Password Managers: What Are They

We’ve already seen what a password should look like for us to call it secure, but now we run into the problem of how to manage all these somewhat more complicated (and varied) passwords than the ones we had before, so let’s take a look at what Password Managers are.

As they say, «there’s more than one way to skin a cat» — there are several options depending on each person’s actual needs. Above all, we need to apply some common sense… if we only have 4 passwords in total, we probably don’t need to pay for a Premium service that auto-fills them in apps or in the browser. And the same goes the other way around: if we have 300 passwords to manage across services, work, our kids’ accounts… then a text document or a notebook probably won’t cut it. We also need to consider whether we’ll be traveling or logging in from other computers, and whether we need to carry our password file with us or keep it in the cloud.

What is a password manager?

Basically, a password manager is an app or web service that lets us store, manage, and even generate secure passwords. It’s not just a place to stash your passwords, since these tools also offer more advanced features like checking your passwords to see if any are repeated or too weak, generating a new one and changing it on the corresponding service every so often, and even delegating passwords if you’re going on vacation and want someone else to be able to keep accessing a particular service (without that person actually knowing the password). Pretty cool, right? Even so, these services aren’t for everyone — some people don’t need to use a sledgehammer to crack a nut. Let’s look at a few examples of different managers:

Some simple options if you don’t have many passwords to manage

– The option to store passwords in browsers (Chrome, Firefox, and Internet Explorer): if you’re only going to access web services or apps, this could be an option… but it’s not recommended, since there are plenty of ways to access these saved passwords, which are stored without encryption and without a master password, meaning anyone who gets access to your computer will be able to see them. Also, Chrome and Firefox do store them in the cloud if you’re signed in on the browser, but with Internet Explorer there’s no such option, and if you switch computers you’ll have to export and import the file by hand.

– Text file: If you only have a handful of passwords to manage, you could keep them in a text file. If you can protect it with a password (like, for example, in Apple’s Notes app for both iPhone (iOS) and Mac), even better. In fact, with Notes on iOS you can even open the note containing your passwords using your fingerprint (as long as your iPhone has a fingerprint reader, of course), which makes opening the document a lot simpler. The biggest downside of Notes is that you can’t search across all your passwords, and the biggest advantage is that it syncs by itself with iCloud (Apple’s cloud), so you’ll have the note on all your devices. The same goes for a text file: if you keep it on your computer, you have to make sure to back it up properly. We’ll talk about backups another day — noted.

– KeePass Password Safe: KeePass is a full-fledged password manager. It lets us store as many passwords as we want, organize them into groups, and copy and paste them into the apps or websites and services we need… all of this stored in a local text file (or in the cloud in its paid version) that’s automatically encrypted, so you don’t need any advanced knowledge to use it. The only downside is that you have to take care of «backing up» this file yourself, since if you carry it on your phone and lose your phone, no one will be able to access your passwords, but you also won’t be able to recover the file where they’re stored.

Online password managers

– iCloud Keychain: Apple has a service for owners of its devices whereby all passwords are stored in Apple’s own cloud. The Safari browser is able to auto-fill stored passwords for services on its own, and we can manage them in a fairly straightforward way. It’s also capable of generating secure passwords and automatically detects when we’re signing up for a new service or when it already has the password for the service we’re trying to log into, all in a way that’s very transparent to the user. The only issue I see is that if you don’t have a Mac, you can’t organize your passwords — they’re simply «there» in Safari, but you can’t create groups or folders, manage them, or have them auto-fill logins in apps outside of Safari. Such a shame — I wouldn’t mind migrating all my passwords to this service if it were actually capable of doing that and gave us an interface to access the passwords instead of just having them sitting «there» in Safari.

– LastPass: This one’s my favorite. LastPass’s philosophy is «the last password you’ll ever have to remember», which is where the name comes from. It means that to access the service you’ll need to create a strong password (the kind we already know how to make), and that password will be used to encrypt all the other passwords you enter into the service. In other words, if you change that master password every so often, the encryption of everything you’ve stored changes as well, making it impossible to brute-force the database. The service is fantastic — it lets you generate secure passwords, change them periodically (for some services I don’t even know my own password; it’s simply whatever LastPass generated at the time, and LastPass is the one who knows it, so I just have to copy and paste it) and delegate them to other people. It also has a security feature in case something happens to us (basically, in case we die) so no one else can access my passwords… can you imagine my wife having to log in, say, to the Iberdrola website while I’m pushing up daisies? She wouldn’t be able to log in because the password is in LastPass, but she also couldn’t reset it, since the reset link would be sent to my email… whose password is also in LastPass! So LastPass solved this by creating a Security Contact who can access your passwords in case you’re no longer around… it’s a really great idea! The free version lets you use LastPass on your phone, in the browser, and via the website, but passwords don’t sync between them… which can make sense for people who always browse from their phone, for example. The paid version ($12 a year) keeps everything synced and lets you access it from anywhere, plus it offers extra security features like two-factor authentication, which we’ll talk about soon — noted, too.

– 1password: This is a service very similar to LastPass, though in this case you decide where you want to store the password file, with support for DropBox and iCloud. Of course, the passwords are encrypted, so even if someone gets hold of the file, it’s impossible for them to access the passwords. Just like LastPass, it offers advanced password management, secure password generation, and temporary passwords (tokens) for accessing certain services. The paid service also includes syncing between devices, which lets us «go mobile» without always having to use the same device. What I like about 1password is that the passwords are very visual — the interface is much simpler and cleaner than LastPass’s, everything feels easier and more minimalist… but it’s also a bit pricier, with the annual subscription running around $36.

There are plenty of other services and options out there, but I’ve listed the most common ones or the ones I’m most familiar with. Now it’s up to you to decide whether it’s worth using one of these managers, or whether you’re capable of remembering all the securely generated passwords that give you access to your digital life… doesn’t it sound like saying «digital life» means it needs to be protected in a more secure way? Because that’s really what it is — we’re protecting our photos, our documents, and in some cases access to our banks… we can’t have passwords like «12345» (it’s the most commonly used password in the world). It’s harder to think about it than to actually decide to do it and get it done — in a little while you’ll have all your passwords updated and entered into your new manager. I change mine every January.