Too many passwords? Here is a solution!

How many sites do you log into? Bank, email, shopping, work tools, social networks — each one wants a password, and serious sites add rules about length or character types.

You already know not to use the same password everywhere. Recycling variants (david1, david2, david3) is not much better: one leak still maps to the rest. For what weak choices look like in the wild, see Passwords used by the Conficker worm.

The real solution: a password manager

Do not try to memorize a unique strong password for every account, and do not invent a personal “scrambling formula” that an attacker can reverse once they see a few examples.

Use a password manager instead:

1. Install a reputable manager — Bitwarden (free, open source), 1Password, or KeePass are solid choices.
2. Create one strong master passphrase you can remember (several random words — see how to make passwords strong).
3. Let the manager generate a long random password for each site and store it in the vault.
4. Turn on two-factor authentication on the manager itself, then on email, banking, and other high-value accounts.
5. Fill logins from the vault (browser extension or app) so you are not typing secrets into the wrong page.

That is it: one secret you memorize, unique secrets for everything else, and less phishing surface because you are not pasting passwords from memory into suspicious forms.

Why this beats clever schemes

Homegrown formulas and reused bases fail the same way weak passwords do — predictability and correlation. A manager gives you true uniqueness without a notebook full of sticky notes. For day-to-day habits (shared machines, phishing, writing secrets down), see 5 tips to help keep your passwords secret.

Manager choice still matters. Vault breaches happen; pick a vendor you trust, use a strong master passphrase, enable 2FA, and be ready to migrate if needed — a lesson from saying farewell to LastPass.

What to do next

• Pick a manager and move your most important accounts first (email, then banking, then everything else).
• Change any password you have reused.
• Prefer passkeys where a site offers them; keep the manager for everything else.
• Keep the vault backed up according to your manager’s guidance so a lost device does not lock you out of your digital life.