Is It Safe to Write Your Passwords Down?

Yes, you can write your passwords down. The National Cyber Security Centre, the UK's official cyber security body, says plainly: "It's OK to write down your passwords, but keep them somewhere safe, and out of sight"¹. The same advice appears in its guidance on three random words: "If you want to write your password down, that's also OK, provided you keep it somewhere safe"².

The reason is physical. A written list can be used safely because an attacker would need physical access to where the passwords are stored³. Someone guessing at your accounts from another country cannot read a notebook in your kitchen drawer. What defeats a written list is leaving it where a visitor, a burglar or a child can find it, or writing down a password so obvious that no list is needed.

So the practical answer has three parts: write down passwords that are strong and hard to guess, keep the list out of sight and away from the computer, and check first whether the service allows it. If you would rather not keep paper at all, a password manager or a passkey does the same job in a different way³.

Writing it down is fine, as long as the list is safe

The fear that a written password is automatically unsafe does not match the official advice. The National Cyber Security Centre treats a paper list as a reasonable option, and its guidance explains why: the risk shifts from the internet to your home, and an attacker would need physical access to where the passwords are stored³. That is a much harder thing to do than guessing a weak password from a list of common ones.

The advice is not a free pass to write anything anywhere. The same guidance sets conditions. Passwords must not be predictable or guessable, you should check you are not breaking the service's terms and conditions, and you should consider who has access to where the list is kept³. A list of strong passwords in a locked drawer is a sensible record. A list of pet names on a sticky note is not, because the passwords themselves are the weak point.

Writing passwords down also suits particular households. The guidance notes it can suit people who need regular support to manage their online affairs³. That covers an older relative who finds password managers confusing, or anyone who needs a carer or family member to help them sign in. The paper list becomes a shared, controlled record rather than a secret.

It helps to understand what a written list protects against and what it does not. Passwords are often stolen when an organisation holding your details suffers a data breach, not by someone reading your notebook¹. A strong, unique password written down safely still limits the damage of a breach elsewhere, because it will not unlock your other accounts. The list is a memory aid, not the security itself.

Where to keep a written list, and where not to

The single clearest rule is about location. The RNIB advises: "If you need to write your password down, don't leave it near your computer. Put it somewhere safe that you'll remember, but where someone else is unlikely to find it"⁵. The National Cyber Security Centre's wording is the same in spirit: somewhere safe, and out of sight¹.

That rules out the most common habits: a note under the keyboard, a card taped to the monitor, a list in the top drawer of the desk beside the screen. These are the first places anyone with access to the room would look. It also argues against keeping the list in the same bag as the laptop it unlocks.

The fire service has useful thinking on where important things should live. Its guidance on keys is to keep them in a safe but accessible place near the exit they fit, never in the locks, and to make sure everyone knows where they are⁷. The principle transfers: choose one place, always return the list there, and make sure the adults in the household know where it is. A locked drawer, a small safe or a filing box with other household papers all fit that description.

There is a balance to strike between security and being able to find the list in a hurry. The fire service advice on escape plans is to decide where keys should be kept and always keep them there, ideally close to the door or window while keeping security in mind⁸. A password list is not a fire escape matter, but the habit is the same: one known place, kept consistently, so that in a stressful moment you are not searching the house.

If more than one adult needs the list, tell them where it is but do not leave it on display. The National Cyber Security Centre's condition is to consider who has access to where the passwords are kept³. A list that half the street knows about is no safer than a weak password.

What to check before you write a password down

Before the pen touches paper, four checks decide whether writing it down is a good idea at all.

• Is the password strong and hard to guess? Do not use predictable passwords such as dates, family and pet names, or ones criminals can easily guess like "1234"¹. Avoid personal information or details shared on social media, such as your name, address or your children's names⁵.
• Does the service allow it? The National Cyber Security Centre warns that some services, including some online banking services, forbid users to write down their passwords³. Check the terms before you commit a banking password to paper.
• Who else can reach the list? Consider who has access to where the passwords are kept³. A shared house, a cleaner, or children old enough to read all change the calculation.
• Is it the same password you use elsewhere? Ideally you should use unique passwords for all your important online accounts, such as banking, shopping and payment accounts and social media, not just your email⁹. A written list makes unique passwords practical, because you no longer have to remember each one.

A strong password typically includes a mix of uppercase and lowercase letters, numbers and special characters, and is at least 12 characters long¹⁰. That is a useful benchmark when you are deciding whether a password is worth writing down or should be replaced first. A long password made of three random words can meet the spirit of that advice while staying memorable.

It is also worth setting up two-step verification on accounts where it is offered, so that a password alone is not enough to get in¹¹. If a password you use appears in a data breach, change it as soon as you can¹². And if you are ever asked to enter a password when resetting a device, make sure you change that password afterwards¹¹.

Three random words: a password you can remember without the list

The best way to reduce how much you need to write down is to make passwords you can actually remember. The National Cyber Security Centre recommends using three random words to create a password that is difficult to crack¹³. Its guidance on hacked accounts gives the same advice: use a strong and unique password, such as three random words⁶.

The method is exactly what it sounds like. Pick three unrelated words and run them together, for example "BallDogRed"¹⁴. The length and unpredictability do the work, and the picture in your head does the remembering. The same approach is recommended for protecting your email, which should have a strong password different from all your others, built from three random words¹⁵. It is also the advice for smart devices: create a secure password, for example by combining three random words¹⁶.

One warning matters here. Swapping the letter "o" with a zero will not make your password significantly stronger, but it will be harder for you to remember². The same goes for other clever substitutions. They add memory burden without adding much security, which defeats the purpose of a password you can recall.

A password manager and a written list are not rivals. The National Cyber Security Centre encourages people to use password managers, which can create strong passwords for you and remember them⁹. Using one can help you create and remember passwords¹³. A paper list is the fallback for the accounts you cannot put in a manager, or for the household member who prefers paper.

Passkeys, password managers and the limits of paper

Paper has one clear advantage: it works when nothing else does. Power cut guidance advises keeping a mobile phone charged and writing down important phone numbers¹⁷. The same logic applies to logins. If the power is off and the router is down, a notebook still opens, while a password manager on a flat phone does not.

That is why a written list belongs with your other household paperwork. Official emergency planning advice is to keep emergency contacts written on paper¹⁸. Several councils advise keeping important numbers such as family or insurance written down somewhere safe in case you cannot access them on your phone or online¹⁹. A password list kept in the same place fits that habit, provided it is out of sight and only the right people know where it is.

For everyday use, though, the official preference is shifting. The National Cyber Security Centre recommends making passkeys your first choice of login and using them wherever they are offered³. If you have given out a password by mistake, you should change the passwords on any accounts that use the same one, and use a passkey instead if one is available²¹. A passkey removes the thing you would otherwise write down.

If you do keep a paper list, treat it as a living document. When you change a password, change it on the list the same day. When you close an account, cross it off. A list that is out of date is worse than no list, because it sends you round in circles at the moment you need to get in.

If the list is lost, or someone else finds it

A lost list is a prompt to act, not a disaster. Start with your email, because it is the account used to reset others, and change the passwords that were on the list. The National Cyber Security Centre's guidance on recovering a hacked account includes changing passwords as a step²². If a password you still use appears in a data breach, change it as soon as you can¹².

If you think someone has found the list, change the passwords on any accounts that use the same password, and use a passkey instead where one is available²¹. If you have given out a password, change the passwords on any other accounts that share it immediately²³. Then move the list to a better place, and consider whether a password manager would suit you better than paper.

There is help for households that need it. Water companies run a Priority Services Register, and customers can set up a password that is used on every visit and can be in the customer's chosen format, such as written down for hard of hearing customers²⁴. That is a useful model: a password written down, held by the right people, used consistently. For anyone who needs support managing accounts, the same principle applies at home.

If a relative or neighbour needs help, keep the password list somewhere they can find it but others cannot. The police Herbert Protocol, used when a vulnerable person goes missing, keeps information stored securely but where you can find it quickly, and other relatives, carers or staff should know where it is²⁵. The same balance of secure but findable is the right one for a password list.

For more on protecting the accounts that matter most, see Protecting Email and Bank Accounts: Passwords and 2-Step Verification and How to Create a Strong Password You Can Remember. If you would rather not keep paper at all, Do You Need a Password Manager? and What Is a Passkey and Should You Use One? set out the alternatives.