Stop memorising passwords: embrace a password manager and passkeys

The problem was never you#

Every few months someone tells me they have a "system". A base word, a number, a symbol, and the name of the site on the end. Or the same three passwords, rotated. Or a notebook in a drawer. I do not think any less of them. The system they were handed is unreasonable, so they built a workaround.

Think about what a password policy actually asks. Make a long, random, unique secret for every account. There are somewhere between a hundred and several hundred of them. Never reuse one, never write it down, never type it into a page that only looks right, and change it if anything goes wrong. No human memory does that. The result is predictable: short, familiar, reused.

Attackers know it, and they build the whole business on it. A password leaks from one forgotten forum, gets tried against email, banking, and the work login, and one of them works. Nobody had to be clever. The Verizon Data Breach Investigations Report has put stolen credentials at or near the top of how breaches start for years. I wrote about the other end of that in Identity risk is rising: attackers increasingly log in rather than break in.

So the advice is not "try harder". It is to stop making the human do the part a computer is better at. That is what password managers and passkeys are for.

Password managers: let the computer remember#

A password manager is an encrypted vault with a good generator attached. You remember one strong passphrase, and the manager creates, stores, and fills everything else.

The NCSC recommends using one, and the reasons are practical rather than theoretical:

• Every account gets its own password. Twenty random characters, different every time. When one site is breached, it is one site. The leak stops there.
• You never have to invent anything. Humans are bad at randomness. A generator is not.
• It will not fill on the wrong page. This is the quiet one. A manager matches the saved login to the real domain. If you land on micros0ft-login.example, nothing autofills. That missing autofill is often the first sign that something is off, and it works even on the days you are tired and clicking fast. A person reads a page and decides it looks right. A manager compares a domain and does not care how good the logo is.
• It makes the good habit the easy habit. Typing a 20 character random password is miserable. Clicking a fill button is not. Security that is easier than the shortcut is the only kind that survives. It is the same point I made about usability defects being security defects.
• It does more than passwords. Most managers also store the one time codes for MFA, secure notes, recovery codes, and card details, and many will warn you when a saved password has turned up in a known breach.

"But everything is in one place"#

This is the objection I hear most, and it is a fair one. If the vault falls, everything falls.

Compare it with the alternative honestly. The realistic alternative is not a flawless memory. It is the same password on forty sites. One breach of a site you barely remember, and every account you have is exposed. A vault protected by a strong passphrase, with MFA on top, and encrypted so the provider cannot read it, is a far smaller target than your reused password.

It is not zero risk, and it is worth doing properly:

• Use a long passphrase for the vault. Four or five unrelated words you will remember, not a clever substitution of letters for digits.
• Turn on MFA for the vault itself, ideally with a passkey or a hardware security key rather than a text message.
• Choose a manager with a zero knowledge design, where the vault is encrypted on your device and the provider cannot read it. Look for independent security audits and a clear account of past incidents. Several well known vendors have had breaches; what matters is that the design meant the stolen vaults were still encrypted, and how honestly it was handled.
• Keep the app updated. It is software, and it has bugs like any other.
• Know your recovery path before you need it. More on that below.

Which one you pick matters less than picking one. The built in options from Apple, Google, and Microsoft are decent and already there. Dedicated tools such as 1Password and Bitwarden add cross platform support, family and team sharing, and better admin features. For a business, you want the second kind, with shared vaults, an audit trail, and a way to take access away when someone leaves.

Passkeys: remove the secret#

A password manager makes passwords much better. A passkey asks a different question: why is there a shared secret at all?

A password is a secret that you and the website both know. That is the flaw. It can be phished, because you can be tricked into typing it somewhere else. It can be leaked, because the site stores something derived from it. It can be guessed, replayed, or sprayed across other sites. Every one of those attacks relies on the secret being something that can be copied.

A passkey is built on public key cryptography, using the FIDO2 and WebAuthn standards. When you create one, your device makes a pair of keys. The site gets the public half, which is useless on its own. The private half stays with you and never travels. To sign in, the site sends a challenge, your device signs it after you confirm with a fingerprint, face, or device PIN, and the site checks the signature.

Three consequences matter:

1. Nothing to steal from the site. If the site is breached, the attacker gets public keys. There is no password database to crack and sell.
2. Nothing to type into a fake page. A passkey is tied to the real domain it was created for. A phishing site on a different domain simply cannot use it. The device will not offer it. This is called phishing resistance, and it is the property that passwords and most one time codes lack. I covered why that gap matters in The office is a browser tab: adversary-in-the-middle kits can relay a password and a six digit code in real time. They cannot relay a passkey to the wrong origin.
3. Nothing to remember. You unlock your phone or laptop the way you already do. There is no rule about symbols and no reset email.

It is also a better experience, which is half the battle. Signing in with a fingerprint is faster than typing a password and a code. Security that people prefer is security that gets used.

Governments are catching on. The NCSC said in April 2026 that passkeys should be the default sign in option for consumers, and NIST's current digital identity guidance, SP 800-63B, recognises syncable passkeys as a legitimate authenticator. Microsoft supports passkeys in Entra ID for work accounts. This is no longer a niche enthusiast feature.

How they fit together#

People sometimes treat this as a choice. It is not.

Passkeys come in two flavours. A synced passkey is stored in a credential provider and copied across your devices, so losing one phone does not lock you out. That provider can be Apple Passwords, Google Password Manager, Windows, or a third party password manager like 1Password or Bitwarden. A device bound passkey lives on a single piece of hardware, typically a security key such as a YubiKey, and cannot be copied off it.

For most people, synced passkeys inside a good password manager is the sweet spot. One place holds your passwords for the sites that still need them, and your passkeys for the sites that have moved on. The same unlock, the same recovery plan, the same habit. As more sites support passkeys, the vault slowly holds fewer passwords and more keys.

For the accounts that really matter, such as an admin account, a domain registrar, or a primary email on a high risk person, a hardware security key is a good extra. NIST is explicit that syncable authenticators are not suitable for its very highest assurance level, because the private key can be exported by design. That is the right place to use a device bound key. Most of us do not need that for a streaming account, and it would be silly to pretend otherwise.

The honest limits#

I would rather give you the downsides now than have you find them later.

• Not every site offers passkeys yet. Many major services do, and the list grows, but plenty of small sites and older business systems do not. That is why you still want the password manager. It covers the long tail.
• Passkeys do not fix a compromised device. If malware is running on your laptop, or someone steals an already authenticated session, a passkey cannot help. Phishing resistance protects the login. It does not protect what happens after. Keep the device patched and managed.
• Account recovery is now the weak point. This is the big one. If the strongest login in the world can be bypassed by a convincing call to a helpdesk or a "forgot my account" email, an attacker will use that instead. For a business, treat resets and MFA re-enrolment as part of the identity control plane and verify them properly. For yourself, make sure the email account behind everything is protected with a passkey or hardware key.
• Ecosystem friction is real. Moving passkeys between providers has been clumsy, and the industry is still improving import and export. Pick a provider you intend to stay with, and know how to move away.
• Shared and legacy accounts are awkward. A shared service login, a printer, an old admin portal. A managed password vault with sharing is often still the answer there.
• You can lock yourself out. If your only copy of everything sits on one phone with no backup and no recovery method, a lost phone is a bad week. Plan for it.

None of that is a reason to wait. It is a reason to do it with your eyes open.

What I would actually do#

If you want a short, doable plan rather than a lifestyle change:

1. Pick a password manager and commit. Built in is fine if you live inside one ecosystem. A dedicated one is better if you use a mix of devices or share with a family or team.
2. Secure the vault. A long passphrase, MFA on it, and a printed or offline copy of the recovery details stored somewhere safe, away from the device itself.
3. Start with the accounts that unlock all the others. Your main email first, because every reset goes there. Then banking and finance, your phone provider, your cloud storage, and any social account you cannot afford to lose. Give each a new generated password.
4. Switch on passkeys wherever they are offered. Most big providers have a prompt in the security settings. Create the passkey, store it in your manager, and keep the old password as a fallback until you trust it.
5. Turn on the breach alerts. Many managers will tell you when a saved login appears in a leaked dataset. That is a to do list that writes itself.
6. Do the rest slowly. Every time you log in somewhere and the manager offers to save or upgrade the login, say yes. After a month or two the old habit is gone.
7. Add a hardware key for the crown jewels if you can. Two is better than one, with one stored safely away.

For a business#

The same ideas scale, and the stakes are higher.

• Give people a managed password manager. A tool the company controls, with shared vaults, offboarding, and visibility, beats a personal one that disappears when someone leaves, and it beats a spreadsheet by a long way. Ban the spreadsheet.
• Offer passkeys in your identity platform and make phishing resistant sign in the default for admins and anyone who handles money or sensitive data first. Conditional access can then require it for the apps that matter. I went through the shape of that in Entra conditional access patterns.
• Stop forcing routine password changes. Both the NCSC and NIST advise against forced periodic rotation and arbitrary composition rules. They push people into predictable patterns and add nothing. Change a password when there is reason to think it is compromised.
• Harden the reset process. Strong login with a weak helpdesk is a weak system. Verify the person, not just the story.
• Make it easy. Roll it out with an hour of training, a clear "what to do if you lose your phone", and someone to ask. People adopt tools that save them effort.

Embrace it#

I do not think passwords are going to disappear next year. But the direction is clear, and the tools to get ahead of it are available now, free or cheap, and easier than the thing they replace.

You do not need to become a security person. You need a password manager so you stop inventing and remembering secrets, and you need to say yes to a passkey the next time a site offers one. Those two small decisions remove the most common way people get compromised: a reused password, handed to the wrong page.

Set it up this weekend. Start with your email.

References#

Sources and further reading for the claims above.

• NCSC, Password managers: using a password manager to remember your passwords
• NCSC, Leave passwords in the past: passkeys are the future
• NCSC, Passkeys guidance
• NCSC, Passkeys are more secure than traditional ways to log in
• NIST, SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management, including syncable authenticators in Appendix B
• W3C, Web Authentication (WebAuthn) Level 3
• Verizon, Data Breach Investigations Report
• Microsoft Learn, Enable passkeys (FIDO2) for your organisation
• Have I Been Pwned, for checking whether an email address has appeared in a known breach