Sign up ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

What's the solution to using safe passwords on numerous logins?

Using a dynamic password each time generally means you will need to store them somewhere and wouldn't be able to log into things without your list.

On the other hand, using the same password multiple times is dangerous because if any of the logins it was used on is compromised, you would have to change the password across a long list of other places. Assuming you used a "base" password and changed it someway specific to each place it's used, wouldn't a potential hacker be able to do the same?

I understand that the safest way is to have an encrypted password list and use a randomly generated password each time, but it's not very practical.

What do the computer aficionados of superuser do?

share|improve this question

closed as not constructive by soandos, Wuffers, iglvzx, Sathya Mar 2 '12 at 3:55

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

You do not need to strikethrough text when you edit. People can view the post's revision history by clicking the edited <time> ago link. – iglvzx Mar 2 '12 at 2:49
use lastpass – Sathya Mar 2 '12 at 3:54

3 Answers 3

up vote 1 down vote accepted

I have a different password for each of my "secure" functions - banking, domain logon, home network password, etc. I also have a generic password for insecure things that I really don't mind if they get hacked (forums, StackExchange, etc.) You shouldn't need to remember too many passwords this way, but it's still reasonably secure.

As for generating the passwords themselves, pick a "cypher" (replace characters, add symbols, change case, etc.), and keep it common between most of your passwords, it's easier to remember this way. Pick some words or phrases that are easy for you to remember (I used to make fake email addresses and use those), and put them through your cypher. Just make sure to keep your phrases at a decent length, I average around 14 characters (more is better). Shouldn't be too difficult to remember. Create a hint sheet (don't write down the actual passwords themselves) and put it in a secure location. After time everything will become muscle memory and you won't need to look at it much often.

May not be as secure as a 20 character string of random facerolling, but it's still pretty decent and easy to remember.

share|improve this answer
Great answer, this is what I have done for a long time. This looks interesting – Moab Mar 2 '12 at 3:13

What I do is use my domain name as a catch-all. Each website get's its own email address and each password uses the same randomly generated string of characters as a base plus an abbreviation and count for the name of the website.

So, my login information may look like:

password: 6v5wA6u8Yp9c s13e

password: 6v5wA6u8Yp9c f8b

I suppose the main advantage of this system is that when one account get's compromised, my other accounts will be safe; i.e. you can't pass one site's login information to another and get access to that account. It is also easy to remember since there is a pattern. I don't have any research to back up my claims, but it's something that works for me.

share|improve this answer
*is now paranoid* – iglvzx Mar 2 '12 at 2:53
There is a very reduced search space that will get the password for other accounts (equivalent to a four character password) – soandos Mar 2 '12 at 3:05
@soandos Didn't think about that. Good point. This Password Haystacks tool is neat. – iglvzx Mar 2 '12 at 3:06
what, no special characters?, only when your paranoid.. ;-> – Moab Mar 2 '12 at 3:17

Personally, I prefer passphrases (short sentences/phrases) without spaces and capitalizing each word (inspired by this xkcd). The advantage I suppose, that they are easier to remember and password managers wouldn't be required.

Not repeating your password across multiple domains is sound advice (but I'm guilty of not following this all the time, there are times when I have reused passwords across domains). Also, using OAuth as much as possible helps reduce the number of accounts that you need, which again is a good thing.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.