Practical orientation for individuals, businesses, developers, and IT teams—not legal or security advice. Follow your organisation’s policy; many employers restrict or monitor password managers on work devices.
Most people reuse passwords. When one service leaks, others can fall too. This guide explains why that matters to you, what to do about it, and which tools we suggest starting with—including enough detail for developers and IT teams.
Why safe password management matters
One breach can unlock many accounts — Attackers test leaked email and password pairs across banks, email, shopping, and social sites—a technique called credential stuffing. Reusing passwords means a breach from years ago can still hurt you today.
You cannot remember enough strong passwords — Unique, long passwords for every site is the right goal and impossible to do in your head. That is normal, not a personal failing—a password manager exists precisely because humans are not databases.
Phishing targets everyone — A password manager will not autofill a fake login page whose address does not match the real site. That alone cuts a common attack path. Two-factor authentication adds another layer when passwords do leak.
The cost is real — Locked-out email, drained accounts, hijacked social profiles, or work access through a personal password reuse chain. Recovering from takeover is slow and stressful; prevention is cheap by comparison.
This is fixable in an afternoon — Install a manager, move critical accounts first—email, banking, main shopping—turn on 2FA, and save recovery codes. You do not need to migrate two hundred logins on day one.
Passwords fail in predictable ways. Many people reuse one strong password—or a few variations—across dozens of sites. Browsers offer to “remember” logins, which helps until you change device, share a computer, or lose access to that browser profile. Sticky notes, Notes apps, and spreadsheets do not sync safely and are easy to lose or leak.
Breaches are not abstract IT news. When a retailer, forum, or old service is compromised, email and password pairs often appear in public breach databases. Attackers automate login attempts elsewhere. If your Netflix password matches your email, shopping, or work single sign-on (SSO), you have handed them a key ring.
“One password I tweak per site” feels clever but rarely holds up. Humans fall into patterns—same base word, same year, same special character. Those patterns are guessable once one example is known.
Safe password management means every account gets its own long, random secret, stored in one place you protect well—plus two-factor authentication where the service allows it. That is the standard professionals use; it is equally appropriate for personal life.
The sections below cover what businesses should expect, which tools we recommend, and what developers and IT teams need to know—but the first step is personal. When you are ready, jump to the tools we recommend.
For businesses — treat credentials as risk
Account takeover is a business risk — Credential stuffing against corporate SaaS, email, and admin consoles is routine. Staff who reuse passwords between personal and work services can bridge a consumer breach into your tenant. This guide complements—not replaces—compliance-aware engineering on the platforms you build.
Offboarding and shared access — When someone leaves, shared passwords in spreadsheets or chat threads are hard to revoke. A managed vault with per-user access and audit trails reduces lingering keys.
Breach response starts with credentials — After an incident, rotating exposed passwords and session tokens is urgent. Teams with a central password manager and documented 2FA enrollment recover faster than those hunting sticky notes.
Policy should be explicit — Say whether approved password managers are allowed on work devices, which tiers (personal vs business vaults), and whether hardware keys are required for admin roles. Silence pushes people toward unsafe workarounds.
Train staff on phishing — Managers and 2FA reduce harm, but social engineering still works. Pair tooling with clear guidance: verify senders, report suspicious login prompts, and never approve multi-factor authentication (MFA) requests you did not initiate.
Vendor due diligence — Where vault data is hosted—Switzerland, EU, US—and whether the vendor can read secrets at rest matters to procurement and regulators. End-to-end encryption and published security models help security questionnaires.
What you ship reflects your values — Products that encourage OAuth over password reuse, support WebAuthn, and document secret handling are easier for enterprise customers to adopt. Credential hygiene in your own org supports that story.
If you skipped straight here: the goal is a unique, strong password for every account, plus two-factor authentication where offered. These tools make that achievable without memorising hundreds of logins.
Other password managers exist—Bitwarden, 1Password, KeePass, and more. We are not claiming this is an exhaustive list.
We highlight Proton Pass because it is maintained by a security-first vendor, hosted in Switzerland, offers a capable free tier, runs on all major platforms with browser extensions, and keeps your vault end-to-end encrypted with open-source clients.
Start with Proton Pass for passwords. Add Proton Authenticator—or 2FA codes inside Pass—for a second layer. Consider a hardware key later for your highest-value accounts.
You want a reputable, Switzerland-hosted password manager with a free tier, browser extensions, and apps for every device you use.
Proton Pass is a password manager from Proton AG—the same company behind Proton Mail and Proton VPN. The company is built around online security and privacy, with infrastructure hosted in Switzerland under strong data-protection law.
Your vault is end-to-end encrypted: Proton cannot read your passwords. Clients are open source, and the product is funded by subscriptions—not advertising or selling user data.
A free tier covers unlimited passwords, unlimited devices, passkeys, and built-in two-factor codes. Desktop and mobile apps plus browser extensions for Chrome, Firefox, Edge, and Safari keep logins in sync wherever you work.
If you already use Proton Mail or VPN, Pass fits the same account. Families and business plans add sharing and organisation features when you need them.
You want two-factor codes on your phone, encrypted and backed up, from the same Swiss-hosted provider as your password manager.
Two-factor authentication (2FA) means a site asks for something you know (password) and something you have (a code from an app, or a hardware key). Even if your password leaks, the account stays protected.
Proton Authenticator stores TOTP codes—the six-digit codes many sites show as “Google Authenticator compatible”—with end-to-end encryption and secure backup through your Proton account.
Proton Pass can also store 2FA codes inside the vault. Use the dedicated Authenticator app if you prefer codes separate from passwords, or use both: Pass for everyday logins and Authenticator where you want an extra split.
Turn on 2FA for email, banking, shopping, and social accounts first. Recovery codes matter: save them in your password manager when each service offers them.
Hardware security keys (optional next step)
For your most sensitive accounts—primary email, banking, cloud admin—a FIDO2/WebAuthn hardware key (for example YubiKey or similar) adds phishing-resistant authentication. The key proves possession without typing a code a fake site could intercept.
Register a key as a second factor on supported services; keep a backup key or recovery codes in a safe place.
Organisations often standardise on one vendor and provision keys through IT—personal keys and work keys should stay separate.
Not every site supports hardware keys yet; use a password manager plus an authenticator app as the baseline, and add keys where policy or risk warrants it.
You have seen what these tools do for everyday logins. This section covers building, testing, and shipping software without leaking credentials.
Proton Pass
Use a personal vault for side projects; never store production secrets in a consumer manager unless policy explicitly allows it—prefer team vaults or CI secret stores for shared infra credentials.
Browser extension autofill behaviour differs from manual entry—test login and signup flows with extensions enabled and disabled.
Passkeys and WebAuthn support is evolving; verify current browser and Proton Pass capabilities when you design auth for your product.
If you debug auth locally, use separate browser profiles so personal vault autofill does not leak into screencasts or shared demos.
Proton Authenticator
Register TOTP for staging and admin consoles; store recovery codes in your vault when the service provides them.
Do not commit TOTP seeds or backup codes to git—treat them like passwords.
When building 2FA in your app, support standard TOTP and WebAuthn; document recovery flows for account lockout.
If you build software
Never commit secrets — API keys, database URLs, and private tokens belong in environment variables, secret managers, or CI vaults—not in repositories. Scan commits with gitleaks or similar; rotate anything that ever landed in history.
Separate dev, staging, and production credentials — Unique passwords and keys per environment limit blast radius when one leaks. Your password manager is for human login; machine credentials often live in HashiCorp Vault, cloud provider secret stores, or GitHub Actions secrets.
OAuth and SSO over raw passwords — Where possible, users should sign in through identity providers rather than storing another password in your database. If you must store passwords, use slow hashes (Argon2, bcrypt) and never roll your own crypto.
Rotate on departure — When someone leaves the team, revoke their SSO, rotate shared service accounts they knew, and review CI tokens tied to their user. Personal password managers should not be the system of record for production infra.
Test like a security-conscious user — Verify your app works with password manager autofill, passkeys, and 2FA enrollment flows. Broken copy-paste or aggressive session timeouts push people toward weaker habits.
Password managers and authenticators are standard security tooling. Blocks are often policy-driven or based on outdated allow-lists. Verify endpoints against vendor documentation before production changes.
Proton Pass
Traffic to Proton services uses proton.me and related Proton-documented hosts for sync and updates. Verify current endpoint lists in Proton’s documentation before production allow-lists.
End-to-end encrypted vault: Proton cannot decrypt user secrets for lawful access in the same way a plaintext store could—understand implications for e-discovery and support workflows.
Desktop and mobile apps plus browser extensions; treat extensions as part of the software inventory if policy requires approval.
Proton for Business offers organisation features—evaluate against SSO, SCIM, and admin requirements separately from the free personal tier.
Proton Authenticator
Mobile app; encrypted backup tied to Proton account. Confirm whether personal authenticator apps align with MFA policy for corporate tenants.
Standard TOTP (RFC 6238)—compatible with most services that show a QR code for “authenticator apps.”
For high-assurance roles, pair software TOTP with hardware FIDO2 keys where policy requires phishing-resistant factors.
Hardware security keys
FIDO2/WebAuthn keys (YubiKey and similar) register per service; users need backup keys or recovery codes to avoid lockout.
Enterprise deployments often standardise on one vendor, provision through MDM, and require keys for VPN, email, or cloud admin.
Allow-listing is usually unnecessary for key crypto itself; focus policy on which services must accept keys and how lost keys are replaced.
