Passwords
Secure and simple password creation and management is a critical skill to master.
This guide is not an all encompassing comparison of methods and strategies, but rather a known-to-be sensible and secure approach for most requirements.
We'll cover the following:
Installing a password manager.
Creating a memorable, secure master password.
Backing up the password database.
Securing the master password.
Multi-device database access.
For the time-strapped or impatient:
Install Bitwarden - https://bitwarden.com
Read the section on creating a secure master password.
Read the Tips and Tricks section
Consider a traditional bank:
Walk into the bank
Open the safe with the key
Store/retrieve your valuables
A password manager is the digital equivalent:
Launch the software
Type in your master password
Store/retrieve passwords and other sensitive data
Install an open source, security expert recommended application on your own device.
Bitwarden
If you wish to use a web hosted password manager, the only option we'd recommend is Bitwarden. The service includes polished mobile phone and desktop apps. The code is also Open Source, meaning the wider software community can and does audit the privacy and security claims of the software.
The free Personal plan would suffice.
For peace of mind, choose their EU server for the location of your password vault, if you reside outside the US.
Alternatives
Should you prefer to retain complete control and responsibility for your data, the following projects come highly recommended. All of them share the same database (file storage) format and are based on KeePass.
The author of KeePass, Bruce Schneier, is a well-known security expert.
You could try one of the apps and at a later stage switch to another one, retaining your password database. What's particularly useful, is the ability to share the database between desktop and mobile devices. Refer to the multi-device section below.
KeeWeb (Windows, MacOS, Linux)
KeePassXC (Windows, MacOS, Linux)
KeePass (Windows)
KeePassDX (Android Phone/Tablet)
KeePassium (iPhone/iPad) - Free version
A master password must meet the following requirements:
Strong enough not to be cracked.
Easy to remember.
Since so much of your data is already available to other people, companies and devices, never use any such information to create a password with. Your ID number, past telephone number and pet's name are examples.
Variations of common phrases, or words such as P@55w0RD! are utterly useless.
Modern computers are so powerful, that the above mistakes will cost you dearly.
Recommended methods follow, without boring you with the reasons and mathematical wizardry.
Suggestion 1 - A silly phrase with punctuation
Think of a silly phrase.
The more ridiculous, the better.
Our minds are sponges for such things.
Use at least 15 words.
Include numbers and punctuation.
Extract the first letter of each word of the phrase.
Mix upper and lower-case letters.
Include the punctuation, if you like.
Example sentence:
Mangoes are blue, raindrops are square and torpedoes should never be confronted while swimming with 4 people.
Corresponding password:
Mab,Ras&Tsnbcwsw4P
Suggestion 2 - At least four, non-trivial words
Pick at least 4, non-trivial words. The more, the better.
Separate them with full-stops, hyphens or numbers.
Example password:
pooch-dehumidifier-pillow-frankenstein
Back up your password database to 2 or more of the following:
External hard disk
Portable USB flash disk
Secure backup service
You are human and might forget your master password.
Print and store it in a physical safe, or suitable alternative.
Preferably, store a copy in 2 separate locations.
Don't be stupid and stick the piece of paper on your screen, or under your keyboard.
The simplest approach to this, would be to save your password database to a cloud storage service such as Box, Dropbox, Google Drive, OneDrive, or Backblaze.
Be sure to secure the containing folder by setting it to private access.
The above-mentioned mobile apps are capable of accessing cloud storage.
Always use a password manager to generate other passwords.
Never EVER, EVER EVER use the same password for different apps/services.
i.e. use one password per service/application.
Cut and paste from the password database into other applications.
Do not use your web browser's password manager
For the super paranoid, consider using the portable version of KeePass, with the software and database saved to a USB flash disk on your key-ring, or in your pocket. Especially if you travel and use public computer terminals.
If an on-line service supports 2FA (Two Factor Authentication) which involves sending you one time PINs via SMS or mobile apps like Authy, or Google Authenticator, enable that feature.