Password managers and passkeys: how to keep your logins secure
Every account needs its own long password. If you use the same password in more than one place, they're all open as soon as one leaks. Nobody can remember eighty different passwords. A password manager does that for you. Where possible, replace the password with a passkey, which fake sites can't misuse.
What a password manager does
- It creates a long, random password for every service: at least 15 characters, or a passphrase of five or six random words.
- It stores everything encrypted in a vault.
- It fills in the password on the right website, and only there.
- It often warns you about reused or leaked passwords, and can also store two-step verification codes and passkeys.
You only need to remember one: the master password of the vault.
Types
| Type | Advantage | Watch out |
|---|---|---|
| Built into your browser or phone | Already there and easy | Often no separate master password: anyone who gets into your computer gets to your passwords. Less suitable for different systems and for sharing. |
| Separate app with sync via the provider | Works on all your devices, with shared vaults for a team | You trust the provider; your master password must be strong |
| Local vault file on your own computer | Everything in your own hands | You take care of backup and sync yourself; sharing is harder |
Our advice: Proton Pass (a Swiss company with a generous free version) or 1Password with an account on 1password.eu (a Canadian company, paid and very easy). Both work on your Mac, your Windows PC, your phone and in all major browsers. Bitwarden is also good, but it's an American company: American law applies, even if your vault is stored in the EU. In the guide Password manager in practice we compare 23 password managers on ease of use, security and EU/GDPR, and you'll read step by step how to set up Proton Pass or 1Password.
When choosing, check: does it work on all your devices, can you share vaults and remove someone again, can you secure the vault with two-step verification, is there emergency access, and can you export your data if you want to switch?
The master password
- Make it a passphrase of five or six random words, chosen by the generator and not by you. Song lyrics or a proverb can be guessed.
- Use it nowhere else and only type it into the app or extension of the manager itself.
- Turn on two-step verification for the vault. That's no reason for a shorter master password: if the provider gets hacked, your master password is the only protection for your stolen vault.
- Forgetting it is often permanent, because the provider can't recover it. Write it down on paper, without noting what it's for, and keep it in a safe place at home, together with your manager's recovery code.
- Turn on automatic locking after a few minutes of inactivity.
rn and m. See Recognising phishing: how to read a link and a sender.Sharing in a team and emergency access
- Preferably give everyone their own account. If you do have to share a login, use a shared vault per topic and only give access to those who need it. Never share via email, chat or a spreadsheet.
- When someone leaves, remove them from the vault and change the passwords they could see.
- Arrange emergency access in case you're no longer around: many managers let a trusted person in after a waiting period. Or keep the recovery details in a sealed envelope with a second person.
Passkeys and security keys
A passkey replaces the password. It's a key pair: the secret part stays on your device or in your password manager, and the website only stores the public part. You unlock the passkey with your fingerprint, face or PIN; that happens on your own device.
- Doesn't work on a fake site. A passkey belongs to the real domain, and your browser checks that. On a lookalike there's no passkey, so there's nothing to fill in or approve by accident.
- Nothing to crack. If the website leaks, the attacker only gets public keys.
- A security key is a small device for the USB port or to hold against your phone, with passkeys that can't be taken off it. Always register at least two keys and keep the spare key in a different place.
- If your passkey is stored in a password manager or in your phone's account, it moves along to your other devices. So protect that account extra well.
- Often your password keeps working too. So keep it long and unique.
At WebOké
| Service | What's possible? |
|---|---|
| Nextcloud | You can sign in with a passkey or security key, under Passwordless Authentication. Your password and your other methods keep working. For apps you create an app password; store that in your manager too. See Setting up an authenticator app and storing backup codes. |
| My WebOké | No passkeys. After your password, My WebOké always asks for a login code by email (The login code by email), or a code from an authenticator app. There are no recovery codes: if you lose the app, please contact us. |
| DirectAdmin | Two-Step Authentication with an authenticator app and backup codes, see Setting up Two-Step Authentication. |
| Mailboxes | An email client signs in with the password. Give every mailbox its own long password from your manager. |
Read more about strong passwords in Secure passwords and what to do about a leaked password, and at the NCSC in How do I choose a password manager? and How do you choose an MFA method?
Want to learn more? Take the free course Safe online for entrepreneurs, lesson 2.2 Choosing and using password managers, or the free course Switching to a European cloud, lesson 7.4 Moving passwords to a password manager.