Password Management Basics (Premium)

Because our online accounts hold the key to our identities, finances, and other personal information, it's important to secure them effectively. This isn't as onerous as you may believe, but if you've neglected account security for whatever reason, you do have some work to do. And even if you think you're up-to-date with account security, chances are you're not: Security technologies, and the products and services that implement them, are improved regularly, and it's impossible for any individual to know for sure that every online account they maintain—including those they've forgotten about—is protected as much as possible.

Or is it?

When you think about the products and services you use to protect yourself online, there is perhaps none more important than a password manager. To be clear, you are almost certainly using a password manager, whether you mean to or not: You would need to explicitly prevent this behavior to do otherwise. Less clearly, you're probably using multiple password managers, and you definitely don't want to do that. But it's also possible that you're not using the right password manager. And, as important, not using your password manager to its fullest.

And that's a lot to unpack. So let's start with the basics.

That password managers manage passwords is obvious enough: This isn't a clever name, it's just descriptive. But modern password managers—good password managers—do much more than that. We'll get to that in a moment.

A good password manager needs to balance security and convenience. This can be elusive. We all have different tolerance levels, and any solution that is too inconvenient might convince users to lower their protections to simplify the experience. This is a critical mistake: A password manager stores some of our most important personal information, but it's also a single point of failure. It needs to be secure.

For many people—perhaps even most people—a password manager is conversely not a single point of failure because we've all used multiple password managers over time. And one of the biggest mistakes one can make when switching to a new password manager is to forget the old one is still out there, full of your personal information. You could properly secure multiple password managers, of course. But the simpler, more secure approach is to remove your personal data from any password manager you've used in the past. This can be problematic: You probably don't even remember most of them.

That last bit is true because password managers, understandably, are promiscuous. That is, they're everywhere. Every major web browser, every major personal computing platform on desktop or mobile, and every major online account (that's tied to identity) provides a password manager. Ideally, this is centralized: If you use an Android phone and Google Chrome on both mobile and desktop, you're probably using the Chrome Password Manager, as it works across all those systems. But if you've used...