in, and it then takes me back to EFTPS, to use my agency-specific login credentials.

It’s a lot, but it protects me from someone else logging in and paying my taxes for me. (Wait. Tell me again why that would be bad?)

There’s a second method. Because ID.me is considered single sign-on (SSO), an identification method allowing users to log into multiple independent apps and websites using a single set of credentials, you can get to all of the various government agencies (and the aforementioned shops) directly from the ID.me website.

Once logged in there, your ID.me wallet can take you to any federal or state government agency or shop that’s part of the program. 

How ID.me Ensures Safety and Privacy

ID.me follows strict federal security rules for consumer authentication set by U.S. Department of Commerce and is approved by the National Institute of Standards and Technology (NIST) as a NIST 800-63-3 IAL2 / AAL2 credential service provider per the Kantara Initiative. (If you think that sounds like something out of Star Trek, well, we’re on the same page.)

ID.me is a private company, not operated by the government. So how does it make money?

ID.me states it does not sell your personal data to advertisers. Rather, ID.me stays afloat by:

  • Charging software subscription and verification fees to government agencies and businesses — Government agencies pay ID.me for Identity as a Service (IDaaS) while enterprise-level companies pay ongoing subscription fees or per-verification fees to securely verify their users and prevent fraud.
  • Charging individual retailers transaction fees to verify customer groups (like military members, or teachers) so they can securely offer discounts to identity/status-linked audiences.  
  • Receiving affiliate commissions on anything users purchase through the ID.me Shop.

However, because people have now experienced signing up with ID.me, leading to trust in the name, you can be sure bad guys are pretending to be ID.me.

As always, watch out for fake emails and text messages purporting to be ID.me in order to purloin your data. Every time you use ID.me, check the URL and security padlock icon (the one that Paper Mommy thinks it looks like a purse), and make sure you’re on the real website before typing any personal information.

LOGIN.GOV

Login.gov is a secure, single sign-on service managed by the U.S. General Services Administration, an independent federal agency.

Login.gov allows you to use one username, password, and multi-factor authentication (MFA) method to access participating federal and state government websites. Unlike ID.me, Login.gov is only for accessing government sites, not retail shops or other types of sites.

How to Create Your Login.gov Account

In addition to all the same bulleted items (above) that you would need to set up an ID.me account, Login.gov also requires that you have a US-based telephone number on a plan that’s in your name.

So, if you’re on a family account that doesn’t list your name or your cell phone is owned by your employer, that can be a sticking point, which is why some people prefer ID.me.

Signing up for Login.gov works much the same way as ID.me, although in addition to using the same standard personal information and matching your ID to a photo or doing video check, Login.gov also matches your identity to your credit history and checks government databases.

There’s one more twist. If any part of the verification process for matching your selfie to your face via Login.gov is problematic, you can go to a United States Post Office location in person, smile that 1000-watt smile of yours, and prove your identity to a human being in order to complete the process.

 

Your Login.gov credentials will allow you to access many of the same government websites as ID.me, including the IRS, the U.S. Department of the Treasury, and the VA, as well as various sites in the Trusted Traveler Programs (like TSA PreCheck application management, Global Entry, NEXUS, SENTRI, and FAST).

SO, WHAT’S ARE THE DIFFERENCES BETWEEN ID.me AND LOGIN.GOV

Login.gov and ID.me are both official secure single sign-on services used by the United States government to access official websites. So, you may be wondering, what are the differences between Login.gov and ID.me?

The main differences are that Login.gov was built and is managed by the federal government to access only government sites, while ID.me is run by a private company that also contracts with private businesses.

Both meet strict federal security rules, but they handle setup and verification differently. 

As mentioned, ID.me requires uploading photos of your ID, like a driver’s license or passport, and uses biometric checks like a selfie scan via your device’s webcam or a live video chat with a support agent.

Login.gov is similar in that it uses the same personal information, and biometric scans, but also digs into what the government already knows about you (whatever is in those sneaky government databases and credit bureaus) to check you out. And again, you’ve got an out if your selfie skills are abysmal — just head to the post office.

So, which should you choose?

The answer may be you-specific, or situation-specific.

ID.me is the more flexible choice if you are currently living outside of the United States, don’t have a Social Security number, don’t have a phone plan in your own name, or need specialized verification via video call.

Additionally, ID.me is often required for specific tasks, like if you want to use the IRS tool to get an Identity Protection PIN. 

And if you fit one of those special identity/status categories as a current member of the military or veteran nurse (or other medical professional), first responder, teacher, student, government employee, you may want to use ID.me’s Shop to get discounts. (That said, always shop around to make sure that the price of what you’re buying can’t be found for less elsewhere.)

However, there are times when Login.gov might be better. If you’d prefer to avoid facial recognition software or biometric uploads and would rather visit your local post office, Login.gov might be your cup of tea.

 

But guess what? You might not have to choose. Assuming you live in the U.S., have a Social Security number and U.S.-based phone in your own name, there’s no reason (aside from annoyance at having to use either one at all), that you can’t sign up for both.

But in all likelihood, you will eventually have to sign up for at least one, as an increasing number of government agencies are requiring one of these two forms of identity validation. 

SEE ID.ME AND LOGIN.GOV AT WORK

So, let’s say you want to create your brand-spanking-new online Social Security account.

Before 2026, you’d go to SSA.gov and answer a long list of questions about your childhood addresses, cars you used to own, and financial information in your name, just to prove your identity. 

Now, when you click to log in, the site will prompt you to either sign in or create an account with either ID.me or Login.gov. You select which you plan to use and then follow the prompts for whichever you choose. For example, ID.me: 

  

or Login.gov:

 
Once your account is set up, on future visits, you’ll be able to log in by choosing either “Sign in with ID.me” or “Sign in with Login.gov” from the Social Security website and authenticating your identity with your selected MFA method.

It works the same way with any other site (governmental or otherwise) that prompts you to use one of these verification systems.

HOW ABOUT CANADALOGIN, EH?

Are you reading Paper Doll from above the 49th parallel? Welcome, Canadian readers! Did you know that you will soon have your own, nifty single sign-on and identify verification program similar to ID.me and Login.gov?

CanadaLogin provides a simple, reliable, and secure way for Canadians (and those residing in Canada or needing to avail themselves of Canadian governmental agency services) to sign in to the websites for various programs and services of the Canadian government.

It’s designed to “prioritize security, convenience, and usability.” As such, it’s not just a matter of being able to verify identity, but make it easier for people to access the 270+ online services offered by the government of Canada. (And remember, Canada is bilingual! Everything has to be available in English and French!) Apparently, there are more than 60 different access points for these services. So, Canada is moving toward streamlining everything!

Eventually, all Government of Canada online services will connect to a single entry point through CanadaLogin. This will eliminate the need to remember (or even have) a bazillion sets of login credentials. (Paper Doll apologizes for not knowing if there is a metric conversion for bazillion.)

So far, users can only start setting up CanadaLogin credentials with two-step verification through one of three MFA methods:

  • a one time code sent as a text message or by voice call,
  • a passkey, or
  • a security key

Soon, though, CanadaLogin will start adding more kinds of 2FA/MFA methods and other ways to log in and recover login credentials, including through Interac sign-in partners. For readers unfamiliar with Interac, here’s a cheatsheet:

 

And eventually, Canadians will be getting the same kinds of secure, online identity confirmation options as Login.gov and ID.me, but likely with a charming, polite, Canadian approach.

Currently, Canadians do have access to a mix of identity verification options, including eID-Me, an encrypted digital ID on one’s cell phone. It offers a secure digital wallet, almost-instantaneous identity verification, password-free logins, and high security and privacy. To register for eID-Me, you need a valid Canadian or U.S. passport as well as a Canadian driver’s license or photo ID card.

Canadian residents can also get verified to access identity/status-based (first responders, teachers, etc.) Canadian Shop ID.me discounts. 

THE FUTURE OF IDENTITY VERIFICATION

The first post in this series looked at the question, “How do I prove something (an account) is mine?” and found solutions in developing passwords, passphrases, passkeys, etc.

The second post examined, “How do I manage it all security to keep organized and productive?” 

And today, we’re answering, “How do I prove that I am who I say I am?” so that, again, we can productively access our online stuff.

It’s not going to stop here. 

Just last week, I was asked by the brokerage company for my IRA to set up a digital voice print identifier so that when I call in, there will be an additional level of security. 

On the one hand, the process was easy and interesting. I was asked to stand in the middle of a room and turn 360° as I described various things I could see in a long and rambling discourse. (Paper Doll is very good at delivering a long and rambling discourse.)

On the other hand, given what I’ve learned about AI and the ability to spoof our voices and our faces for scams, I can’t say I’m comforted. Of course, when fingerprint identification for phones came out, I have to admit I was a little queasy, imagining thieves stealing iPhones and cutting off people’s fingers, and as far as I know, that never came to pass.

The only thing we know for sure about the future of login credentials, identity verification, management of all of it is that it will continue to evolve, which means we will have to keep monitoring the changes to protect our identities and access credentials with more and more care. Our ability to stay productive online will depend on embracing these methods, even while familiarizing ourselves with the methods will initially slow us down. ‘Twas ever thus.

Do you already have accounts with ID.met or Login.gov? Do you have a preference?

Posted on: July 20th, 2026 by Julie Bestry | 13 Comments

Last week, in Not Your Mama’s Passwords: Passphrases, Passkeys, and the Future of Logging In, we saw how much has changed since we all made our first online passwords. Now, creating a strong password requires more characters, more variety, and more possibilities for making them secure, memorable, and useful. We also looked at passkeys, those secure digital handshakes that are even more powerful than passwords, and we got a greater understanding of what goes into multi-factor authentication.

So now we’ve got these big, strong, hunky passwords, passphrases, and passkeys, what do we do with them once they’re created? Organize them, of course!

HOW SHOULD YOU ORGANIZE YOUR PASSWORDS?

Having something and not being able to find it is just as bad as never having had it in the first place.

Have you ever lost or forgotten a password you really needed?

 

So, let’s start with a different question: how shouldn’t you organize your passwords?

  • Don’t count on your memory! — When a password is first created, everyone thinks they’ll remember it, but time and disuse (as well as stress) can make the memory of a password foggy. One too many half-remembered attempts can lock you out altogether.
  • Don’t re-use the same password for everything in order to lessen the likelihood that you’ll forget. — As we saw last week, a re-used password is an invitation to ne’er-do-wells.
  • Don’t leave passwords on sticky notes around your desk for others to see (or for tiny humans or furry friends to accidentally carry off) — The security of where you keep your passwords can be just as important as the security around their creation.

The main ways to organize your passwords are either analog or digital.

ANALOG PASSWORD MANAGEMENT

You can use a password notebook or even an address book to log your passwords as you create them, alphabetically by the website’s name or URL.

A simple, nondescript option can hide in plain sight. For example, this faux leather, hardcover Clever Fox Password Spiral Book with alphabetical tabs, measures 4.7″ x 5.7″ and comes in more than a dozen colors. There’s a pocket for loose notes and an elastic band to keep it from accidentally opening to view.

Each entry block has spaces for the website/URL, user name, password, and a hints or clues.

Importantly, the cover (once the label is removed) does not betray the contents and the average onlooker would likely mistake it for a journal. This one costs about $15 at Amazon.

There are a variety of similar options. What you really don’t want is a novelty version with a cute phrase or design that lets on that it contains passwords.

Even if you normally only used a password notebook at home, the minute you need or want your passwords to be as portable as your phone (such as when you’re traveling), if your notebook can’t go incognito, the information within will be at risk. 

Advantages of an Analog Password Notebook

The main advantage of a notebook for storing and organizing your login credentials is that you already know how to use one.

Every time you create a new password, you just reach for your password notebook and write it down. You don’t need any technical skills, just diligence. 

Disadvantages of an Analog Password Notebook

And there’s the first drawback. It requires diligence. How often have you been prompted to make a new password while in a hurry? You think you’ll remember it and do nothing, or you write it on the nearest piece of paper. Either way, you’ve got trouble.

There are other drawbacks of a tangible, analog password notebook:

  • It has no backup — If you lose your password notebook, spill coffee on it, drop it down a subway grate, leave it on the hood of your car as you drive away, or otherwise destroy it, you’re stuck clicking “forgot my password” for the next several months (or years) until you recreate every password for every site you visit. Worse, if you’re traveling, not being able to log into your accounts to access reservations or financial sites could put a serious crimp in your plans.
  • It’s not secure — If you do lose your password book (or if it’s stolen), someone has access to your entire financial and personal life. It’s not that big deal if someone logs into your Netflix account, watches to their heart’s content, and messes up your algorithm. But if someone can log into your bank, investment, and shopping accounts (especially the ones in which you have a credit card on file), you’ll be in a world of hurt.
  • It’s not really searchable — Yes, you can use the alphabetical tabs, in general, so Apple and Amazon will stay in the A’s, but you don’t live your life in alphabetical order. You don’t encounter websites in alphabetical order, either, so whatever you add later will be out of order, making it harder to find what you seek.
  • It runs out of space — Password notebooks have limited pages, so when you run out, you’ll  need a second (and then a third) notebook. The additional cost of one notebook every several years isn’t a huge barrier, but not knowing whether the right password is in the first book or the second (and so on) is inconvenient, and again, having to take two notebooks any time you travel from home or office doubles your chances of loss.
  • It’s hard to keep organized when you need to update passwords — You should update passwords every so often; some sites require it. The problem? If you use a pen, you need to cross out the prior password and squish the new password into the space. If you’ve run out of space in that entry, you could cross everything out and write the login credentials in a different entry box, but now you’re not only going to be out of alphabetical order, but if you don’t do a good enough job crossing out the old information, you may someday stop at the first entry and think it’s valid. (If you use pencil instead of pen, you may struggle with legibility, and eventually, with erasing a hole through the paper!)

You could create a spreadsheet with all of this information to make it digital, adding lines and then using the sorting function to keep the websites/apps in alphabetical order. However, printing the document (which may get unwieldy the more passwords you add) yields the same problems regarding security.

I won’t tell you that an analog password notebook is never a good choice. Some seniors and many people averse to technology will find it easier to commit to using an analog tool.

While it’s better than no system at all, an analog password notebook lacks the nuance and robust resources of a digital version.

DIGITAL PASSWORD MANAGEMENT

A digital password manager is simply a piece of software; on your mobile device, it works as an app. On your computer, it’s a free-standing program that generally integrates with your web browser. Its job is to sit and wait until you need to create or access login credentials.

Advantages of Digital Password Managers

There are more advantages to digital password managers than most people realize. A modern, sophisticated password manager can:

  • Remember thousands of passwords so that you don’t need to do it.
  • Generate strong, unique passwords automatically — Most can generate options based on the requirements of the site for which you’re creating a password and your preferences.

So, if BlahBlah.com requires 16 characters, capital and lowercase letters, a number, a special symbol, and a dash of fairy dust, but you also prefer passwords that don’t include capital “I” or lowercase “l” because they look the same to you (just in case you ever need to actually read the password), you can make an adjustment.

If you tell it to generate a password with all of the site requirements, but you want it to look more like a passphrase, not only can a digital password manager do so, but if one of the words reminds you of a horrible ex-boyfriend, you can “regenerate” the password with a click of an on-screen button. Next!

But digital password managers can do so much more, like:

  • Store more than just passwords, including passkeys, Wi-Fi credentials, credit cards, secure notes, software license keys, recovery codes, and passport/ID information.
  • Warn you of weak, re-used, or compromised passwords (as we discussed last week).
  • Prevent the reuse of passwords across multiple websites and apps during the creation/generation stage.
  • Auto-fill usernames, passwords, passkeys, and payment information so you can minimize the time you spend typing and optimize your productivity.
  • Sync securely across all of your digital devices, including computers, phones, and tablets.
  • Provide safe sharing capabilities with spouses, family members, co-workers, or trusted advisors. 
  • Save time by reducing password re-sets due to lost or misread passwords.

In summary, digital password manager can organize your digital life by helping you create, maintain, and access your login credentials (and more) in one secure, searchable system across all of your devices.

Disadvantages of Digital Password Managers

I’m not going to tell you that digital password management is perfect. As with any system, there are some demerits and hiccups, and each person has to weigh the costs and benefits. The imperfections of digital password managers can include:

  • Learning curves — If you’re constantly online, this is barely a blip; you’ll either intuit or learn whatever you need to in order to start using it immediately. However, for folks who find computers and mobile devices a source of frustration, the concept of digital management, if not any one password manager’s functions, may cause more annoyance than it helps.
  • Temporary inconvenience — While creating/entering new passwords is easy, importing all of your passwords from a different digital password manager or from analog lists may not be instantaneous.
  • Single point of failure — Digital password managers depend on a master password, known only to you. There’s no clickable “forgot my password” for the key to your keys, and though there are recovery methods, you actually have to put them in place for them to be available. Without your master password or recovery methods arranged, it’ll be difficult or impossible to access your vault.
  • Browser auto-fill isn’t always 100% successful — Every once in a while, particularly on mobile, you may encounter a situation where you have to manually copy-and-paste (or view-and-type) your username and password from the digital password manager into the website login section.
  • Cost — While most digital password managers have free tiers, you will likely have to pay for all the bells and whistles. 
  • Subscription fatigue — Most software-as-a-service entities have moved from one-time payments to subscription models. If you’re the type of person who wants to pay once and never again, this may be a mindset hurdle.
  • Trust — You’re giving the keys to the kingdom to a piece of software. When you’re trusting a third party with all of your highly sensitive information, it’s vital that you choose a reputable company whose security is undeniable.

While any/all of these can be drawbacks, they are almost certainly outweighed by the advantages of digital password management.

THE MOST POPULAR DIGITAL PASSWORD MANAGERS

You have a variety of choices when it comes to digital password management.

Built-In Password Managers

Let’s start with the digital password managers you already have.

Apple Passwords (Part of iCloud Keychain)

Apple’s Passwords is built in to all Apple devices, interacting with iOS apps, Mac apps, and the Safari browser. I’m a fan, especially because it’s free and works like a charm, but I’m the first to admit it’s not feature-full in the way many third party apps are. 

Contrary to popular belief, Passwords can work in Chrome and on Windows computers, but it’s not turnkey. You have to download the official Apple extension to sync your passwords and autofill logins.

You’ll still need an Apple ID to authenticate yourself with a verification code when you set it up. 

Google Password Manager

Google Password Manager is built in to the Chrome browser on all desktop and mobile platforms and every Android app.

One problem I’ve noticed is that it’s not uncommon to have more than one Google identity, and that can cause frustration. If you created a Google account in 1999 and built a life for yourself as ILikePuppies1959@gmail.com, but created ProfessionalLeader@gmail.com in 2010, you may have different accounts linked to each Google identity.

You may use Chrome and want to log in to Website A, only to find that Google Password Manager’s login for Website A is associated with your other Google account. On the plus side, Google won’t make you log out; just click on your little avatar and log in as the appropriate profile. 

Third-Party Digital Password Managers

One benefit of a third-party digital password over a built-in one is easier cross-platform compatibility without dealing with QR codes or fiddly Apple vs. Android/PC fussing.

But the truth is, every digital password manager, including the ones from Apple and Google, have trade-offs: personal aesthetic preference, user user convenience, cost, styles and methods of security protections, backup/synchronization and preferred features.

Bitwarden

Bitwarden has a very generous free plan, making it a budget-friendly option. The Personal Premium plan is $19.80/year and includes premium features like an integrated authenticator, secure password and file attachment sharing, emergency access for trusted contacts, security reports, and the ability to share vault items with one other user. Families get up to six premium accounts, unlimited sharing, unlimited collections, and a shared vault for $47.88/year. 

Bitwarden is open source, so anything you do decide to pay goes toward further development and not lining the pockets of evil billionaires.

Some users feel the interface isn’t as polished as some of its competitors, and that the family and sharing tools aren’t always intuitive. Additionally, there are complaints that if you update a password, it may create a new entry instead of modifying a pre-existing one, leaving both the correct and outdated passwords in place.) 

1Password

1Password has a 14-day free trial, after which it’s $36/year for individuals and about $60/year for families, with additional team, business, and enterprise-level plans. 

1Password is beloved for it’s easy-to-use interface, family and shared-vault features, and a security dashboard that alerts you to weak and reused, and monitors the dark web for compromised passwords. It autofills logins across mobile apps and browsers with biometric unlock via fingerprint, face, or iris. 

One standout feature is Quick Access, which can be used to search for anything you’ve saved in 1Password, including medical records and software license keys. Quick Access automatically identifies the app or website you have open and suggests relevant items from your vaults, providing a fast and convenient way to sign in to your accounts. 

Unfortunately, there’s no free version and it’s slightly more expensive than its (un-discounted) competitors. (Also, while the software is user-friendly, the website a bit intimidating.)

Proton Pass

Proton Pass has a strong privacy focus and is part of the Proton ecosystem. Like Bitwarden, it’s open source.

On top of the basic password generator, the feature-rich free plan works in the browser, on mobile, and in desktop apps, and includes unlimited logins, notes and credit cards, unlimited devices, 10 hide-my-email aliases, passkey support, alerts for weak and reused passwords, and an easy password import function. 
 
Pass Plus, at $2.99/month or $35.88/year, also includes unlimited hide-my-email aliases, a built-in 2FA authenticator, secure vault and link sharing, dark web monitoring, file attachments, emergency access for trusted contacts, a custom domain and additional inboxes for aliases, and command-line interface. Pass Family is $59.88/year includes everything in Pass Plus for up to 6 accounts, plus an admin panel for your family. There’s also Proton Unlimited, which gives you Proton Pass, Proton Mail, Proton Calendar, Proton VPN, and Proton Drive, all for $119.88/year.

Keeper

Keeper is one of the more expensive options at $42.99/year for a personal plan with unlimited storage, sync, and devices, unlimited identity and payment storage, fingerprint and FaceID login, web app and browser storage, and 24/7 support.

A family plan is $91.99/year for up to five users, providing the same features as a personal plan, plus shared passwords for WiFi and streaming services, unlimited shared folders, records and permissions, 10GB  of secure file storage, and emergency access for estate planning. (Note: family members cannot access each other’s vaults.) In addition, there are also student plans at 50% off, and personal and family military plans with separate pricing options.

Keeper has a strong security reputation and rich business features, but a regular plan does not include dark web monitoring or secure storage, which require add-ons at extra cost.

For casual users, Keeper can be a little feature-heavy.

Dashlane

Dashlane has a very polished interface and is beginner-friendly, but it no longer offers a free plan (though there is a 14-day free trial). The usual Premium price is about $65/year, though a current 40% discount brings it to $39.12/year.

In addition to unlimited devices, dark web monitoring, and the usual password generation and monitoring tools, the Premium plan includes passwordless instant login (without typing), securely shared access, a built-in virtual private network (VPN) for when you’re on public Wi-Fi, and live AI-powered scam protection. 

The Friends & Family plan covers 10 users and has a family dashboard.

NordPass

NordPass, from the makers of NordVPN, starts with a free lifetime plan with essential features like password generation, autosave, autofill, biometric/MFA access, password import capability, secure storage, and 24/7 support, but if you want access on multiple devices, a password health dashboard, a data breach scanner, file attachments, and the NordPass authenticator, you’ll have to upgrade to Premium (usually $35.88/year, but currently $19.08/year for the first 12 months, a 46% savings).

The “Family” Plan (good for friends and family) has all of the same features as premium for up to six users for $35.88/year (usually $71.88). Both the Premium and Family plans have a 30-day money back guarantee and both 1- and 2-year plans.

Other well-known options like Roboform and Aura may be worthy of your consideration, too. This post was a survey of options, not recommendations.

Fancy Words: Zero Knowledge Architecture and Encryption

Digital password manager marketers talk about these two features.

Zero knowledge architecture means that your data is encrypted and decrypted exclusively on your local device, ensuring only you can access it. But guess what? All six of these third-party password managers has it, as should every leading password manager. But because these companies can’t access your information, it’s vital that you always know and remember (and never re-use) your master password!

Oh, and encryption? They all tout having AES-256 encryption, except for NordPass, which uses XChaCha20 (yes, I’m serious) encryption, which is a newer, highly regarded encryption algorithm.

Essential Digital Password Manager Features

  • Intuitive user interface — Because if you don’t get it, you won’t use it.
  • Strong encryption — Duh!
  • Multi-factor (including biometric) authentication for your vault/master login
  • Strong password generation according to your specifications
  • Passkey support
  • Cross platform support — If it doesn’t sync across all of your devices, something is going to fall through the cracks.
  • Browser extension for auto-fill, so the minute a login screen pops up, your browser should detect the need for credentials and fill them in, awaiting only your approval by click.
  • Easy search and organization tools
  • Mobile app
  • Secure backup and recovery options
  • Import/Export Tools — Because the last thing you need is for your passwords to be spread across multiple digital password managers

Bonus Features

  • Security alerts and/or a password health dashboard for compromised or reused passwords
  • Secure sharing capabilities to let family members (or team members at work)
  • Emergency access login for trusted contacts
  • Secure notes
  • Document storage with high (or no) limits
  • Dark web monitoring
  • VPN included in subscription
  • 24/7 Customer Support

And of course, consider the costs — look for a free trial (or better yet, a free tier) to make sure you find it intuitive. Whatever you pick, don’t just think in terms of a monthly cost, but also the annual cost and total cost over a “lifetime” of  use. 

A digital password manager means that you no longer have hundreds of login credentials and related information on sticky notes and in notebooks, un-synced browsers, and spreadsheets. And definitely not in your memory.

Instead, everything can live in one organized, searchable, encrypted repository.

Keep Your Digital Password Managers Organized and Maintained

As discussed last week, dealing with the backlog of weak, compromised, and reused passwords will take a while. Once all your strong passwords are migrated into your new system, block time to periodically check (and update) compromised passwords and delete outdated, unnecessary ones.

MORE RESOURCES

For more on helping you select a digital password manager, try these resources. 

Cyb3R_Sm@rT!: Use a Password Manager to Create and “Remember” Strong Passwords (CISA.gov)

Trusting the Tech: Using Password Managers and Passkeys to Help You Stay Secure Online (National Cyber Security Centre, UK)

The Best Password Managers of 2026 (Security.org)

The Best Password Managers for 2026 (PC Magazine)

Best Password Managers for Android 2026 (ZDNet)

The Best Password Managers (Wirecutter)

Just don’t let analysis paralysis keep you from getting started. Any reputable password manager that you use consistently will improve your security more than whatever you were doing before.


In the first post in this series, we focused on creating better passwords and passphrases, because what made a good login credential in 1997 (or even 2017) just doesn’t work today.

Today, we looked at password management systems for these new and improved security credentials.

Next time, we’ll examine how we prove who we are online with the new digital identity platforms increasingly used by federal governments.

Posted on: July 13th, 2026 by Julie Bestry | 12 Comments

Those of us of a certain age remember the first time we had to create a password, and for many years, lots of people used the same password for everything. As we edged from the 20th century into the 21st, we got “smart” about using smart passwords so they’d be harder to crack.

This short video from comedian Michael McIntyre may reflect your early password experiences.

 

Have you found that it’s become even more frustrating in recent years?

You don’t just need a password. There are passwords, passkeys, two-factor authentication, multi-factor authentication, facial and thumbprint recognition, and so much more. You may think you know everything there is to know about passwords; but even if you do, are you actually doing what you know you ought? And are there people in your life (like teens, grandparents, or technophobes) who could use a little support?

Today, we’re going to look at all the things you need to know and the various actions to consider taking to make sure your vital data is organized, safe, and protected.

Let’s start with the classic, the good old password.

HOW TO MAKE A GOOD PASSWORD

Do you know what makes up a solid password?

A Good Password is Strong

A good password is a strong password, one with serious muscle, one that’s hard to break or crack. The experts say that a strong password should have the following characteristics

  • Sufficient Length — A strong password should be 16 characters. (I remember fondly when they asked for eight; then 12 characters were recommended. Sigh.) The shorter your password, the chance of a hacker figuring it out increases exponentially.
  • Complex Makeup — Generally, it’s recommended that a strong password should be a mix of both uppercase and lowercase letters, numbers, and symbols that you can type from the keyboard. (Don’t use emoji.)
  • Randomization — It’s a lot harder to guess 1dK5d8P91e65nNwf82et than PaperDoll123456. 
  • Uniqueness — Never reuse passwords across different accounts. Yeah, I know. We are all guilty of it, but the easier it is for a bad guy to hack one of your passwords, the easier it is to get into your others. If you must re-use passwords, aim to only do so on with sites that have no real impact on your life. 

The problem with this recipe for strong passwords is that we are human. We’re lazy. We don’t want to keep creating new passwords. And complex, random passwords are hard to remember. But do you know what’s harder? Dealing with a hacked bank, investment, or Amazon account.

Instead of creating a random block of letters, numbers, and characters, you can keep the randomization but make the password a little easier to remember.

via GIPHY

Create a Passphrase Instead of a Password

Instead of one block of letters or numbers, develop a sequence of unrelated words.

For example, WinterWonderland, while possessing 16 characters, would not be a great passphrase because the words are thematically related. GrotesqueBroccoli, while reflecting my feelings about a particular vegetable, aren’t commonly used together. Even better would be something even longer, more bizarre, and unrelated, like YuckySweaterRodentNoise.

One advantage of a passphrase is that if you’re hand-copying it (from a password notebook, or typing on a computer but retrieving it from an app on your phone), it’s much easier to see and parse a string of words than il7-0oO-nmn-MWN, especially if you’ve got eyes that were in their prime in the 1980s. 

Think about the characters you choose.

The above example prompts a tip that the experts never mention. Because various letters and numbers, like a capital “I” (as in “I am”) and a lowercase “l” (as in “login”) are indistinguishable from one another in some fonts, as can be the number 1 and an exclamation point.

Capital “O” (as in “order”) and “0” (zero) can be confused for one another, and some lowercase letters, like “r,” “n,” and “m,” and uppercase letters like “M,” “N,” and “W” can also be hard to differentiate. 

Avoid predictable password information.

First, don’t use common dictionary words like “password” or keyboard sequences like qwertyiop. Duh!

Similarly, don’t use your personal information. Your password shouldn’t have your birthdate, phone numbers associated with you, names of your pets or the street on which you live.

If you need to be able to remember a password and won’t be safeguarding it in a digital password manager, an alternative method might be to pick information that’s personal to someone unassociated with you. Everyone knows I’m a fan of Jane Austen, so someone trying to hack me would find it easy to pick obvious things like Pemberley or Rosings, but if you have a favorite book or movie character that wouldn’t be easy for someone on the internet (or an evil ex) to suss out, consider stealing their fictional personal information.

Consider combining the above tips with a foreign language.

While I am only fluent in English, I have studied Italian, French, and Spanish, and know a smattering of Yiddish. Picking words from another language to come up with a lengthy but easy-to-read/remember passphrase might help you more easily read and remember it to safeguard access to your data.

Let a digital password manager do the heavy lifting for you.

Often, you can designate the features you want, so that if it needs (or you want) the number of characters to be even more than 16, or you prefer a readable passphrase over one with garbled numbers and letters, it will accomplish that for you.

Hacker Reality Check

The longer and more complex your passwords, the harder it will be to crack them. Hive Systems annually creates a table of the characteristics that increase your chances at organizing and preserving your dat privacy. Here’s their most recent table.

Courtesy of Hive Systems

This table confirms what we know: “Fluffy” and “123cookie” just aren’t going to cut it.

HOW TO FIX THE PROBLEMATIC PASSWORDS YOU ALREADY HAVE

If you have a digital password manager, it may prompt you with warnings regarding some of your passwords because they are:

  • Weak — Such passwords are likely not long, complex, or random enough to be effective.
  • Compromised — This status indicates that passwords have shown up on the dark web in a hack, likely one of a large corporation, like a retailer or insurance system (like the Change Healthcare cyberattack in 2024).
  • Reused — An internal scan of passwords shows your app that you’ve used the same password repeatedly.

While working with a client recently, we saw that her iPhone’s Passwords app listed 610 passwords with a scary exclamation point on a red background indicating that 236 passwords had a security concern. Of those, about 122 were shouting “COMPROMISED PASSWORD” in red letters, with another 100 or so listed as “reused password.”

(Again, it’s not a huge problem to reuse passwords solely for sites you’re merely using to gain access to articles; but if such a site allows comments on articles, would you want to risk a hacker making you look like a fool or scammer by commenting with your identity?)

Closing your eyes to this problem isn’t a solution. In this case, the only way out is through.

Schedule a date with yourself — perhaps weekly, to deal with the backlog, and then perhaps quarterly for maintenance — to address your password hygiene. Treat it the same way you do (or should do) to periodically update your operating system and apps, clean your desktop, pare down  your inbox, etc.

Again, consider letting a digital password manager create replacements for you. It will be faster and easier than trying to come up up with something unique for any/many of your passwords.

WHAT IS A PASSKEY AND WHY IS EVERY SITE ASKING ME FOR ONE?

Have you noticed in the last year or so that every time you log into a web site, it asks you if you want to set up a passkey? Are you ever prone to thinking, “I just logged in with my password. Isn’t that already a passkey? What’s the difference?”

A password is your super-secret word or phrase that you create and then memorize (or write down, somewhere). It’s like the secret password that might have gotten you into a speakeasy in the 1920s.

(Trust me, this is worth watching for a laugh, especially if this whole topic stresses you out.)

 

But there’s the problem. You, a flawed (but adorable, I’m sure) human, must come up with the secret password and then protect it. This makes it vulnerable — to memory loss, password loss, phishing, hacking, and data breaches.

A passkey is different. It’s an un-phishable digital credential that’s tied directly to your device. Instead of typing a word, phrase, or string of gobbledygook, you unlock your account through a handshake between your device and the website, usually through some kind of biometric scan on your device (like FaceID on your phone, or thumbprint/TouchID on your device or keyboard), or a device/screen PIN. If you’re already logged into your computer or phone, you may be all set!
 
Passkeys differ from passwords in several ways.

Passkeys Are More Secure than Passwords

With a password, you’re sharing a secret with the server for whatever site you’r trying to log into. The thing is, secrets like these get revealed or betrayed all the time, either on our side, by our faulty memories or poor record-keeping, or on the server’s side, by getting hacked. Either way, access to your account is either lost or exposed.

Passkeys, however, use what’s called public-key cryptography. That’s a fancy way of saying that rather than having one key (your password) that fits in a lock on the other side, it’s more like in an old movie, where they’d go into a bank vault and the customer and the banker would each have a key for the safe deposit box.

Your private key is always securely locked inside the security chip of your device, while only the public key, which is totally useless-to-hackers, is maintained by the website.

Passkeys are More Resistant to Phishing Attempts

Have you ever been tricked (or almost tricked) into typing your password into a fake website, one made to look like the one you really want? Passkeys link your login effort to only a legitimate app or website, so if you try to log in to a faked website, your device will say, “No way, José!” and refuse to authenticate.

No handshake. Do not pass GO, and the phishers will not get $200 dollars.

Passkeys Are More Convenient than Passwords

Aren’t you tired of having to REMEMBER passwords?

Aren’t you tired of typing passwords?

Well, with a passkey, you don’t have to. If you’re already logged in to your device, access feels like magic. If not, logging in is limited to a simple scan of your beautiful face or a tap of your finger or thumb. It’s quick, and your face or thumbprint can’t make a typo, so your success rate will be higher. 

Passkeys Are Unique

We’ve already established that people reuse their passwords, which means that if you reuse the same password on ten shopping sites and a hacker gets your password once, they can probably guess it on a lot of other major sites.

Conversely, each passkey gets generated uniquely for whatever individual account at which it’s being set up.

Passkeys Are Loss-Proof

If you lose your phone, get a new computer, or your toddler puts your iPad in the dishwasher, you’re not out of luck.

Passkeys are synced across cloud services, like your Google Password Manager or your iCloud Passwords app, so access can be restored by setting up a passkey to the new device.

Passkeys (Usually) Eliminate the Need for Multi-Factor Authentication

I don’t know about you, but I’m so tired of having to check my email and/or my phone for a email or text code that I then have to type in. With a passkey, two-factor authentication is built-in, so you’re all set.

Passkeys Bypass Password Fatigue 

Have you ever just given up and done something else because you can’t bear to type in another password? (If you have a digital password manager and your passwords are organized and frequently pruned, probably not, but if you’re go the analog route 100% of the time or you’ve let your password management go rogue, this may sound familiar.)

So, the next time a website asks, “Would you like to set up a passkey?” you can feel confident in saying, “Why yes, thank you. I would very much like to set up a passkey! How nice of you to ask.”

A NOTE ABOUT AUTHENTICATION AND DIGITAL IDENTITY PLATFORMS

In addition to passwords and passkeys, you may have found websites asking you to use additional forms of identity authentication.

Authentication

Do you cringe when you hear people talking about two-factor authentication? You know it has something to do with security, but maybe you’re having trouble wrapping your head around it? Just like you don’t need to know how to rebuild a carburetor to be a good driver, you only need to know a little to make this aspect of security feel accessible.

For example, you’re almost certainly used to providing a security code, usually a series of numbers, that gets sent as a text or email. 

This process is an example of two-factor authentication or multi-factor authentication. We’re not going to get too deeply into the weeds on this, but very basically:

  • Two-Factor Authentication (2FA) requires exactly two authentication steps, like using login credentials (a user name and password combo) plus that security code texted to you.
  • Multi-Factor Authentication (MFA) requires two or more authentication steps.

So, 2FA is a type of MFA, but not all MFA is 2FA. 

In order to classify a method as Two-Factor Authentication or Multi-Factor Authentication, the “factors” have to come from different categories. For example:

  • Knowledge — In order to log in, you have to provide something that you know, like a password, passphrase, code, or PIN, which means you have to keep your password information organized.
  • Possession — This step involves something that you have, like your mobile device, your computer, or a hardware security key. (Again, not to get too geeky, but that’s a physical device used for MFA or password-less logins. If you actually want to know more about hardware security keys, you can read PC Magazine’s The Best Hardware Security Keys for 2026.) The key proves your identity using advanced cryptography when you:
    • insert it into a USB port in your computer
    • tap it wirelessly via near-field communication (NFC) against your phone or tablet
    • connect via Bluetooth (for devices that don’t have USB ports or aren’t NFC-capable)
  • Inherence — This fancy word means something that you are, or that is inherent to you and nobody else. This is where FaceID or a fingerprint scan on your phone or your keyboard come in handy, because only you have your face or your fingerprints. Well, mostly. Per Apple, identical twins can sometimes unlock one another’s FaceID! 

Digital Identity Platforms

As technology gets more advanced, the bad guys avail themselves of more technology. This means that modern authentication needs to get more advanced, too. Just as the Michael McIntyre video of the top of the post made the point about our old-timey passwords requiring us to add capital letters, then numbers, then symbols, so too are we facing more complex requirements beyond simple passwords and multi-factor authentication.

Because of this, there’s a whole honking sub-category of authentication through digital identity platforms.

In two weeks, we will look at two very special kinds of login credentials we need to set up in the United States to help ease our access to federal government websites in order to pay our taxes, check our benefits, and travel. We’ll also look at a companion platform in Canada. But first…

COMING ATTRACTIONS

While long passwords are good, long blog posts on complex (and sometimes scary) technology topics are not. So, this week’s post is shorter than usual. (Really! It it’s 20% shorter!)

Next week, we’ll explore how to organize your passwords to make them accessible (to you) so you need never worry about forgetting them or making your kids crazy trying to figure them out.

 
We’ll cover:

  • Analog methods for tracking your passwords
  • The built-in digital password managers you already own
  • The most popular third-party digital password managers and what makes each stand out
  • The advantages and disadvantages of digital password managers
  • The key features every digital password manager should have — and some bonus features you might not know about

We’ll also explore how to safely share your passwords with family members and trusted advisors.

And the week after that, we’ll end July with the aforementioned look at those digital identity platforms, which I’ve come to think of as “the password for your passwords.”


Until next time, please feel free to share any unique tricks or strategies you have for creating passwords, and any thoughts you have about this strange world of passwords, passphrases, and passkeys.

How do you feel about your password security?