Sometimes we cannot avoid to write down usernames and passwords internally in our organisation. This is mainly for personal usage, not for reading by programs.

There are several ways to do this, e.g.

  • username/password
  • username, password
  • "username","password"

All of them and more are used in the field. What is the "best" way to do this we can recommend internally in our organisation? Are there pros/cons for each alternative or should we leave users create their own style?

closed as unclear what you're asking by ThoriumBR, schroeder Nov 26 '18 at 20:20

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • This is going to be primarily opinion based because there is no security standard when it comes down to writing down credentials: Best practice is to not write them down at all. To give some advise though: When you do write credentials down, fold the paper so you cannot see the credentials (when looking through windows, for example). – Kevin Voorn Nov 26 '18 at 16:37
  • Thanks, how to handle the sheet when everything is written down is one thing (folding, covering,...). The other is how to write down. – WeSee Nov 26 '18 at 16:39
  • "Best" in what way? Best for what? How would the punctuation used make a difference? – schroeder Nov 26 '18 at 20:20

There is no best practice for writing down passwords (or credentials in general). This mostly depends on your own company and how you decide to write them down, I don't see any reason to have rules in place for standardized credential writing. The advise in general is to not write down credentials at all. If you must write down credentials, there are a couple steps you can take to improve security.

  • Use two factor authentication so that if credentials are leaked, your accounts are still somewhat secure;
  • Make sure to have a standard when it comes down to writing down credentials and the disposal of papers with credentials on it. You can for example have a standard paper for writing down credentials and a special bin to remove then;
  • Fold paper with credentials on them so other people cannot as easily read them by looking at them from a distance.

One of your main problems will be a violation of 'clean desk policy' which you can look and why it is important and things like bin diving.


To me, it seems the best, simplest, and most standard solution here would be to use a centralized, secure password manager. Is there some reason not to?

I should add the caveat, though, that the truly “best” solution can only be determined through knowledge of your organization. Every organization’s particularities define what works for it, so it’s important to optimize for your own org.

Not the answer you're looking for? Browse other questions tagged or ask your own question.