A lot of the users in my company are using their agendas to write down their password and usernames, or Excel sheets with a protected password. I'm hesitant to install software for password management after reading recommendations/feedback on them. Is there any other secure and user-friendly solution to store passwords?

  • 4
    Maybe ask IT if they have a recommended solution. They may already have some software they allow.
    – Daisetsu
    Commented Mar 25, 2019 at 20:47
  • 104
    What is it about the recommendations/feedback that’s made you hesitant?
    – Ry-
    Commented Mar 25, 2019 at 21:48
  • 42
    This question reads exactly like "I want a password manager, but not a password manager." Hajar, I'm not sure what would satisfy you. Any sufficiently well made solution would be a password manager, so you're essentially limiting yourself anything that "works" for this purpose, but not well enough to be called a password manager". You're limiting yourself to half-baked hacks like those spreadsheets.
    – Alexander
    Commented Mar 26, 2019 at 16:11
  • 3
    Related: How to store passwords written on a physical notebook? Still, I'd recommend an offline password manager such as KeePass whenever possible.
    – tmh
    Commented Mar 27, 2019 at 10:55
  • 4
    Would you be hesitant to wear a bulletproof vest after reading about their shortcomings?
    – MonkeyZeus
    Commented Mar 27, 2019 at 12:36

13 Answers 13


Install a password manager. A good password manager is much, much better than anything you can do by yourself.

They are software created by security professionals, follow strict development rules, and are tested by a lot of people, and attacked by a lot of people. They have better chance of protecting your passwords than anything invented by the average, even the above average user.

  • 33
    how does one know which is a good password manage and if they actually follow all the strict development rules ?
    – Nigel Fds
    Commented Mar 26, 2019 at 1:06
  • 10
    @NigelFds Some, like Password, get audited by 3rd parties. support.1password.com/security-assessments
    – Schwern
    Commented Mar 26, 2019 at 1:35
  • 37
    @NigelFds Other example: KeePass It is open source can be audited my literally everyone and if you really wish you can even compile it yourself.
    – Mischa
    Commented Mar 26, 2019 at 8:31
  • 16
    @JesseM LastPass is a cloud-based password manager. This should immediately conflict with any sane company security policy. Also, LastPass had various security incidents and a breach. I wouldn't recommend it to anyone, not even for personal purposes. Stick to offline password managers.
    – scai
    Commented Mar 27, 2019 at 8:50
  • 27
    @scai "This should immediately conflict with any sane company security policy" Total BS. As long as proper encryption is used you can store your secrets anywhere, including the cloud. "Also, LastPass had various security incidents and a breach" Please read Schwern's answer and stop spreading FUD. Also: ALWAYS use 2FA (if you can / is supported by that website).
    – RobIII
    Commented Mar 27, 2019 at 15:42

You're probably referring to the recent articles about flaws in password managers.

Its right there in the titles, password managers have flaws and you should still use one because they're more secure than what many folks do, like keeping passwords in Excel, emailing them around, pasting them into chat where they'll be logged by everyone...

All software has flaws. Password managers, and security software in general, is held to a higher standard than run-of-the-mill software. The flaws these articles are talking about in password managers are not rookie mistakes, but risk trade-offs.

1Password has a write up about the latest flaw as well as a deep discussion on their forums. It's not a mistake as it is a consequence of a trade-off to avoid other worse memory bugs. The important bit is that your computer must already be compromised and you have recently typed in your master password. As jpgoldberg of 1Password put it...

...we need to consider that for this to enable an attack the attacker must

  1. Be in a position to read 1Password process memory when 1Password is locked
  2. Not be in a position to read 1Password process memory when 1Password is unlocked.

Number 1 requires that the attacker has already seriously compromised the device. Number 2 means that that the attacker (who has seriously compromised your device) only has that control at some oddly limited times.

If your computer is already so compromised an attacker can read 1Password's process memory they don't need this exploit. They can just wait until 1Password unlocks.

And if your computer is compromised, keeping your passwords in an Excel spreadsheet offers you no protection.

Password managers can do other things to add to your security.

  • Share and manage your passwords between all your devices, including mobile devices.
  • Share and manage passwords and credentials with co-workers.
  • Store more than just passwords securely.
    • GPG and SSH keys and passphrases
    • One-time password generators
    • Recovery keys
    • Security questions
    • API keys
    • Notes
    • Credit cards (arguably better than saving them on web sites)
    • Bank accounts
    • Memberships
    • Software licenses
  • Inform you of insecure passwords
    • Reused passwords
    • Password breaches
  • Generate secure passwords
  • Auto-fill passwords (avoids being shoulder surfed)
  • Auto-record new accounts
  • Protection against ransomware (if it stores your vault elsewhere)

These avoid bad practices such as reusing passwords, using weak passwords, sharing them via email or chat or a shared document, writing them down (whether on paper or a file), and continuing to use breached passwords.

  • 7
    Using an OTP generator (TOTP usually) from within a password manager secured with a good password (or even 2FA) is still better than not using that functionality, because the TOTP-seed becomes a second secret you need to know in addition to the user's password.
    – JeroenHoek
    Commented Mar 26, 2019 at 13:27
  • 1
    "(...) keeping your passwords in an Excel spreadsheet offers you no protection" -> actually, from what I know when you set a password on an Excel doc, modern Excel versions encrypt that using AES with PBKDF2 on top. This is quite very good, given that AES is not broken (as far as we know) and PBKDF2 makes it immune to brute-force attacks (as long as you have a good password). Commented Mar 27, 2019 at 10:43
  • 2
    @RaduMurzea But you can still see everyone's password, in the clear, without much effort: just enough physical access or even "over the shoulder". Worse: you can snap a few photos of it in an instant, and have an offline copy. Commented Mar 27, 2019 at 17:50
  • 1
    @RaduMurzea Yes, you could encrypt it (and I bet most don't) and that would give you a bit of protection... until you decrypt it. Decrypting the document decrypts the entire document leaving passwords in memory and possibly a temp file easily snapped up by generic malware which is the scenario in question. See Tschallacka's answer for more. We like to fixate on encryption for security, but breaking encryption is the last resort of the attacker.
    – Schwern
    Commented Mar 27, 2019 at 19:36
  • 1
    @IsmaelMiguel: Simple solution though: create your own font where characters are indistinguishable and use that in your Excel file! ;)
    – Flater
    Commented Mar 28, 2019 at 16:20

The safest place to store a password is nowhere. It should be a secure token that only exists in the memory of the holder. Unfortunately, many use passwords that is too simple and insecure, for the purpose of making it easier to remember. In contrast, more secure passwords are more difficult to remember (for most people). Adding to the complexity is the fact that many have dozens, sometimes even hundreds of passwords to remember.

Because of these issues, everyone should definitely use a password manager. Password managers prevent even physical access from compromising your passwords when you are not present.

And yes, while it is true someone could attempt to coerce you into revealing your password using threats or other means, the same is true for any other physical security token. For example, they could ask where the paper is that you record your passwords on, or the hardware security key that you have hidden away, etc. Coercion is a threat regardless of how the secret is stored.

The advantage of using a password manager with a master password stored only in your memory is that it reduces the threat of break-in while not at a given location (think: a Post-It on a monitor in the office). Another alternative is to always carry a master hardware key for your password manager, with it never leaving your side.

This leaves basically two secure options:

  1. Use a password manager and only keep the master password in your memory.
  2. Use a password manager and use a hardware key as the master password, under the assumption that you always carry it.

In either case, using a password manager is essential to improving security.

  • 5
    @lucasgcb - Proper password storage for comparison purposes should include cryptographic hashing along with salting, thus the password itself is never actually stored. Proper salting also prevents hash comparisons if you do use the same password for different services.
    – owacoder
    Commented Mar 26, 2019 at 12:03
  • 5
    I would disagree on the last point. We have significantly more experience with physically securing items and documents than we do securing data. Whether the physical security requirements are appropriate for the environment is another issue entirely.
    – Dan
    Commented Mar 26, 2019 at 14:45
  • 2
    @Dan - Agreed. We're on the same page I think. Both physical and computational security should be employed. I was just trying to highlight that our perceived and actual physical security often are not equal. We perceive our physical security to be much greater with a lock on the door, but realistically, that may just add a deterrent. Definitely agree with the likelihood of getting infected vs. being broken into, though.
    – owacoder
    Commented Mar 26, 2019 at 15:26
  • 2
    @lucasgcb the other side should most definitely NOT be storing your password. They should be using a hash of your password, salted at a minimum.
    – Baldrickk
    Commented Mar 26, 2019 at 15:33
  • 5
    It's not even true that the inside of the owner's memory is the safest place to store a password under all threat models. Storing an unmemorable or invisible password on physical media can make it harder to get the owner to disclose the password by coercive or deceptive means, which may or may not be more significant threats than ways of gaining access to the physical media.
    – Will
    Commented Mar 27, 2019 at 9:09

The encryption in Microsoft office documents is pretty good and secure for all intents and purposes, as long as you don't open the document, and don't have a security certificate pushed by an IT admin.

It does offer some weak points


Previously, if the original creator of a file password either forgot the password or left the organization, the file was rendered unrecoverable. By using Office 2016 and an escrow key, which is generated from your company or organization's private key certificate store, an IT admin can "unlock" the file for a user and then either leave the file without password protection, or assign a new password to the file. You, the IT admin, are the keeper of the escrow key which is generated from your company or organization's private key certificate store. You can silently push the public key information to client computers one time through a registry key setting that you can manually create or you can create it through a Group Policy script. When a user later creates a password-protected Word, Excel, or PowerPoint file, this public key is included in the file header. Later, an IT pro can use the Office DocRecrypt tool to remove the password that is attached to the file, and then, optionally, protect the file by using a new password. To do this, the IT pro must have all the following:

The IT manager or someone with access to the root certificates can decrypt all documents. So if a malicious attacker would be able to gain access to this, it could decrypt all the password protected documents.

There is the secondary problem of the temp files Microsoft Office. The moment the file is opened in Microsoft Office and the correct password is entered, Microsoft Office creates a temp file that displays the contents. Anyone browsing to this file can just select it and see the contents in the preview pane of Windows Explorer as long as someone has opened it.

In most windows networks its possible to just browse to the pc of a collegue and look into the documents on his/her pc or to any share they may have those documents on.

So in it's own, on the surface it might seem safe, but down below, someone just has to infect a workstation with a program that lies in wait for any encrypted documents it has access to be opened and then just read the contents of the temp file. And most people will just leave that password document open in the background once opened.

Most password managers have protections in place to only decrypt when needed and then store the password for a short moment into the clipboard before overwriting it, minimizing the possible exposure of the password.

In comparison, password managers offer more security.

  • 11
    By "all intents and purposes" what you actually mean is "not for all intents and purposes". Because if even a lousy sysadmin can access what you intend to protect, you've increased the social surface area of attack by at minimum a factor of 2, which is how passwords are cracked in many real world cases. That without taking into account the many flagrant software weaknesses provided by .norm password storage.
    – Oxy
    Commented Mar 26, 2019 at 11:42
  • 1
    Well, if it's made on a pc without the group certificate pushed, and only you know the encryption key/password, nobody will get to your documents as long as the file is closed. Best case scenario is that you store this document on a disconnected from ethernet, airgapped pc in a soundproof box within a faraday cage. It will protect documents against casual glancing at contents. Commented Mar 26, 2019 at 13:42
  • 1
    Note that the DocRecypt tool and temp files both don't apply to MS Access, thus that can be used to store passwords without this weakpoint. However, an added weakpoint for nearly all Office applications is COM automation. Any application can check if Office files are open and read their content if they are using COM automation, which is a lot easier than reading out the password manager memory and doesn't require any special privileges.
    – Erik A
    Commented Mar 28, 2019 at 11:05

Sure! Here's a scheme that will not get compromised very often, if executed perfectly:1

  1. Keep a list of sites you have passwords for. Put it somewhere secure enough.2

  2. Keep a list of passwords. Keep it folded in your wallet. Be vigilant about showing it when opening your wallet, or when using a password from it. Destroy passwords you've memorized.

  3. If your wallet is lost or stolen, enjoy the huge headache of changing all your passwords.

So, pretty much what a basic password manager does—memorability, mapping to sites, and confidentiality. It's just way more leg work than using a password manager. If you make mistakes doing this, it becomes far less secure than using a password manager. Given human fallibility, perhaps a password manager is better?

1 The main argument against this scheme is that you will eventually fall out of practice doing it, and it will be a huge mess when you need to actually change passwords.
2 'Secure enough' will vary greatly depending on your needs. Are you a boring person whose saving their bank credentials? A safe in your basement is probably fine. Are you hiding from the NSA? This scheme probably isn't sufficient, honestly.


I still heartily recommend using a password manager. If that is impossible, and all the following are true:

  • People can choose their own passwords.
  • No one has to share passwords.
    • (Protected Excel files make this seem unlikely.)

...then you could suggest a Password Card to keep in their wallet.

  • The caveat on password cards is that you must wipe them down after use. Most people trace their finger across the card as they track their password. This leaves an obvious trail for someone who obtains your card. Commented Mar 26, 2019 at 14:01
  • 1
    @Adonalsium TBF, the Password Card site does say that. "Don't read along with your finger, or the smudge will tell a thief where your password is." Commented Mar 27, 2019 at 11:11
  • 2
    @LightnessRacesinOrbit ... That's probably where I read that advice originally. Heck. Commented Mar 27, 2019 at 16:31
  • 1
    @dgnuff, If someone knows the seed that generated your card, maybe. But otherwise it's offline steganography. Commented Mar 28, 2019 at 10:59
  • 1
    @dgnuff Wouldn't there be extra entropy from choice of direction and # of characters? Yeah, I have to pick from 240 characters to start from, but then I pick a direction (8 inc. diagonals), and a number of characters (8-??? depending on whether/how I choose to wrap around).
    – Delioth
    Commented Mar 28, 2019 at 14:43

A spreadsheet encrypted with a password (say in Excel 2016) will use "ECMA-376 Document Encryption" by default which uses AES-256 bit encryption. Provided the password isn't a dictionary word, it would be no better or worse than any other password manager from a data risk perspective.

The spreadsheet would be FIPS-140-2 compliant and you would comply with the majority of encryption laws if they key or drive needed to be wiped with the secure wipe methodology as stated in NIST 800-88.

For a user managing a few passwords, I don't see a short term problem using Excel and a password, or a legal problem.

Long term, a password vault solution which allows check-in/check-out rotation, like CyberArk or Thycotic would be much better with logging and other capabilities. Something else to look at for free and simple is Buttercup.

  • Vulnerable to simple shoulder surfing.
    – Schwern
    Commented Mar 27, 2019 at 7:41
  • @Schwern not if they were very complex passwords
    – Ulkoma
    Commented Mar 27, 2019 at 20:47
  • 1
    @Ulkoma 1) The password may not be the user's choice; shared work passwords are often weak because they are shared in a way that is difficult to update, such as a spreadsheet. 2) Users and orgs who use spreadsheets to store passwords probably have poor password discipline. 3) (Here's the kicker) phones have amazing cameras. Good security has many layers so if one is breached, such as an easily remembered password, or if your assumption like "my password is too complex to shoulder surf" is wrong, you have other layers of protection to stop the attacker.
    – Schwern
    Commented Mar 27, 2019 at 20:55

Bruce Schneier on Write Down Your Password:

Microsoft's Jesper Johansson urged people to write down their passwords.

This is good advice, and I've been saying it for years.

Simply, people can no longer remember passwords good enough to reliably defend against dictionary attacks, and are much more secure if they choose a password too complicated to remember and then write it down. We're all good at securing small pieces of paper. I recommend that people write their passwords down on a small piece of paper, and keep it with their other valuable small pieces of paper: in their wallet.

  • Shocking to hear advice like this from Microsoft. Though, to be fair, it's from almost 15 years ago. Commented Mar 27, 2019 at 11:12
  • No, that's FUD. Read Schwern's answer. Commented Mar 31, 2019 at 18:01
  • A password manager is writing down your password and then encrypting it and then storing it where it will not be lost. We are not good at securing small pieces of paper, we lose them all the time. And with the increasing number of accounts you're going to have a very fat wallet.
    – Schwern
    Commented May 3, 2019 at 21:19

Your only solution is to select passwords, that are hard to break but easy to remember, then you don't need to write them down anywhere!

But seriously, maybe you can ask your IT support to install a password manager server for your whole company, then you don't need to install one on your machine.

  • 3
    I think that the hesitation is with using a password manager in general, not the local install.
    – schroeder
    Commented Mar 26, 2019 at 0:11
  • But usually the passwords are for something, often for resources on the web. So if you are sending the password through the web, you can also store it on a server that is accessible only internally in your company network, secured by your real password, multiple users can share passwords for some resources, bla bla, <insert advertisment for pwd managment servers here> :-)
    – Paris
    Commented Mar 26, 2019 at 1:06
  • The problem with this answer is that you cannot force users to do this. Sending something akin to the "correct horse battery staple" example (but more simply explained) as part of the policy may help them learn though. Commented Mar 26, 2019 at 16:24
  • @CaptainMan you could write a password policy that only allows dictionary words and has a large minimum length, but that was more of lame idea in case a password manager is really not wished. but i really believe offering everyone a decent password manager where they don't have to install anything will go a long way. i'm now at the first company that is using one and it is a big help compared to how it was handled in my previous jobs.
    – Paris
    Commented Mar 26, 2019 at 20:43
  • Sorry, this does not scale to reality in any kind of modern life. I have 130 passwords and I am a late adopter, and I actively seek to avoid passwords. It just never ends. Paperless billing? Password. Retail rewards program? Password. Pizza delivery? Password. Uber? Password. Have your tax refund not be hacked? Password. E-file? Another password. 401K? password. GP? Password. Specialist? Password. Lab? Password. Play a game? Password. Library card? Password. New car? Password. Buy a textbook? Password. You cannot keep track of them all without duping or writing down. Commented Mar 28, 2019 at 22:40

Many recommend password managers. I don't disagree, that is indeed sound advice, but there is another possibility.

It is fairly doable to let them record information on where to find the password without significantly weakening the integrity of the password - to most attack vectors. Have each bring a personal book (think: Alice in Wonderland or something), which are kept together in a single bookshelf and make every password a combination of 3-4 words from the book. You can then write down anywhere you like the page number, line number and word number of those words. Yes, password lookup will be slower but it will increase the security of your passwords against brute force attempts, it will ensure that physical access to the office is necessary, as well as a who's-book-is-which to break the code in addition to electronic access to their "stored" password. This is a huge improvement over storing the passwords in plaintext in a file on the workstation - which only needs a single successful phishing attempt to work.

As a bonus, the passwords are more secure and easier to remember. Obligatory xkcd

But, then again, if they can't be bothered to not write passwords down into an excel file - it can be a tough sell to establish a cumbersome procedure such as this. YMMV.

  • This is pretty dumb. Just write your passwords in a notebook and lock it in a drawer (or a fire-proof safe for critical passwords).
    – OrangeDog
    Commented Mar 26, 2019 at 17:49
  • It doesn't matter how passwords are stored, a single successful phishing attempt will always compromise them.
    – OrangeDog
    Commented Mar 26, 2019 at 17:49
  • @orangedog but not all of them.
    – Stian
    Commented Mar 26, 2019 at 19:13
  • I think you are confused about what a phishing attack is.
    – OrangeDog
    Commented Mar 26, 2019 at 19:15
  • @orangedog Hardly, it rather seems like I am quite convinced.
    – Stian
    Commented Mar 26, 2019 at 19:18

I agree with the other answers that a password manager is more secure than custom methods. Also note that protected Excel spreadsheets can be compromised easily than a password manager.

Having said that, If you have decided against using a password manager then you could use the following approach

  1. Have two password protected Excel files.
  2. Use different passwords for each Excel.
  3. Store the list of User names, services, etc... in one sheet and assign a unique number / test (eg: A001 for Adobe, S001 for Stack Overflow, etc...) for each record.
  4. Store the unique number and corresponding password in another Excel.

If you do not want a password manager program, print them out and store then in a safe or something secure rather than just a notebook like your co workers use.

  • 4
    This is fine as a backup for your super important passwords, like the password to your password manager, but for any day-to-day passwords you need them in a convenient and secure location. A safe will not cut it.
    – Schwern
    Commented Mar 25, 2019 at 23:57
  • 2
    Keeping the VPN password on a safe is not practical. For your bitcoin cold-wallet is fine, but not for everything.
    – ThoriumBR
    Commented Mar 26, 2019 at 1:53

This is not really answering the question about co-workers, but for personal use this works great if you really don't want to use a password manager (like me).

You can easily store it in your mind: but don't remember the passwords, remember a formula.

For example, start with a base word, let's say "Password", and think of a couple of custom rules:

  1. Number of letters in website name (Facebook: 8), and add it to the end.
  2. Capitalize matching vowels (Facebook: A and O)
  3. Replace the Nth character with a number equal to number of syllables (Facebook: 2)

You end up with P2sswOrd8.

You can now "store" an infinite amount of mostly unique passwords in your head (even with just 3 rules).

  • 7
    This really isn't a question about how to create memorable passwords. We already have a canonical question about that. Password patterns are inherently insecure, and your system does not account for needing to change the password. What do you do, change the rules for every password you have when you need to change just one?
    – schroeder
    Commented Mar 26, 2019 at 16:10
  • 3
    Your answer to the question is basically to use a password formula, and there is already an answer that covers that option. Your example formula has a lot of flaws, and I would not recommend this formula at all if I was recommending formulas.
    – schroeder
    Commented Mar 26, 2019 at 16:14
  • It was about storing credentials, and this is how I store them. When hacked, just use a backup base word. It's the password that got hacked, not the formula. Also, where did I pretend this is a perfect? The above rules are just an example, showing how easy it is to create unique passwords with even some simple rules that are easy to remember. And who knows, it may help OP. Commented Mar 26, 2019 at 16:31
  • 3
    Wait, so in your formula you still have to remember a unique word per site? How do you store that word? No, you are not storing anything, you are generating the password. And no, it is not perfect, it's not good either. There are far more secure patterns to choose.
    – schroeder
    Commented Mar 26, 2019 at 16:41
  • The entropy of this password generation method is dramatically low. If one knows your "formula", he only needs to know the base word and the target website name to deduce the password. If you rely on your formula being secret, once it's discovered (through retro-engineering of leaked passwords or social-engineering of yourself), one would be able to deduce all your past and future passwords. Remember that security through obscurity is an illusion.
    – zakinster
    Commented Mar 26, 2019 at 17:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .