You might be tempted to save login details in spots that are quick and convenient, such as your phone's notes app, an email or a document on your computer. But if your device is lost, stolen or hacked, those shortcuts could make it much easier for someone else to access your accounts.
Below, backed by advice from the experts at Which? Tech Support, we explain which password storage habits to avoid and how to keep your login details safe.
Already a Tech Support member? For more help and 1-2-1 technical advice, including advice on malware and scams, go to our .Question of the month: Where should I keep my passwords?
'I have hundreds of passwords for websites, apps and online accounts – and the list is growing.
'At the moment, I save them all in a Notepad (.txt) file on my computer because it's easy to update. But I'm conscious it probably isn't the safest way to keep them. What would you recommend instead?'
Avoid storing your passwords here
Unencrypted USB sticks
Keeping a list of passwords on a USB drive might seem safer than writing them on paper, but if the drive is lost or stolen, there's a risk that someone else could access your passwords.
Anyone who plugs an unencrypted USB drive into a computer may be able to view the files stored on it. If those files include passwords for your email, banking or shopping accounts, that person could gain access to them.
If you need to store sensitive information on a USB drive, it's worth encrypting it first. That means only someone with the password will be able to open the files.
To encrypt your USB drive, plug it into your PC and follow these steps:On Windows 10 Pro and 11 Pro Control Panel BitLockerDrive EncryptionTurn on BitLockerUse a password to unlock the drive On macOSFinderEncrypt [drive name]Encrypt DiskFor more step-by-step guidance, including the free software we recommend if you have a home edition of Windows, see our walkthrough on .Unprotected notes on your phone
Many people keep passwords in the Notes app on their smartphone. While apps such as Apple Notes let you lock individual notes using your device passcode, Face ID or Touch ID, they aren't designed specifically for managing passwords.
Dedicated password managers can generate strong passwords, autofill them securely and alert you if your credentials are exposed in a data breach. Keep scrolling to find out more about password managers.
If someone gains access to your unlocked phone, they could open any notes that aren't protected. Many notes apps also sync across multiple devices. That's useful if you want to access your notes from your phone, tablet or computer, but it also means the same passwords could be available on every signed-in device if one of your accounts is compromised.
If you keep passwords in Apple Notes, make sure you lock the note by following these steps:Notesthree horizontal dotsLockUse iPhone PasscodeCreate PasswordEnableFace IDTouch IDunlocked padlockOur guide on explains how to track and protect your phone.Shared cloud storage folders
Cloud storage services such as Google Drive, OneDrive, Dropbox and iCloud Drive make it easy to access your files from anywhere. They're great for sharing documents with family, friends or colleagues, but it's easy to forget who can still see a file months or even years later.
A document containing passwords could be shared with the wrong person by mistake, or left accessible through an old sharing link you've forgotten about. Even if you only meant to share one file, the wrong sharing settings could leave it visible to more people than you intended.
If you keep passwords in cloud storage, it's worth checking who can access the file. Remove any people or sharing links you no longer need and, where possible, move your passwords into a dedicated password manager instead.
To review your sharing settings, follow these steps:On Google Drive My Drivethree vertical dotsFile information DetailsWho has accessManage accessOn iCloud DriveShared Manage Shared Filethree dots Remove AccessShare Options Stop Sharing On Microsoft OneDrive SharedBy youthree dotsManageaccessPeopleGroups LinksX buttonOur guide on has more details.Plain text documents on your computer
Saving your passwords in a Word document or plain text (.txt) file might seem like an easy way to keep track of them, but if the file isn't protected, anyone who opens it can read everything inside.
They're also easier to find than you might think. If someone gains access to your computer, either because it's been stolen or infected by malware, they could use Windows Search or Finder on a Mac to look for files with names such as 'Passwords', 'Logins' or 'Accounts'. They could also search your files for terms such as 'password', 'username' or 'Pin'.
It's common for people to keep other sensitive information in the same file. Alongside passwords, a criminal might find memorable questions and answers for banking accounts, Pin reminders or recovery codes. This means they may have enough information to access multiple accounts or even impersonate you online.
An unlocked laptop
Leaving your laptop unlocked, even for a couple of minutes, can be enough for someone to access your passwords or copy sensitive information.
Whether you're working in a shared office, a café or at home, it only takes a moment for someone to glance through an unattended laptop. Getting into the habit of locking your screen whenever you step away is one of the simplest ways to protect your accounts and personal information.
To make sure your laptop locks itself automatically, follow these steps:On WindowsSettings AccountsSign-in optionsSettings System Power & batteryScreen and sleepOn macOS System Settings Lock Screen Windows + LControl + Command + QIn an email
You might save passwords in an email to yourself or an email draft as a quick reminder, but your email account is one of the most valuable targets for cybercriminals. If someone gains access to it, they may find passwords or other login details. They could also use it to reset passwords for your other online accounts.
Instead of storing passwords in your inbox, delete any emails containing login details once you've finished using them and save the information in a trusted password manager instead.
If you think you've emailed yourself passwords in the past, spend a few minutes searching your inbox for terms such as 'password', 'login' or 'username', as well as the names of your most important online accounts. Delete any messages you no longer need.
A compromised inbox puts your personal data at risk, so find out .Try a password manager
'Trying to remember dozens of strong, unique passwords isn't realistic for most people, which is why a password manager is one of the safest and simplest options.
'Instead of keeping passwords in notes, emails or documents, a password manager stores them in an encrypted vault that's protected by a single master password. Most password managers can also generate strong, unique passwords for every account and fill them in automatically when you sign in.
'If you're already using antivirus software, it's worth checking whether your subscription includes a password manager. Some packages include one as part of the service, although the features can vary. Just bear in mind that if you later switch antivirus provider or let your subscription expire, you will need to move your saved passwords to another password manager to avoid losing access.
Callum Pears, Which? antivirus software expertJoin Which? Tech Support
Which? Tech Support can help you keep on top of your home tech. Our experts explain things clearly so that you can resolve issues and feel more confident using your devices.
Get unlimited 1-2-1 expert support:By phoneBy email By remote fixIn print Which? TechJoin .source https://www.which.co.uk/news/article/places-you-should-never-store-your-passwords-aAOLf3H9vTbd