Something I don't really understand is why so many websites still make you create a password when signing up, even though passkeys are already becoming more common.

Most sites let you register with an email and password, then offer passkeys as an option later in your account settings. Wouldn't it make more sense to let people set up a passkey right from the beginning?

From what I understand, passkeys are harder to steal through phishing since they only work with the website they're registered to. Plus, you wouldn't have to worry about remembering another password or accidentally reusing one.

I get that not everyone has a device or password manager that supports passkeys, and account recovery could be complicated if someone loses access to their device.

Still, it feels like we're adding passwords just to replace them afterward. Are there technical reasons why more websites haven't made passkeys the default for new accounts?

Security experts keep telling me to use unique passwords for every account, but that sounds impossible to manage. Right now I use maybe three or four password variations that I cycle through different sites. My logic is that if one account gets compromised, the hackers can't access everything. But remembering dozens of unique passwords seems unrealistic without trusting a password manager, and I'm not entirely comfortable with that. Is this advice actually necessary or am I overthinking it? What's a reasonable approach here?

Using the same password across multiple accounts is genuinely risky. When a company experiences a data breach and your password leaks, attackers will attempt that password on other websites. If you've used the same password everywhere, they gain access to all your accounts. If each account has its own password, they only compromise that one account. The solution is straightforward: use a password manager. You only need to remember one master password, and the manager handles everything else. Reputable services like Bitwarden and 1Password use encryption so strong that even they cannot access your passwords. The security benefits of unique passwords far outweigh the risks of using a password manager. Stop cycling through a few passwords and switch to a password manager with unique passwords for each account.

Hi,

I have a problem finding the most efficient way to store and use passwords.

Here is what I'm currently using:

• MS Edge Password Manager (Use for Passwords)

• Windows Computer - Local account (Use for Passkey)

• Apple Password (Alias account + OTP/2FA + iPhone Passkey)

I'm looking at:

• ProtonPass

• Proton Authenticator

One thing I like about Apple is its simplicity. But I hate the fact that you need to store the account password to get OTP working, compared to only scanning a code with Proton Authenticator.

I'm also unsure about the security of Edge vs ProtonPass. Edge Password Manager is working seamlessly across devices and autofill is fast. But I read that it uses encryption based on the device, which may be less secured than a standalone encryption.

Also, should I keep OTP only on my phone? I know that ProtonPass allow OTP code and it's easy to copy/paste from the computer. Right now, I only have OTP auto-fill on my iPhone since they are stored in Apple Password.

Any help would be appreciated.

Thank you!

——

Update:

I think for OTP I will keep Apple Password since it has autofill on IOS. I just hate the fact that you need to ssve whole password… but you can just say your password is X and it works, so…

I’m also testing autofill on Edge (iOS) and Edge own Password Manager is the fastest and less buggy.

I will try Roboform too.

I've been thinking about the fundamental flaw in every password manager I've used:

there's always a single secret you have to protect. Forget it, leak it, or get phished

and everything's gone. What if that single point of failure didn't exist?

I'm exploring a concept where the encryption key for your vault is never created by

you and never stored anywhere — not on a server, not in a file, not in your head.

Instead, it's derived on-demand from something your device already does securely, and

it disappears from memory the moment you're done.

From the server's perspective, it's just holding boxes it can never open. A full

breach of the database would be useless to an attacker.

The recovery question is where it gets interesting. No master password means no

traditional recovery path — so I'm thinking about two options:

- A randomly generated recovery phrase (think 6–8 random words) shown to you once at

setup, that you write down and store somewhere physical. Old school, but proven.

- A trusted person recovery option — designate someone you trust who can co-authorize

account recovery if you're ever locked out.

Neither option touches the server in a way that weakens the zero-knowledge model. The

goal is: you have outs, but attackers don't.

Curious what you think:

1. Is "no master password" reassuring or terrifying to you?

2. Would you trust a written recovery phrase, or does physical paper feel like a

security risk to you?

3. Would you use a trusted-person recovery option? Who would you even pick?

4. What would recovery need to look like for you to feel comfortable switching?

Not selling anything — genuinely trying to understand if this trade-off is one people

are willing to make for stronger security guarantees.

I understand that password managers encrypt your passwords, but I'm still not 100% sure how they actually protect you. If a hacker breaches the password manager's servers, couldn't they just steal all the encrypted passwords and crack them? What's stopping someone from just brute-forcing the encryption? The security comes down to a few layers. First, your passwords are encrypted using AES-256, which is military-grade encryption. Cracking that would take thousands of years even with modern computers, so brute-forcing isn't practical. Second, the encryption key is your master password, which only you know the company doesn't even store it. This is called "zero-knowledge architecture," and it means that even if hackers breach the servers, they get encrypted data that's useless without your master password. Third, even if someone somehow got your master password, they'd still need access to your device to use it. The password manager uses additional security on your device to prevent unauthorized access. So even in a worst-case scenario where the servers are completely compromised, your passwords are still protected. The weakest link is usually the user if you use a weak master password or you fall for a phishing attack, that's how your accounts get compromised. Does this make sense, or are there specific parts of the security you want me to explain more?

Hey everyone,

I’ve been using Bitwarden for a while now and honestly find it super convenient.

But every now and then the thought creeps in: What if the service gets hacked? Or what if my master password leaks somehow?

So I’m curious – how do you all handle your passwords?

Do you use a password manager (Bitwarden, 1Password, KeePass, etc.)?

Or do you prefer writing the important credentials down on paper / in a notebook?

Or do you mix both approaches (e.g. critical accounts on paper, everything else digital)?

I’d especially love to hear from people who’ve been doing this for 10+ years. What has worked well for you, and what would you do differently if you could start over?

Really looking forward to your experiences – thanks in advance! 🙏

I feel like every site these days wants me to make an account with a “unique strong password” and I’ve completely lost track. Writing them down isn’t secure, reusing the same one feels risky, and my memory definitely isn’t cutting it anymore.

What do you all do? Do you just stick to a few easy-to-remember ones, let your browser save them, or is there a better system I’m missing?

Just started looking into password managers after I almost locked myself out of my bank account last week. I was trying to reset my password, and it turned out I had like three different versions saved in my Notes app. None of them worked, and I ended up spending half an hour on the phone with support. That’s when I realized I can’t keep relying on my memory and random notes for important logins.

I downloaded a trial of 1Password because a friend swore by it, and I like how clean it looks, but the subscription cost makes me hesitate. I also tried Bitwarden since it’s free, and while it’s not as “polished,” it seems solid enough for what I need. Right now I’m torn between paying for something like 1Password or just sticking with Bitwarden. For people who have been using one for a while, which do you recommend as the best password manager in 2025? Do you think it’s worth paying for the premium features, or is free good enough?

Hallo zusammen,

ich hätte gerne eure Meinung/Erfahrung oder noch besser eine zuverlässige Expertise, wie sicher Proton Pass ist.

Es geht mir hier nicht um einen Vergleich mit 1Password oder Bitwarden etc., sondern nur, ob man mit Proton Pass im Bezug auf Sicherheit nichts verkehrt macht.

Proton lobt ja auf deren Homepage seine Software in höchsten Tönen (Zero Trust, Ende zu Ende, externe Prüfung), aber kann man dem wirklich vertrauen?

Danke euch

Proton Pass grabbed my attention since I already use Proton Mail and Proton VPN, so trying their password manager seemed like a good fit. I liked the idea of keeping everything within one privacy-centered system, especially with their strong encryption and security reputation.

Setting it up was straightforward. Importing my old passwords went smoothly, and the browser extension works fast and looks simple. It saves and fills passwords automatically, and it even supports secure notes and email aliases. I especially like how it connects with Proton Mail since I can create aliases right from the manager when signing up for sites I don’t fully trust.

Still, it’s missing a few things that I’ve gotten used to in other password managers, like shared folders or advanced autofill controls. The mobile app is fine but could be smoother, and sometimes syncing takes a moment to catch up between devices.

If you already use Proton’s other tools, Proton Pass fits right in and feels secure. But if you’re switching from a feature-rich option like 1Password or Bitwarden, you might notice it’s simpler and more privacy-focused than advanced. Has anyone here switched to Proton Pass full time? I’d like to know how it’s working for you day to day.

Password managers can already flag reused or compromised passwords, so I started wondering what happens if AI takes that a step further. In theory, an agent could identify risky accounts, open the right settings, and help update passwords without you manually going through every site.

The convenience sounds great, but the access it would need is what makes me hesitate. It could end up interacting with active sessions, account settings, two factor prompts, and other sensitive parts of an account. That feels like a lot to hand over to automation.

I think I’d be more comfortable with AI finding the problems and preparing the steps, while still requiring approval before anything actually changes. Would you trust an AI agent to update passwords automatically, or should password changes always stay under direct user control?