Where should I keep my website passwords and recovery codes?
The short answer
In a password manager, such as 1Password, Bitwarden or the one built into your browser or phone, with two-factor authentication turned on. Keep account recovery codes somewhere safe offline as well. Don’t keep passwords in spreadsheets, documents or email.
A password manager creates a different strong password for every account and fills it in for you, so one leaked password doesn’t open everything. Most let you share selected logins with staff safely.
- Turn on two-factor authentication for the password manager itself.
- Save the recovery codes each website account gives you when you turn on two-factor authentication. Without them, losing your phone can lock you out.
- Use a business email address you control as the login for business accounts.
Words used here
- Two-factor authentication (2FA)
- A second check when you log in — usually a code from your phone. It stops most account takeovers. Turn it on for every provider.
- API key / secret key
- A password that lets one service talk to another automatically. Treat it like a bank PIN: never paste it into emails, chats or documents.
- Rotating keys
- Replacing a secret key with a new one and switching off the old one, so anyone who had the old key is locked out.
Still have a question?
Ask the SlopDox assistant: it answers from this catalog, any time. Or let SlopDox keep track of your websites for you, free for up to 3 websites.