Password Manager - Any Opinions

Jules

SF VIP
Passwords are a colossal PITA. Every so often I consider the merits of a password manager. They’re very reasonably priced at $2 - $5 a month.

We’re strictly an Apple community in our house now. Some opinions are that this and 2FA are reasonably safe.

There are some passwords that I’d never have in a manager of any sort.

If you have a password manager and decide to leave it, how do you get their generated passwords back.
 

I have a spreadsheet with all my passwords in it. It is easy to update.To come up with new passwords, I have a book of hundreds of single malt scotch distilleries. I use their names as passwords, along with numbers and special characters.
 

What's wrong with Apple Passwords (built-in)?

On Apple devices, the Passwords feature (built into iOS, iPadOS, and macOS) lets you look up stored passwords, but there are security restrictions:
  • Accessing Passwords
    • On iPhone/iPad:
      • Go to Settings → Passwords.
      • Authenticate with Face ID, Touch ID, or passcode.
      • You can browse saved accounts and passwords for apps and websites.
    • On Mac:
      • Go to System Settings → Passwords (or Safari → Preferences → Passwords in older macOS).
      • Authenticate with your Mac password or Touch ID.
  • Search Function
    • There’s a search bar at the top. You can type a website, app name, or account name.
    • Matching accounts appear, and you can view the stored password after authenticating.
  • Security
    • Passwords are encrypted end-to-end, so you can only see them on devices where you’re signed in with your Apple ID.
    • Apple cannot see your passwords.
    • If your device is locked or offline, you can’t retrieve them without authentication.

Note:

  • If you enable iCloud Keychain, your passwords sync across all your Apple devices automatically.
  • If you don’t use iCloud Keychain, passwords stay only on that device and can’t be looked up elsewhere.
 
I’m curious about this too!

I have a tattered old yellow pad that contains my password history over the last 20 years.

I’m fairly comfortable that if someone found it they would not be able to decipher my strange shorthand.

I would like to automate them but I’m a bit reluctant with all of the data breaches we read about.

Is a secret still a secret if you choose to share it with a huge nameless faceless corporation that employs thousands of people and is on millions of computers around the world. 🤔
 
I dunno @Jules but off the top of my head, I would think that if you gave your most trusted survivor(s) your computer/device logon ID & Password ... once they log onto the computer/device, they could access "Apple Passwords" just as easily as you access it (?)

DISCLAIMER: ... the hard part follows ...

But if you want to go the password manager route and go about things more stringently ... I might give Bitwarden a look.

You're smart to plan ahead, Jules. Here’s a practical, secure checklist you can do right now (and keep updated) so your survivors can get into your computer, accounts, and important things after you pass, without exposing everything to strangers while you’re still kicking.

Quick checklist (do these first)​

  1. Pick a primary method for sharing credentials: a reputable password manager with an emergency/legacy feature or a securely stored physical emergency kit (see below). Compare features, then commit. WIRED+1
  2. Designate one or two trusted people (and tell them where the instructions are). Put their names in your will or executor instructions. Nolo+1
  3. Set up platform legacy tools where available (Apple, Google, Facebook/Meta). These let you name people who can access or manage specific accounts after death. Apple Support+2Google Help+2
  4. Create a concise “digital estate” document listing accounts, locations of backups, devices, and instructions, and store it securely (see storage options below). Nolo

How to implement (detailed steps)​


1) Use a password manager — recommended​


Why: It centralizes credentials and many offer emergency/legacy access so a trusted person can request access and (after a waiting period) receive it, avoiding messy court processes. Consider managers that support emergency or inheritance flows (features differ — some provide request-and-wait, some offer exportable emergency kits). Always enable secure backup/export options the vendor documents. WIRED+1

What to do now:
  • Create an account with a password manager you trust.
  • Put all passwords, account notes, software licenses, and 2FA recovery codes in it.
  • Configure its “emergency access” or prepare its “emergency kit” PDF and store that per the storage options below.

2) Use platform legacy tools (Apple, Google, Meta, etc.)​

  • Apple: Add a Legacy Contact and save the access key. The Legacy Contact needs the access key + your death certificate to request data. Some sensitive items (payment info, some passwords) remain protected. Apple Support+1
  • Google: Use Inactive Account Manager to name people and choose what data to share or to delete the account after inactivity. Google Help+1
  • Facebook/Instagram, Twitter/X, TikTok and others: check each platform’s “legacy” or deceased-user procedures and set preferences where possible. (Policies vary; some only memorialize or delete rather than grant full access.) AP News

3) Legal & wills: name a digital executor or include access instructions​

  • Put language in your will or estate documents stating who is authorized to manage digital assets and where to find credentials. Laws vary by state; many states let executors access digital assets but some providers still require provider-specific requests, death certificates, or court orders. Work with an estate attorney if you have high-value digital assets (crypto, business accounts). Nolo+1

4) Device access and encryption​

  • If your computer or phone is encrypted (FileVault, BitLocker, strong passcode), survivors will need the password or recovery key. Store recovery keys in the same secure place as your emergency kit or password manager. Note: Apple and some vendors may still require proof (death certificate) and may not grant direct device passcode access. Apple Support+1

5) Physical storage options (choose one or multiple)​

  • Bank safe deposit box or home safe with combination or sealed envelope labelled for your executor.
  • Secure cloud storage (encrypted) with the decryption key in the password manager or in the emergency kit.
  • Printed emergency kit (for services that offer it) in a sealed envelope with executor instructions.

What to include in your “digital estate” document​

  • List of accounts (email, banks, investment, social, utilities, subscriptions), usernames, where passwords are stored.
  • Location of devices, backups, encryption/recovery keys, and instructions for 2FA.
  • Contact info for trusted persons and the executor.
  • Any accounts you want closed vs. those you want preserved.
  • Note if you own crypto and how to access it (special handling required). Nolo+1

Security trade-offs & best practices​

  • Don’t email passwords or leave them in plain text. Use a password manager or physically secure storage.
  • Limit the number of people who can access everything — fewer trusted individuals reduces misuse risk.
  • Review and update this plan at least once a year (accounts change).
  • Keep a copy of your will/estate plan and digital instructions coordinated so executor can prove authority when a provider asks for documentation. AARP

Practical next steps you can finish today​

  1. Choose a password manager and create an Emergency Kit or set up emergency access.
  2. Add at least one legacy contact to Apple and set up Google Inactive Account Manager. (Takes 5–15 minutes each.) Apple Support+1
  3. Draft a 1–page digital estate note listing where everything is and place it in your safe. Use the checklist above as the template. Nolo

I mentioned Bitwarden but there are most certainly other password managers. I'll stick with Bitwarden here, but it will give you some good things to consider, examine, evaluate and compare with any other password managers you may be interested in. in many ways Bitwarden would be a good choice for a password manager, especially given your priority around securely handling access for survivors. I’ll walk you through what it does well, where it may have limitations, and what you’d want to watch or configure so it fits your specific needs.

What Bitwarden does very well

  • It’s open-source, meaning the code is publicly viewable, so it benefits from transparency and scrutiny. PrivacyJournal.net+3WIRED+3SafetyDetectives+3
  • It uses strong encryption (AES-256, zero-knowledge architecture) so your stored vault is encrypted end-to-end and the vendor can’t read your vault contents. WIRED+2Cybernews+2
  • Their free tier is remarkably generous: unlimited devices, unlimited passwords, etc. Which means you won’t be forced into premium unless you want extra features. TechRepublic+2SafetyDetectives+2
  • Cross-platform support (Windows, macOS, Linux, Android, iOS, web browsers) so your survivors will have options regardless of device. Password Manager+1
  • They support more advanced features like passkeys, hardware security keys (in premium), and even self-hosting if you want ultimate control. PrivacyJournal.net+1

Some limitations / things to be aware of​

  • While usability is quite good, some reviewers say the interface is a bit less polished or “bare‐bones” compared to some premium managers. SafetyDetectives+1
  • Some features you might want (emergency access / inheritance workflows) may require setting up manually or using premium features (or customized procedures) rather than being super slick out of the box.
  • As with all password managers: your “master password” becomes a single point of failure. If that’s lost or the vault is inaccessible, you have issues. (That applies to Bitwarden as well) Wikipedia
  • A recent general note for password managers including Bitwarden: there was research showing a “clickjacking”-type vulnerability in browser/extensions context across several managers (including Bitwarden) which required the autofill functionality to be used carefully. Tom's Guide

Does it meet your specific need (ensuring survivors have access)​

Given your goal — leaving behind a computer + accounts + passwords so survivors can access things — Bitwarden aligns well. You can:
  • Store all your credentials, backup codes, recovery keys etc in one place.
  • Use unlimited devices / account sharing to set up a trusted “emergency contact” (or multiple) who would have vault access after you’re gone (you’ll need to plan exactly how this hand-off will work).
  • Combine Bitwarden with your “digital estate” document: you can include in that document where your vault lives, how to recover it, who the trusted person is, and how to unlock it (master password or recovery key).
  • Because it’s affordable (even free tier is strong), you won’t have a big cost barrier.

What I’d recommend you do (with Bitwarden) to optimize it for your “if I pass away” scenario​

  • Set a master password for the vault that is strong, unique, and that you record securely. Make sure the recovery key (if provided) is safely stored too.
  • Decide on a trusted person or persons (executor, family member) and clearly document that they are authorized to access your vault in the event of your passing. Note how they will be given the master password or recovery key (sealed envelope, safe deposit box, etc.).
  • In your digital-estate document (or your will/estate instructions) include:
    • Where the Bitwarden vault is (account email, hint, how to login)
    • Which trusted person(s) will get access
    • What to do if you become incapacitated (not just pass away)
    • How to handle device access (i.e., computer encrypted? external drives? backups?)
  • Enable two-factor authentication (2FA) for Bitwarden itself. That keeps your vault safe, but you need to ensure your trusted person knows how to access the 2FA (or you have an 2FA recovery method documented).
  • Consider the emergency access / sharing features Bitwarden offers (premium) or manually set up sharing with your trusted person ahead of time, so that immediate access can happen if needed.
  • Keep the vault and the documentation up to date. If you acquire new accounts, new keys, change major devices, make sure they go into your vault and the instructions get updated.
  • For additional safety: you might store an encrypted backup of the vault (or an export) in a safe place (physical medium, safe deposit box) so survivors can retrieve it if something happens to the account.
  • Make sure your survivors know where the computer (and any encrypted drives) are located, and the procedure to power up/unlock them. Bitwarden helps with credentials; you also need physical access to the device or its recovery keys.
I’d pick Bitwarden as my password manager. It offers excellent value, strong security, cross-device support, and gives you the flexibility to plan for the future. The trade-offs (slightly less polish, need to set up the “hand-off” process) are manageable given the upside.

Emergency Access / Trusted Contact Setup
Bitwarden has a built-in “Emergency Access” feature: you designate trusted contacts (known as “grantees”), set a waiting period (after which they may view or take over your vault) and define the level of access (view vs takeover). Reddit+4Bitwarden+4

Requirement for Trusted Contact Acceptance / Waiting Period
The trusted contact must accept the invitation. After that, when they request access, there is a waiting period you set, during which you can approve or deny; after that period expires, access is granted. Reddit+2

Cost / Premium Requirement
The Emergency Access feature is offered in the Premium tier (or family/business tier) of Bitwarden. Bitwarden Community Forums+1

Control Over Access Type (view only vs takeover)
Bitwarden supports “View” access and “Takeover” access (the latter allows the trusted contact to set a new master password and permanently access the vault). Bitwarden Community Forums+1

Survivors’ Ease of Access After Death
Bitwarden: Relatively high ease (once setup done) — trusted contact requests, waiting period expires, access granted.

Risks / Things to Work Around
Setup must be done ahead of time — trusted contact must accept invitation; you must define waiting period; you must keep your master password & vault secure but accessible to your survivors. Some users report interface quirks. Bitwarden Community Forums+1
 
I keep the important ones on my cell in the notebook, but nic name the title that only makes sense to myself... others, I keep them on a spread sheet, and again only ny names that I know, and if I pass... or get a disease where i don't know who I am, my family can figure it out... probably an easier way, but this works...
 
Like @Naturally I am also a MAC user, and my passwords are stored in my password app. Between the security steps needed to just get into my phone, and the additional security steps to get into the password app itself, I’m confident that they’re safe.
 
Last edited:
I also want to add this: Given the skill level of some of the hackers out there, I’m far more focused on the security of my financial and personal data on the web.

Even the most secure institutions with a web presence, with the most advanced security measures available, have been hacked, and that is way more concerning to me than the security of my personal passwords on my various devices.
 
Also an all Apple environment here. If Open Source is a thing for you then Bitwarden is good; I used it for a while. I have hopes that the Apple Passwords app will someday "Sherlock" its competitors. However, for me and my house, 1Password is the thing, Have used it for many years and it has all the features as well as working smoothly across the entire Apple world. They even have a Windows and Linux version.

Sadly they did move to the subscription model a few years ago, but for the convenience and security, it's worth it to us.
 
The three that I was looking at were 1password, Bitwarden, and Proton, with 1password seeming good for me.

Anywhere I can use 2FA, I will. Some sites didn’t offer it back when I signed up.

For banking, I’ll NEVER use voice recognition.
 
Mentally, passwords have me banging my head on my desk. I decided to go through all of them and delete and/or deal with any that are flagged. Too similar. Repeated. Not strong enough. Do you hear me crashing my head down?

I have some sites that I joined years ago and probably never used. They have me jumping through hoops to delete them.

As for dealing with all of them, I’ve barely scratched the surface.
 
It is hard to go past Keepass for a password manager. It is open source and available for Windows, Linux and Android. I use Dropbox to keep the file up to date on my phone, desktop and laptop.


I only have to remember one password - Keepass is free and uses 127 bit encryption whatever that means. You are not relying on a third party to keep your data safe.


Downloads - KeePass
 
I am so old school, I have all my passwords written on paper. One in my wallet, a copy on the fridge.
I really do not trust technology and see the day when it all goes to s*it plunging the world into chaos.
 
Passwords are a colossal PITA. Every so often I consider the merits of a password manager. They’re very reasonably priced at $2 - $5 a month.

We’re strictly an Apple community in our house now. Some opinions are that this and 2FA are reasonably safe.

There are some passwords that I’d never have in a manager of any sort.

If you have a password manager and decide to leave it, how do you get their generated passwords back.
You don't have to store your passwords online. I don't do that, but I do use a password manager that is completely local.
I use eWallet, it was a one-time purchase, and I don't store my information online. It is all local on my computer and phone. I can sync across my home network securely. https://www.iliumsoft.com/ewallet/
KeePass is a free password manager that can also be used locally offline.
It is free and open source. KeePass Password Safe
Both programs allow you to export the data to many other file types so if you leave the program, you can export the data first.
You really want a secure, encrypted program to store your information.
 

Last edited:

Back
Top