LONDON (AP) — Everyone has too many passwords. The credentials we need to remember to navigate online life keep multiplying, not just for frequently used email, banking, social media, Netflix and Spotify logins, but also, say, the little-known e-commerce site you’re not sure you’ll buy from again.
According to some unscientific studies, the average person has hundreds of passwords. That’s a lot to keep track of. You might be tempted to recycle them, but it’s one of the bad password habits that cybersecurity experts warn against.
Instead, use a password manager. They’ve been around for a while and can be useful tools to keep on top of your credentials. But they can also be intimidating for those who aren’t tech-savvy.
Here’s a guide on how to use them:
Why should I use a password manager?
Many people just use the same password for all their online accounts, mainly because it’s the most convenient thing to do.
Don’t!
If your credentials are caught in a cyber breach, the hackers could try using the stolen passwords to get into other services.
Other no-nos: Using easily guessed information like birthdays, names of family members, favorite sports teams, or simple phrases like abc123.
The best strategy, experts say, is to use a different password for each account, the longer and more complex the better, backed up by two-factor authentication where possible.
But it’s impossible to remember all those various codes. So let a password manager do the job.
How does a password manager work?
The basic concept is simple: Your passwords are stored securely in a digital vault. When you need to access an online service, it auto-fills the login and password fields. The only thing you’ll need to remember is a single password to open the password manager.
Most password managers have a smartphone app that works with mobile browsers and other apps and can be opened with a thumbprint or facial ID scan. If you’re using a computer, you can also log in to your password vault through a browser plug-in or by going to a website.
A good password manager should also be able to generate complex passwords with letters, numbers and symbols, for whenever you’re setting up a new account. And it should also recognize that you’re signing into an online service for the first time and ask if you want to save the credentials you’ve entered.
Password managers can also help you avoid falling prey to phishing scams. Those deceptive emails from fraudsters trying to trick you into clicking a link to a phony website designed to harvest login details? A password manager won’t automatically fill in the details if the web address doesn’t match the one linked to the saved password.
They don’t just store passwords. You can save bank and credit card PINs, for example. Many also support passkeys, a new technology that companies like Google have been rolling out as a safer alternative to passwords.
How do I choose the best one to use?
But are they secure?
Cybersecurity worries around password managers flared up after one service, Lastpass, reported a security breach, leading experts to recommend avoiding it.
Don’t let that put you off. For one thing, experts advise that saving credentials in a password manager is much safer than letting, for example, e-commerce sites do it.
Good password managers use strong encryption that prevents anyone else from seeing your data.
Many services use AES-256 encryption, which is considered the most secure type “and impossible to be brute-forced by today’s technology,” said Pieter Arntz, senior malware intelligence researcher at cybersecurity company Malwarebytes.
Strong encryption “ensures that even if your computer or your password manager is compromised, the attacker cannot simply read all your passwords, because they are stored encoded and the attacker will need the master password to decode them,” Arntz said.
A good password manager should also hold regular security audits and inform users quickly if there’s a breach.
Many services store data in the cloud. If you’re worried about that, some let you store them only on your local device, but it can be a complicated process.
___
Is there a tech challenge you need help figuring out? Write to us at [email protected] with your questions.
