The rapid widespread yet inconsistent adoption of digital technology throughout the early 21st century has resulted in many of us interacting with multiple fractured digital systems. Managing access to our digital assets stored within these disjoint platforms and services makes protecting our assets and identities an increasingly arduous task. In the event we discover that our credentials have been compromised or our assets were stolen or corrupted, the damage has already been done, and all we have left is to figure out how to recover in the aftermath. Instead, we must adopt a proactive approach.

The Challenge

There is a potential upside to relying on decoupled systems. We can add a layer of protection and minimize each attack surface by using long unique random credentials for every system we interact with. This poses a different problem we need to deal with:

How do I remember my credentials for the 250 accounts I created?

This problem compounds with the adoption of additional authentication protection schemes such as multi-factor authentication (MFA). The overhead required for accessing to our own assets is becoming increasingly difficult and expensive. The answer is simple: do not rely on your memory to store and recall your digital account information. Instead:

Use a Password Manager.

Digital Security

Our desire to grasp for a sense of control is strongest when we feel vulnerable to threats we do not fully understand.1 Malicious digital attacks emanate from vague and anonymous sources; they pose exactly this type of threat to us. We don’t know our adversary, where they might originate from, or when they might attempt to gain unauthorized access to the assets we value and protect. While reacting to these perceived threats, it seems natural to reach for protection schemes we understand and control. However, it is foolish to assume any one of us can outwit a sophisticated targeted hacking attack by using a secret pattern or custom solution that someone have devised on their own. The fundamental principle of cryptography is simple: system or algorithm obscurity does not provide security. In other words, obscurity creates a false sense of protection from a system vulnerable to algorithm-based reverse-engineering attacks.2 Instead, cryptography relies on the “open design” paradigm. The National Institute of Standards and Technology (NIST) provides a definition for the fundamental principle of open design: “system security should not depend on the secrecy of the implementation or its components.” 3

The severity and frequency of sophisticated digital hacking attempts has dramatically increased over the past decade, and the magnitude and scale of these threats are accelerating. AI-powered targeted corporate phishing attacks increased by 3000% in 2024, and 77% of hacking-related breaches used stolen credentials in the same year.4 As of 2025, 60% of data breaches involved a human element.5 In the near future, the development and proliferation of quantum computers and algorithms will result in an exponential reduction in the time required to undermine the current pervasive classical computing encryption methods.6,7,8 There is a silver lining: the same technology used to enable sophisticated malicious attacks is being applied to detect and prevent them.

Password Managers

Password managers employ multiple tactics to help us protect our digital assets and identities. Now is the time to become proactive by adopting a password manager. Password managers provide many benefits for protecting your credentials and sensitive personal information:9

Passkeys • Password Generators • Secure Notes • One-time access codes • Hardware Security Keys • Biometrics • Watchtower • Recovery Keys

Passkeys

Passkeys provide the strongest protection against unauthorized access into digital systems. They are built on the FIDO2 protocol, which uses state-of-the-art asymmetric encryption algorithms to validate your identity without requiring the process of transmitting and validating a user’s account credentials or password. This is the reason why NIST recommends adopting Passkeys where possible.10 Passkeys are becoming the most prevalent form of passwordless authentication. Password managers implement the FIDO2 protocol to securely generate and manage account passkeys for you.

Unique Random Passwords

Generating a unique random string of at least 15 characters is the most effective method for creating a password. As NIST states, “the most important part of a good password is its length. Every additional character dramatically increases the number of guesses an attacker would need to try.”10 Password managers provide secure and customizable random password generators to manage and store your account passwords, so you do not need to remember them or write them down.

Account Recovery Keys

Password managers provide account recovery keys. These are very long complex random keys that you can use if you forget your main passphrase or need to unlock your account. Print and store a physical copy of these keys in a secure location so you can find them if necessary. These keys are meant to provide a back-up option to regain access to your account. These keys are typically one-time use only, so make sure to have the system regenerate a key if you’ve already used it!

Configure One-Time Access Codes

Password managers provide support for multi-factor authentication when you need to validate your account credentials in a system. They can generate MFA-compatible one-time access codes for this process. This provides an alternative to relying on SMS text messages or e-mail for receiving one-time account access codes.

Consider a Hardware Security Key

A Hardware Security Key (HSK) is a physical device used to unlock access to a digital account. It provides a digital analogy to a physical key. Password managers may be configured to be unlocked by this HSK instead of a main passphrase.

Use secure biometrics

Considering enabling biometrics on supported devices for faster secure access to accounts. This provides an easier way to unlock password managers and other protected apps on mobile devices. When enabling biometrics, understand how the data is stored and shared. Many smart phones protect personal biometrics data with special embedded hardware called a secure enclave.11

Keep notes secure

Many password managers support maintaining secure notes which use the same protection mechanism to store your credentials. This secure notes vault is a great place to keep sensitive personal identification information.

Enable Watchtower

Many password managers provide “watchtower” services, where the password manager services monitor known data breaches to determine if your credentials have been compromised.12 They will scan public credential data dumps for matches with your credentials to notify you of a potential security breaches or compromised passwords.

Risk Assessment

Threat modeling is a useful technique for assessing relative risk by understanding system vulnerabilities and potential attack surfaces. The Open Worldwide Application Security Project (OWASP) Threat Model provides a well-defined procedure for performing this risk assessment.13 Understand your own use cases and how secure each account and system must be. In many cases, a “one size fits all” approach will not produce the desired outcome. Similarly, we don’t need the highest level of security to protect all of our accounts. There are cases where multi-factor authentication is not required, especially for shared low-value accounts, systems, and data. In these cases, using system and account credential isolation will help prevent against extensive account takeover attacks.14 Your personal risk profile will determine which approaches are the best fit for you.

* * *

Storing credentials and secrets in a centralized location may feed the perception of taking on additional risk. However, using a password manager is far safer than:

  • Reusing the same password across accounts
  • Writing passwords in a notebook or on sticky notes
  • Saving passwords in unprotected spreadsheets or notes apps.

“A password manager reduces your overall risk by helping you create stronger passwords and avoid reuse, two of the biggest causes of account compromise.” 9

Further Reading:  “What Is A Password Manager?”


Works cited

  1. B. Brown, A. Grant, “Uncertainty is Not the Enemy”, The Curiosity Shop with Brené Brown and Adam Grant, Vox Podcast Media Network, Apr. 2026.
  2. P. Meunier, “CWE-656: Reliance on Security Through Obscurity”, Common Weakness Enumeration, MITRE Corporation, Jan. 2008.
  3. K. Scarfone, et. al., NIST SP 800-123, National Institute of Standards and Technology, Jun. 2008.
  4. “Why Passkeys?”, FIDO Alliance, 2024.
  5. “2025 Data Breach Investigations Report”, Verizon Business, 2025.
  6. “8 Quantum Computing Cybersecurity Risks and How to Prepare”, Palo Alto Networks, 2026.
  7. S. Susnjara, et. al., “What is quantum-safe cryptography?”, IBM, Apr. 2026.
  8. “Post-quantum cryptography”, NIST, 2026.
  9. “What Is A Password Manager?”, National Cybersecurity Alliance, May 2026.
  10. “What is a Passkey?”, National Institute of Standards and Technology, 2026.
  11. “Biometric security”, Apple, Dec. 2024.
  12. “Don’t fear the dark web”, 1Password, 2026.
  13. “Threat Modeling”, Open Worldwide Application Security Project (OWASP) Foundation, 2026.
  14. “What is account takeover?”, Cloudflare Inc., 2026.