FREE NEWSLETTER
MANY OF US HAVE little more than a weak, reused password standing between our financial assets and a remote attacker—one armed with powerful tools and a database of passwords from security breaches. This is a losing battle. It’s the most likely way for weak computer security to put our finances at risk.
Think this can’t happen to you? I’ll bet you have at least one password taken in a big security breach. A quick way to find out is entering your email address at Troy Hunt’s HaveIBeenPwned site. My address turns up in almost a dozen big cyberattacks.
We are notoriously bad at creating strong passwords and remembering them. When you decide to create stronger, unique passwords for each site, you quickly discover that managing dozens of randomly generated, site-specific passwords by hand is a headache.
Don’t fret. Password managers like LastPass, Dashlane and 1Password make short work of it. A password manager puts all your passwords in an encrypted vault, leaving you with just one password to remember. You want to make this password really strong and unforgettable. The password manager then fills in the right password for mobile apps and websites whenever you use them.
What can you expect from a good manager?
Some of these are only available in paid versions of the service.
Despite knowing better, I procrastinated in evaluating password managers. That changed the day I tried to picture life for my spouse after I leave this vale of tears. I visualized the chores I handle: Banking, bill paying and investment management all involve online accounts. That brought my password problem into focus. A list of passwords in a binder, next to our wills, isn’t secure and it’s a pain to keep up.
After experimenting with a free trial, I bought a family subscription. Moving my password vault from low-ranked to the top 1% took a couple of weekends. Each weekend, I’d spend an hour or two changing passwords, guided by the security challenge and with help from the password generator. Do this on your home PC or Mac, not an office computer.
I started with high-value accounts: email, cellular carrier, and then banks and brokerages. Why email? Most web sites let you reset a password by emailing a link to the address on file. If hackers have access to your inbox, they’ll use it to access every online account. The cellular account is also important if you’ve enabled two-factor authentication that triggers text messages with secure codes.
What if someone hacks into your password manager’s vault? If you pick a great vault password, the odds of this are low. But when you have all your eggs in one basket, you want to ensure that basket stays safe. That’s what led me to the YubiKey 5 series hardware keys.
When you use a YubiKey with a password manager, the manager encrypts your vault twice, once with your vault password and again with a secret it gets from the YubiKey. For convenience, I’m using two models of YubiKey. I use YubiKey 5 Nano with my PC and Mac. Meanwhile, YubiKey 5 NFC stays on my keyring for use with my phone. The latter should work with an iPhone 7 or newer, as well as an Android phone with NFC (near field communication).
David Powell has written software or led engineering teams for 35 years. He enjoys work, vegan fine dining, cycling and travel with his spouse. His previous article was Playing Defense.
Want to receive our weekly newsletter? Sign up now. How about our daily alert about the site's latest posts? Join the list.
This is one thing I’ve started to do at least five or six times. Every time I stop because it’s feeling overwhelmed.
You list three that you say make short work of it. Which of the three is the simplest to use.
Lastly, can a password manager be installed using my Android phone. I didn’t have a computer
LH, I have used Lastpass and Bitwarden, and found them to be virtually identical in terms of simplicity of use. I suspect all of the major brands are similar in terms of simplicity or complexity. I use Bitwarden currently, I found LastPass had troubles with some of the sites and browser combinations I use.
Yes, the major bands can be installed on an Android device.
Two notes related to simplicity and phones:
1) On a computer the password manager can be installed as a browser extension. This makes the password manager VERY easy to use as you are looking at a webpage login screen, it fills in the login with one click (it can also be installed as an app). On my android the password manager can only be installed as an app, separate from the browser I use. This means on the android, when looking at a login screen in a browser, there are the multiple steps (and clicking) of jumping back-and-forth from the password app (storing the username and password) to the browser window to copy the username and then the password from the password app to the browser window.
2) On a computer with the password manager installed as a browser extension, the manager “sees” you logging into a webpage and offers to store and remember the login if it is not in the manager yet. This is a very easy way to train the password manager, and slowly enter your usernames & passwords into it, as you are using them. On an android this does not happen. You would need to open the password app and use “add a Login” to then enter the site address, username, and password and save them in the password vault.
The effort of using a password manager is well worth the benefit. I also extensively use the “Notes” feature to store securely other private information I need to have handy to run my life.
I suggest you start with just ONE website that is not critical to you, such as a store you shop at. Practice there to get a feel for it.
https://www.nytimes.com/2026/05/13/technology/personaltech/passwords-managers-passkeys.html