The passwords you should never save

Most of the details from our 2017 article have aged: the tools have changed, the advice from security experts has changed, and the product we suggested at the time has since been breached. One rule has held up, and it’s the one this article is about.

What getting hacked usually means

Hacking sounds like something out of a movie. In practice, it’s usually simple: someone logs in to one of your accounts as if they were you, using a password that leaked from another site, was guessed, or was typed into a fake login page. Then they use whatever the account gives them. They buy things with your saved card, move money out, cash in your points, or collect enough personal details to open accounts in your name.

Two things can go wrong

The worst case is a stranger getting into your email, your bank, or your government accounts. These are the accounts that unlock everything else. With your email, a stranger can reset the passwords to many of your other accounts. With your bank, they can take your money. With your government accounts, they get the personal details they need to pretend to be you.

The good news is that this has become harder. These services now notice when someone signs in from an unusual place or device and ask for more proof before letting them in.

The more likely problem is getting locked out yourself. Fewer services let you reset a forgotten password with just a link to your email. More of them want your second step: a code from your phone or an app. Some won’t let you sign in without it, even if you know your password. Lose your phone, change your number, or stop using an old email address, and recovering the account can mean days of identity checks, or losing it for good.

Good habits protect you from both. The easiest way to never get locked out is to save every login in one place. But that makes the worst case worse: one break-in would give a stranger everything, including your email and your bank.

The one rule

Never let your phone, browser, or password manager save the login for your email, your bank, or your government accounts.

When you sign in to one of those and your phone or password manager offers to save the password or a passkey, say no. Everything else can be saved. These few can’t.

Using your face or fingerprint to open your bank’s own app is different, and it’s fine. The bank’s app keeps that login on that one phone. It isn’t copied into the account that holds everything else, so someone who breaks into that account can’t use it.

If you do nothing else in this article, do this.

Assume something will be breached

It’s tempting to look for a service that can’t be hacked. There isn’t one. A better plan is to assume that one day something you use will be breached, and make sure you can recover when it happens.

LastPass is a good example. In 2017, it was one of the most popular password managers, and the one we recommended. In 2022, attackers stole copies of its customers’ password vaults. The vaults were encrypted, but many were protected by master passwords weak enough to be cracked, and the US Secret Service has since tied a $150 million cryptocurrency theft to a vault cracked from that breach.

People who had saved everything in LastPass had everything exposed. People who had kept their email and bank logins out of it only had to change the passwords to their less important accounts, and they could still get into their email to do it.

Every fix moves the weak spot

Each new security idea has been presented as the answer, and each one has moved the problem somewhere else rather than removing it:

• Complicated passwords were hard to remember, so they ended up on sticky notes and reused everywhere.
• Password managers solved that, but put every password behind one master password and one company.
• Text-message codes added a second step, until scammers learned to talk phone companies into moving a person’s number to a new SIM card.
• Passkeys, the newest idea, let you sign in with your face or fingerprint instead of a password. They’re convenient, but they sync through your Apple, Google, or password manager account. Whoever gets into that account gets every passkey in it, and if you lose access to that account, you lose them all.

None of this means these tools are bad, or that you made a mistake by using them. A password manager is genuinely better than reusing the same password everywhere. It just means no tool can make up for human mistakes. The weak spot is always people: the ones using the tools, and the ones building and running them. Keeping your most important logins somewhere separate is how you plan for that.

Match the protection to the account

You don’t need to treat every account like a bank vault. How careful to be depends on what a stranger could do with it. Start at the top of this list and go as far down as makes sense for you.

Accounts with no money, card, or personal details

This covers newsletters, forums, streaming services, and most apps. Keep them all in one password manager: passwords, passkeys, and two-step codes together. Let it create a different password for each one. If that one place is ever broken into, nothing in it can cost you money or your identity, so the convenience is worth it.

A separate place for notes

The first step up is a notes app from a different company than your password manager. Use it for hints that remind you of the passwords you don’t save, and for the recovery codes of your everyday accounts, so losing one doesn’t mean losing the other.

Email, bank, and government accounts

• Don’t save the login. That’s the one rule. Keep a hint in your notes instead.
• Turn on two-step login. If you’re offered a choice, an authenticator app is safer than text messages.
• Set a backup email and phone number, and keep them current. A spouse or family member is a good choice. A work address is fine while you work there, but update it before you leave. These are how you get back in when everything else fails, so check them once a year.

Only if what’s inside calls for it

Some people go further: a written list in a safe place, or a physical security key that plugs into a computer or taps a phone. These are real protections, but most people, us included, don’t use them for most accounts. Paper is also risky if you tend to misplace things, because a lost list is a lockout waiting to happen.

If you run a business

The same thinking applies, and the list of important accounts gets a little longer. Your business email, your bank, and the account where your domain name is registered all belong in the “never save” group. Make sure each of them is in the business’s name, with backup contacts that lead to people still with the business, not to a former employee or the person who set it up years ago.