It is truly upsetting to see how few people use password managers. I have witnessed people who always use the same password (and even tell me what it is), people who try to login to accounts but constantly can’t remember which credentials they used, people who store all of their passwords on a text file on their desktop, people who use a password manager but store the master password on Discord, entire tech sectors in companies locked to LastPass, and so much more. One person even told me they were upset that websites wouldn’t tell you password requirements after you create your account, and so they screenshot the requirements every time so they could remember which characters to add to their reused password.
Use a password manager. Whatever solution you think you can come up with is most likely not secure. Computers store a lot of temporary files in places you might not even know how to check, so don’t just stick it in a text file. Use a properly made password manager, such as Bitwarden or KeePassXC. They’re not going to steal your passwords. Store your master password in a safe place or use a passphrase that you can remember. Even using your browser’s password storage is better than nothing. Don’t reuse passwords, use long randomly generated ones.
It’s free, it’s convenient, it takes a few minutes to set up, and its a massive boost in security. No needing to remember passwords. No needing to come up with new passwords. No manually typing passwords. I know I’m preaching to the choir, but if even one of you decides to use a password manager after this then it’s an easy win.
Please, don’t wait. If you aren’t using a password manager right now, take a few minutes. You’ll thank yourself later.
I use a password pattern. I have hundreds of different passwords all stored in my head and all between 10-20 characters long. The trick is to have a deterministic formula for picking a password.
Example: short word + First 6 in url + symbol + short word capitalised + number
Let’s say the first word is cat and second is dog, symbol is - and number is 5 and you have a Gmail it would give you
“catgmail-Dog5”
https://www.passwordmonster.com/ gives it 61 years to crack this one but if you use longer words you get better times.
Wait are you saying that with the example your provided your password for Lemmy would be catlemmy-Dog5? Because that’s a terrible system.
Maybe it’s not for you then. It’s been working pretty well for me and my passwords aren’t saved anywhere but locally in the browser.
It’s better than reusing the same password, but not by much. If one of your passwords get compromised, an attacker can easily guess to try to just replace “gmail” by whatever service they’re attempting to log into as you, and give it a shot.
That’s assuming that a human will ever see it. People cracking passwords either have all of them and then use an automated tool or hack a person specifically by decrypinc a password hash which will take an immense amount of time and electricity.
Still since that’s a concern I can modify the formula. By splitting gmail into g and mail and sticking g at the front.
gcatmail-Dog5
Not how it works.
First of all, there’s far too many companies out there still storing passwords in plaintext.
Second of all, even with a good hash algorithm, hacking a specific person’s password out of a leaked database is still feasible when your passwords are variants of a couple of dictionary words with a few numbers and symbols attached.
Creating fully randomized, unique passwords in a password manager really is the best way. Even an older hash method of storage on the web site’s part will likely protect it.