Using a password manager and passkeys

3 min read · Updated on 19 October 2026

Nobody remembers fifty unique, long passwords. That's why people reuse one, and that's why phishing works so well: one stolen password opens ten doors. A password manager creates a unique password for every service and fills it in for you.

Which one?

• Microsoft Edge and Google Chrome have a built-in password manager that syncs encrypted between your devices and warns you about leaked passwords.
• Microsoft Authenticator fills in the same passwords on your phone.
• A separate service such as 1Password or Bitwarden is useful if you want to share passwords within a team.

Getting started

1. Turn on saving passwords in your browser or password manager.
2. Let it suggest a strong password for every new sign-up and accept it.
3. Over the coming weeks, replace your reused passwords, starting with email, banking and services with payment details.
4. Protect your phone and computer with a PIN or biometrics: the password manager is only as secure as the device.

Passkeys: one step further

More and more services, including Microsoft, support passkeys. You sign in with the fingerprint, face or PIN of your own device, and there is no password left for anyone to intercept. A passkey only works on the real website, so a fake site can't use it. If you see the option, turn it on.

Two rules

• Don't store your work password in a personal password manager or in the browser of a personal computer.
• Never share passwords via email, Teams or WhatsApp. Use the password manager's sharing feature.