Hi, this is Gary with MacMost.com. Let me tell you
why storing your passwords in a note or a document is a bad idea.
MacMost is brought to you thanks to a great group of more than 1000 supporters.
Go to MacMost.com/patreon. There you can read more about the Patreon Campaign.
Join us and get exclusive content and course discounts.
So recently I've notice a lot of people saying that they like to store their
passwords in a note in the Notes App or perhaps in a Numbers or Pages document.
Now when you do that you can keep is secure by adding a password to it and, of course,
your entire Mac account should be secure because you have a password on that. So the security
of those passwords really isn't an issue. Still there are some important things that
you're missing out on when you're using a note or document to store passwords rather than using a
Password Manager like Apple's built-in Password Manager or a third party password manager.
The first is that Password Manager's allow you to create strong unique random passwords.
If you're storing your passwords in a note or document chances are you're just creating
the passwords on your own and even if you think they're random then they're not. They're probably
not long enough and strong enough. Now when you go to a site like this one and you go to create
a new account you select an email like that and then you go to create a password. You're going to
get prompted here to use a strong randomly created password. You can see part of it entered in here.
You can simply say Use Strong Password. Now this password is going to be very hard to
break because it's just too long and too random. The problem is, of course, typing it in. But you
don't have to worry about typing it in because the Password Manager will take care of that for you.
Now another thing that Password Managers will do for you is store the password automatically.
So at this point if you were saving your password in a note or document you would have to copy the
User ID, the password, go over to that note or document and record it there manually.
But, when I simply register with this password at the site
now that is stored in the Password Manager. So in this case I'm using the default Password
Manager included with macOS and when I go look at that I can find it right here
and I can see its recorded that password for me. I don't have to do any additional steps and there
is no chance that I would have forgotten to do it in quickly setting up an account at a site.
Now another thing a Password Manager does for you is it easily allows you to auto-fill the password.
So in this situation where I want to login if I was storing them in a note I would have to go to
the note and copy the ID, copy the password, and put them in each of these fields. But the password
manager does that for me. I can go into here, and in fact, it will show me if I have multiple
ID's assigned to this site, select that one and you could see it filled in the password for me.
I didn't have to type it in. I didn't have to copy and paste it in and maybe make a mistake,
and now I can login. So this saves you a lot of time particularly for sites that are very secure
and ask you to login all the time. Like a bank should ask you to login each and every time. It
shouldn't leave you logged in for a long period. That means you'll be entering your password in all
the time and having to go back and forth between the document and the login page to do that.
Now here's probably the most important thing that a Password Manager gets you. Its
protection against a phishing attack. So in a typical website password phishing attack you'll
get a link somehow, maybe in an email, maybe in a text message, maybe from another site,
and you click on that link to go to login. Maybe the email makes it seem urgent like there's an
invoice for an expensive purchase that you didn't make or your account has been compromised and you
have to logon right away. So you click on it without thinking. Now you get to a page that
looks like this. The page looks perfectly like the login page for the site you want to go to.
A quick glance here at the URL shows you that it is, in fact, the right site. Except its not!
You can see here that it goes on and the actual domain is this odd thing here. Perhaps you catch
that nine times out of ten or even 99 times out of a 100. But that's not enough. You have to
catch that 100% of the time. These could be really tricky to spot. So then you could go here to sign
in and you would go and copy your ID, copy your password, place them in here and then you would
be handing that information to whomever is trying to steal it from you. You may never even realize
your mistake because they may simply redirect you with a fake error message to the actual site where
you go and enter them again and you successfully login and find there's no problem. You don't
remember that you actually gave your password twice and the first time was to a bad actor.
But this won't happen with a Password Manager. Because a Password Manager says, oh you're at
this site, do I have a password for that. No I don't. So you go to use the password from the
Password Manager and it doesn't appear. Something is wrong. Now that prompts you to take another
look here to see that, oh this is the wrong site, somebody is trying to trick me. The Password
Manager doesn't find a match and therefore it has protected you from this phishing attack.
Another thing a Password Manager will do for you that a note or document will not is it will
tell you if a password has been compromised or maybe it's too weak. For instance, in this case
this password here is too weak and it's telling me it is easily guessed. It puts a little caution
symbol there and it prompts me to do better. If the password is compromised, say somebody stole
a database of passwords from a big site, then it would also show that up here and you would know
about it and be able to make the change. A note or document is not going to do that, of course.
Here's one last thing that a Password Manager will do for you. This is fairly
new for most Password Managers including Apple's built-in one. You can see here
if I go into Edit you can see there is Verification Code and I can enter a setup key.
This is for two-factor authentication. For a lot of sites they are using standard
two-factor authentication which means you have to enter in this six-digit code
to get into the site. This makes it much harder for somebody else to break into your account.
Password Manager's have this feature will not only allow you to fill in your ID and password
but also your two-factor code making it easier than ever to use two-factor codes. If it's easier
to use two-factor codes that means you could use them more often. They won't be as inconvenient.
Meaning that your account will be that much more secure. A note or document isn't going to have
that so it's going to make it inconvenient to use two-factor codes a lot of the time and you
may be tempted to skip using them every once in a while making your online accounts more vulnerable.
So there are some great reasons why you should absolutely use a Password Manager, even just
Apple's built-in Password Manager, instead of storing your passwords in a note or a document.
However, if you want to store some of your most important passwords in a note or document
as a backup, sure, it's always good to have backups for those kinds of things.
But your primary place for storing them should be a regular Password Manager.
Hope you found this useful. Thanks for watching.