Password Managers and Passkeys: A Practical Setup

Reused passwords are how most accounts are lost. A password manager fixes that, and passkeys remove the password altogether where they are supported.

The actual risk

When one site is breached, attackers try the leaked email and password on every other site. If you reuse passwords, one breach opens many accounts.

What a password manager does

It generates a long random password for each site, stores them encrypted, and fills them in for you. You remember one strong master password. An overview is in Wikipedia's article on password managers.

Setting one up

1. Choose a manager and create a long master passphrase you have never used elsewhere.
2. Turn on two-factor authentication for the manager itself.
3. Change the password on your main email account first, then on anything that holds money.
4. Replace the rest as you log in to them over the following weeks.
5. Store the recovery kit on paper, somewhere safe.

Passkeys

A passkey replaces the password with a cryptographic key pair. The private key stays on your device and is unlocked with a fingerprint, face or PIN. Because the key is tied to the genuine site's address, a fake login page cannot use it. Where a service offers passkeys, they are worth enabling.

Autofill is a security feature

A password manager fills credentials only on the address it saved them for. If it refuses to fill on a page that looks right, check the address bar: the page may be an imitation. More on that in spotting a cloned website.