Is it crazy to keep all my passwords in one place?

Liz's monitor has a frame. Not a nice one: it's made of yellow sticky notes, and every single one says the same thing. “Pancake1.”

Dan suggests a password manager. Liz isn't having it.

“Keep all my passwords in one app?” she says. “Sounds like one big target.”

“Your notes all say the same thing,” says Dan.

“Pancake one. Easy!”

Fair enough. So let's follow Pancake1 and see where the real target is.

Follow one password

Liz uses Pancake1 at an online shop. One day the shop gets hacked, and its list of customers' passwords leaks.

Thieves don't stop at the shop. They take every email and password from the leak and try them on other sites: email, banks, photo accounts, shopping. Software does it automatically, site after site. Wherever Liz used Pancake1, the door opens.

This isn't rare. The US government's cybersecurity agency, CISA, tells the story of a woman hacked exactly this way: her password was in a company's leak, and she'd used it on another account too. Verizon's 2025 breach report found that signing in with stolen passwords was the most common way attackers first got in, at 22% of breaches. In 2023, attackers got into about 14,000 23andMe accounts with passwords recycled from other sites' leaks.

“So Pancake one is the big target,” says Liz. Exactly.

What a password manager does

A password manager is an app that makes a different strong password for every site, remembers them all, and fills them in for you. Something like k7#Qm2!x for the shop and R9$vT4&p for the bank. You'll never type them, so they can be as ugly as they like.

All of them are locked behind one main password: the only one you remember.

Now play the leak again. The shop gets hacked, and the thieves get the shop's password. They try it on Liz's email. Nothing. It only ever worked at the shop.

“But isn't it one big target?”

It is a target, and it's fair to ask. Password managers have been attacked. In 2022, LastPass said a thief had copied a backup of its customers' vaults.

Here's what that shows. The passwords inside were scrambled, and only each customer's main password could unscramble them. With a long main password, LastPass said guessing it would take millions of years. People with short, weak main passwords were told to change their stored passwords. (The website addresses in the vaults weren't scrambled, so the thieves could see which sites people had accounts on.)

So the vault isn't magic, and its main password is the whole lock. Make it long, a few random words strung together is a good start, and use it nowhere else. Even so, compare the two risks: a reused password leaks every time any site that has it gets hacked, and it opens all your doors at once.

You probably have one already

“Wait,” says Liz. “Doesn't my phone have one?”

It does, free:

• iPhone, iPad and Mac: the Passwords app (from iOS 18 and macOS Sequoia; on older iPhones, it's under Settings, Passwords). It suggests a strong password when you sign up somewhere, and its Security section flags passwords that are weak, reused or leaked.
• Android and Chrome: Google Password Manager, built in to Chrome on any computer or phone, and to Android. Its Password Checkup does the same flagging.

Most other browsers have one built in too. Paid managers add extras, like sharing passwords with family or working on every kind of device, but the free one is a big step up from Pancake1.

Add a login code

For the built-in managers, your “main password” is your phone's passcode and your Apple or Google account password. The last step is a login code, so that password alone can't open it. It's the same code you've seen when a site texts you one: we explain why it works in why websites text you a code.

• Apple Account: on your iPhone, open Settings, tap your name, then Sign-In & Security, and check that two-factor authentication is on. Apple turns it on for most accounts already.
• Google Account: open your Google Account, go to Security, and under “How you sign in to Google”, turn on 2-Step Verification.

The UK's National Cyber Security Centre puts it simply: with this on, even someone who knows your main password still can't get in.

What about the sticky notes?

Paper isn't the villain here. The NCSC says writing passwords down can be done safely, because a thief would need to be in your home, though anyone who can reach the notes can copy them. Liz's real problem was that every note said the same thing.

“So the sticky notes go in the bin,” says Liz. And then, because she likes to sum things up: “One strong main password, a different one for every site. Way safer than Pancake one everywhere.”

What you can do

• Open the password manager you already have (Passwords on Apple devices, Google Password Manager on Android or Chrome) and let it save your passwords as you sign in.
• Give it a long main password that you use nowhere else.
• Turn on login codes for your Apple or Google account.
• Change your reused passwords, starting with your email and your bank. Your manager's security check shows which ones.