A password manager: remember just one
Lesson 4 of 16 in the course “Cybersecurity from Scratch”. Free, with animations and a quiz.
How to remember 100 different passwords
You can’t, and you don’t need to. A password manager is an encrypted vault for passwords. You remember one long master password, and the manager makes up a random 20+ character password for each site, stores it and fills it in when you log in. The vault is encrypted on your device, so even the company that makes it can’t read your passwords.
Why not notes or a sticky note
Passwords in phone notes or screenshots are the first thing infostealers look for: programs that steal data from a device. A sticky note by the screen is visible to any guest and to your camera on a call. And passwords “in your head” almost always end up as one password for everything. A manager solves all three. Just protect it: a long phrase as the master password, plus 2FA.
Bonus: the manager catches phishing
A manager ties each password to the exact site address. On the real binance.com it offers to fill in your password. On binance-verify.com, which looks identical, it stays silent: it has no password for that address. A single letter can fool your eyes but not the manager. The rule: if the manager doesn’t offer a password on a familiar site, stop and check the address instead of typing the password by hand.
Which one to pick
If everything you own runs one system, the built-in one is enough: the Passwords app on iPhone and Mac, or Google Password Manager on Android and in Chrome. If your devices are mixed, a standalone one is handier: Bitwarden, 1Password, Proton Pass. Brainax doesn’t advertise any of these; they’re simply well-known options. Any of them is far better than one password for everything. The key: a long phrase as your master password and 2FA on the manager itself.
A one-evening plan
You don’t have to change 100 passwords at once. Install the manager on your phone and laptop and import the passwords already saved in your browser. Right away, set new random passwords for email, bank and exchange: they’re the keys to everything. Update other sites the next time you log in to them: the manager will offer to generate a new password itself. In a month Dan won’t have a single repeat left.
Check yourself
- Dan worries: “If the manager gets hacked, they get everything at once.” What’s the answer?
Correct answer: The vault is encrypted on the device, and with a long master password and 2FA it’s far safer than one password for everything. There’s always some risk, but compare it with the real alternative: one reused password already sitting in leaks. An encrypted vault with a strong phrase and 2FA is far safer. - Dan opened a “Binance” link from an email, and his password manager doesn’t offer to fill in the password. What does that mean?
Correct answer: Most likely the address is fake: close it and go to the exchange via the app or a bookmark. The manager compares the address exactly. Silence on a “familiar” site is one of the best phishing signals. - Which passwords should Dan move to the manager first?
Correct answer: Email, bank and exchange: new random passwords right away. Email resets everything else, and the bank and exchange hold the money. The rest can change gradually, on your next login.