Do You Need a Password Manager?

Most households do not need to think hard about this: yes, a password manager is worth having, and the National Cyber Security Centre encourages people to use one because it can create strong passwords for you and remember them¹. The reason is simple. If you use the same password across different accounts and one of them is compromised, a hacker can try the same password on your other accounts and potentially get into those too². A manager stores your passwords safely so you can have a unique password for every service without having to memorise any of them².

You do not have to start with software. The National Cyber Security Centre says writing passwords down can be done safely, because an attacker would need physical access to where they are stored, and that this can suit people who need regular support to manage their online affairs². What matters is that each account has its own password, and that you can get back into your accounts when something goes wrong.

This page sets out what a manager does, how it compares with a written list kept at home, why phishing tends to rise after big outages and attacks, and how to keep access to your accounts when systems go down.

Why one reused password puts every account at risk

The danger is not that any single password is weak. It is that the same one opens several doors. The National Cyber Security Centre puts it plainly: if you use the same password across different accounts and one of your accounts is compromised, a hacker can try the same password on your other accounts and potentially gain access to them too². Wiltshire and Swindon Prepared, a local resilience site, makes the same point from the household's side: cyber criminals only need one password to access all your accounts¹.

Passwords are often stolen when an organisation holding your details suffers a data breach⁴. You do nothing wrong; a company you once bought from loses its records, and your email address and password appear in a list. If that password also opens your email, your shopping account or your bank, the breach is no longer the company's problem alone.

Email deserves special treatment. The National Cyber Security Centre publishes separate guidance on using a strong and separate password for your email, because your email is where password reset messages for everything else arrive⁵. If you have reused your email password across other accounts, change your email password as soon as possible, and make it strong and different to all your other accounts⁵.

There is a second, quieter risk: predictable passwords that a criminal can easily guess⁴. A manager removes the temptation to build passwords from names, dates and football teams, because you never have to invent one.

If you already suspect a password has leaked, the response is quick and specific. Change the password on any account that has been hacked, and on any accounts using the same password³. If you gave a password out in response to a phishing message, change it on every account where you use it, immediately⁶. And if a scam email quotes a password you still use, it is probably from an old breach of personal data, but change that password immediately and anywhere else you use the same one⁷.

What a password manager does for a household

A password manager stores passwords safely for you, meaning that you can have unique passwords for each service without needing to remember them². That single sentence covers most of what a household needs from it. You keep one password in your head, the master password, and the manager holds the rest.

There are two broad kinds, and the difference matters when you are choosing.

The National Cyber Security Centre describes the synchronising benefit as one of the main advantages of a separate manager over the one in your browser². For a household with a phone, a tablet and a laptop between them, that is the practical difference: the password you set on the laptop is there on the phone.

A manager also solves the creation problem. The National Cyber Security Centre encourages people to use password managers, which can create strong passwords for you and remember them¹. You are not asked to invent something memorable and unguessable for every site; the software does that, and you stop reusing.

What a manager cannot do is protect you if you hand the password over. It stores; it does not verify who is asking. That is the job of two-step verification, covered below.

Password manager or a written list kept at home

These are not as far apart as they look, and the official guidance treats both as legitimate. The National Cyber Security Centre says writing passwords down can be done safely because an attacker would need physical access to where the passwords are stored, and that it can suit people who need regular support to manage their online affairs².

The conditions are what make it safe:

• Keep the list somewhere safe that you will remember, but where someone else is unlikely to find it, and do not leave it near your computer⁸.
• Do not share your passwords with anyone⁸.
• If you use a password manager, use it only on your own computer, share it only with people you trust, and do not use it anywhere in a public place, like a library⁹.

That last point comes from Age UK's staying safe guidance, and it applies to the written list too: a notebook carried to the library and left on a table is not the same as one kept at home.

The trade-off is phishing. The National Cyber Security Centre warns that with a written list you will be at greater risk of phishing attacks, since you will need to manually verify that a website is what it purports to be². A manager fills in the password only for the site it has stored, so a convincing fake address does not get the same automatic help. That is the strongest argument for software over paper for anyone who is online often.

Phishing rises after big outages and attacks

Scams follow the news. Criminals use information about you that is available online, including on social media sites, to make their phishing messages more convincing¹⁰. The advice is to use strong passwords and be vigilant to phishing emails, text messages and phone calls, and to keep all software and systems up to date, including mobile phones¹¹.

The pattern is not new. Cyber criminals used the energy regulator Ofgem as a lure for over 50 phishing campaigns used to harvest financial credentials, according to the National Cyber Security Centre's 2022 annual review¹¹. Criminals also use information about you that is available online, including on social media sites, to make their phishing messages more convincing¹⁰.

For a household, the practical rules are short:

• Be vigilant to phishing emails, text messages and phone calls, and keep all software and systems up to date, including mobile phones¹².
• If you think you have entered personal details or a password into a phishing site, change the passwords on any of your accounts where you use the same password⁶.
• If you entered banking or card details, contact your bank straight away, and if you use online banking, cancel the card or cards there⁶.
• If you think your device has been hacked or you opened a suspicious link, open your antivirus software if you have it and run a full scan, allowing it to clean up any problems it finds⁶.

A password manager reduces the damage in one specific way: because every account has its own password, a single phished login does not cascade. You change one password, not twenty. Our guide to phishing walks through how to spot the messages, and what to do if you clicked a phishing link covers the first hour.

Keeping access to your accounts when systems go down

The scenario that catches households out is not a clever hacker. It is a service going offline, a password reset that never arrives, or a phone lost at the wrong moment. The National Cyber Security Centre's test for a hacked account is worth knowing: you may be hacked if you can no longer access your accounts, or if there is activity you do not recognise, such as changes to security settings or password reset messages¹³.

If that happens, work through it in order:

1. Change the password for the account that has been hacked, and for any accounts using the same password³.
2. Log all devices and apps out of the account, usually from the Settings menus of the app or website, so anyone trying to use it must supply the new password¹⁴. This means a cyber criminal will not be able to use your old password to access your account¹⁵.
3. Set up two-step verification, which usually works by sending a PIN or code, often by text message or email, to prove it is really you¹⁴.

Two-step verification is the piece that keeps you in when a password is out. The National Cyber Security Centre calls turning it on the first and most important step, because it helps protect you if your password gets phished or otherwise compromised². It gives you a code to enter from an app or text message, so even if a criminal knows your password, they will not be able to access your accounts⁴. The option to switch it on is usually in the security settings of your account¹⁶, and it is worth setting up on important accounts like email and banking even if they are already protected by a strong password, because it only takes a few minutes³.

Keep a route back in that does not depend on the account itself. Protect cloud accounts, and access to your backups, with strong passwords and two-factor authentication¹⁷. If you protect a backup with a password when offered the option, do so, in case the removable media is lost or stolen¹⁸. And if you are asked to enter a password when resetting a device, make sure you change that password afterwards¹⁹.

For the wider picture of what to do when banks, shops and public services go offline, see when banks, shops and public services go offline. Our protecting email and bank accounts guide covers the account-by-account work, and how to turn on 2-step verification takes you through the settings.

Smart devices, older phones and the passwords you did not set

Every connected device in the home is another account, and many arrive with a password set by the factory. The law now requires manufacturers not to supply devices that use default passwords, which can be easily discovered online and shared²⁰. If a device or app still comes with a default password, change it²⁰. The reason is direct: if the default password is used, a criminal could log into a smart device and use it to access a local network, or conduct cyber attacks²⁰.

Older equipment needs a little more care. To change the password for older security cameras, you may have to type the camera's IP address into your browser, and you can find that address in your router settings under connected devices²¹. Our guide to smart speakers, cameras and baby monitors covers the rest.

An old phone can run a password manager, since a separate manager is usually an app on your phone or tablet and is also available through a website². The limiting factor is updates. Browser-stored passwords are only as secure as your devices and accounts, which is why the National Cyber Security Centre says not to switch off the automatic security update feature for your browser and operating system². If a handset no longer receives updates, use the manager through its website on a supported device instead.

Where to get help, and passwords for the door

Some passwords have nothing to do with the internet. Water and energy companies run password schemes so you can check that someone at your door is who they say they are. Northumbrian Water lets you set a password so the team can prove their identity when they visit; you ask for the password when they knock²². SP Energy Networks offers the same for home visits, for extra peace of mind²³. Thames Water's doorstep password is shared only with the staff member visiting your property²⁴.

These schemes sit alongside the Priority Services Register, which water companies use to record households that need extra help. South Staffs Water lists a password protection scheme among its Priority Services²⁵, and Yorkshire Water describes some services as automatic, like bills in a specific format, and others as available when needed, such as requesting a password during a home visit²⁶. If someone in your household would struggle to verify a caller, ask your supplier to add you. Our guide to extra help in an emergency explains what the register covers.

For online help, the National Cyber Security Centre's Cyber Aware pages are the starting point, and its top tips include using a password manager to help you create and remember passwords²⁷. Essex Prepared advises turning on two-step verification to help protect your online accounts²⁸. The British Red Cross suggests memorising the username and password for social media accounts as part of family safety planning²⁹.

If a password has already been compromised, do not sit on it. Our guides to what to do if an online account is hacked and your details in a data breach set out the next steps, and is it safe to write your passwords down? looks at the paper option in more detail.