Managing passwords is a reality of computer use, and doing so effectively can have a profound positive impact on protecting your privacy online and offline:
- Use strong (long and random) passwords. Strong passwords take more resources for an adversary to guess.
- Never reuse passwords between accounts. Unique passwords limit the impact if and when they are exposed through a security breach.
- Change your passwords periodically. Occasionally changing your passwords for important accounts limits the time frame in which a compromised account can be exploited.
Maintaining a list of unique, strong passwords in your mind alone is impractical. A password manager can help you securely maintain your password database. Strictly speaking, a notebook you keep containing a list of passwords can serve as a rudimentary password manager, but there is a variety of programs purpose built for not only storing passwords but also generating them and even automatically filling them on the web.
Aside from managing passwords themselves, using a password manager provides the additional benefit of keeping an up to date list of online accounts you maintain. You can review your list of accounts periodically and close those you no longer need to further mitigate risk of data exposure.
Securing Your Password Database
Password managers store their database in an encrypted format in order to mitigate the risk of leaking sensitive information to other people or programs. Your password database should be secured with a strong master password, which we recommend you create using diceware, since you’ll need to remember and type this password frequently in order to access your password database.
You may also have the option to use a second factor to secure your database such as a key file on your computer or a physical authenticator. These measures can be helpful depending on your threat model, but can increase the risk of losing your passwords (more factors needed to access your database that you can lose access to) and thus make data backup and recovery more complicated.
We don’t recommend copying your password database to devices you don’t control (including syncing to Dropbox or Google Drive) or to devices that are particularly vulnerable to loss or seizure, such as a mobile phone. For devices on which you don’t have access to your database, consider using diceware for easy-to-type passwords, or consider keeping only a subset of passwords in a separate database to be copied to those more vulnerable devices.
Choosing a Password Manager
We recommend using a free-software manager that is compatible with the standardized KeePass password database format (.kdbx). Doing so gives you the freedom to use your database with different programs on different operating systems or to exchange one password manager for another without having to manually transfer passwords over.
Avoid non-free managers. Proprietary password managers whose source code isn’t made available to you cannot make any (practically) verifiable claims about security. Fortunately, there are many high quality free alternatives to choose from.
Avoid online password services. Various companies offer convenient password management SaaSS products, but like proprietary software, these subscription services take control away from you and place it in their operators’ hands instead. Why rely on a middleman that can hold your passwords hostage unless you pay up?
KeePassXC
KeePass-compatible password manager for desktop
Secrets
KeePass-compatible password manager for GNOME desktop