I’m cleaning up the logins I keep in a paper notebook beside my desk and trying to decide whether to move them into a password manager. I expected the manager to feel clearly safer, but putting every login behind one master password feels more fragile than remembering my important passwords.
I also use a shared family laptop and regularly sign in from my phone while buying groceries. Do others find password managers safer than keeping passwords in their head, especially across devices, and what should I look for?
The shared family laptop matters more than the “all eggs in one basket” argument. If everyone uses the same computer account, a password manager left unlocked could expose the whole vault. Give each person a separate login, set the vault to lock quickly, and never enable permanent sign-in on a shared profile.
A manager is generally safer because it lets every site have a long, random, unique password. Human memory usually leads to reuse or predictable variations, so one leaked password can affect several accounts. The master password should be a long passphrase you can remember, backed by MFA. Keep the recovery code offline, since forgetting the master password can otherwise mean losing the vault. NIST recommends considering a password manager and enabling MFA where available.
Bitwarden is a reasonable free password manager to try across a phone and laptop. Move a few low-stakes accounts first rather than migrating everything in one evening. Your paper notebook can still hold the recovery code, but put it somewhere private instead of beside the computer.
15 Likes
A password manager will not make a compromised computer safe. Malware, a malicious browser extension, or someone using the machine while your vault is open can still capture credentials. Treat it as a tool for reducing password reuse, not as a shield against everything.
A useful advantage over a notebook is domain matching. If you land on a convincing fake banking page, the manager normally will not offer the saved login because the address does not match. That pause can expose phishing that you might miss when copying a password manually.
I would keep important email, financial, and recovery accounts out of the initial migration until you are comfortable with locking, backups, and account recovery. Then move them after you know exactly what happens if your phone dies or you forget the master password.
Your master password needs to be both unique and memorable, because forgetting it can lock you out of Bitwarden along with everything stored there. Write down the recovery information and keep it somewhere secure, rather than trusting your memory for the single credential that now matters most.
If your notebook already contains long, unique passwords and nobody untrusted can reach it, moving everything into an app is not automatically a huge security upgrade. Paper is immune to remote hacking. Its weaknesses are physical access, loss, fire, and the fact that copying complicated passwords gets annoying enough that people start shortening or reusing them.
The manager becomes safer mainly because it makes good password habits practical. You can give every account a different random password without remembering any of them, and you can quickly identify duplicates when an old service gets breached. The tradeoff is that your master passphrase, device security, and recovery plan now matter a lot more. That is concentrated risk, but it is usually easier to protect one strong passphrase properly than dozens of weaker passwords badly.
I agree with the warnings about the shared laptop, though I would go further: separate computer accounts are a requirement, not a nice extra. Browser profiles are not the same thing. Set a short vault timeout and require the master passphrase after a restart. I would avoid storing the master passphrase in the same notebook as a printed vault export or full list of recovery codes. Keep those pieces in different secure places.
I mildly disagree with postponing important accounts for too long. Your primary email is often the reset key for everything else, so leaving it on a reused or predictable password during a long trial period can be the bigger risk. Test the manager with a few ordinary accounts, confirm that syncing and recovery work, then move your email early and add MFA. You do not need to destroy the notebook immediately either. Keep it temporarily while checking that every migrated login works, then retain only the master-passphrase backup and recovery information rather than a permanent second copy of the whole vault.
A notebook in a locked drawer and a password vault on a patched personal phone are both defensible. A notebook beside a shared laptop and an unlocked browser extension on that laptop are both poor setups. The container matters less than who can reach it and what happens after they do.
The manager’s real advantage is that it can generate unique credentials without asking your brain to perform an impossible filing job. Its main disadvantage is concentration. Someone who obtains the encrypted vault can potentially keep trying to crack it offline, so the master passphrase needs real strength, not a familiar password with punctuation added. Use several unrelated words, never reuse that phrase elsewhere, and make the vault require it again after a restart. A short PIN or biometrics can be convenient for routine unlocking, but they should not become the only barrier.
I would avoid putting every layer of account recovery in the same vault. If the manager stores the password, the email recovery details, and the one-time MFA codes, an attacker who opens it may have the complete package. Keeping MFA for your primary email and financial accounts in a separate authenticator or on a hardware security key preserves an extra boundary. Printed recovery codes can stay offline in a secure location.
There is a mundane failure mode people overlook too: migration errors. Old URLs, duplicate entries, changed usernames, and passwords saved before the site confirms the change can leave you with a vault entry that does not work. Move accounts in batches, sign out, and test each new login before crossing it out of the notebook. Do not create an unencrypted spreadsheet or vault export as a convenient backup. Those files tend to survive in downloads folders, cloud backups, and trash long after they were supposedly deleted.
So yes, a manager is usually safer than memory because it makes unique random passwords practical. It is not automatically safer than well-secured paper in every threat model. On your shared machine, separate operating-system accounts and aggressive vault locking are the minimum. If that cannot be arranged, I would keep the vault primarily on your phone rather than exposing the entire collection through a permanently signed-in shared browser.
If any of those logins get shared with family (streaming, the electric bill, whatever), the answer tips toward a manager fast, and not for the reason people usually give. A notebook only works when you’re standing at that desk. The moment someone texts you asking for the login while you’re out, you’re reading a password over the phone, which is worse than either option. Managers handle shared entries without you broadcasting the credential.
@alphabear6747node and @not_a_hawk are right that the shared laptop is the real problem here, but I’d frame it more bluntly: typing your master passphrase into a machine other people use is the risk nobody fully closed. Separate OS accounts help. They don’t help against a keylogger someone in the house installed by accident along with a game mod. If that laptop is genuinely shared and not tightly controlled, keep the vault on your phone and unlock it there, then just reference it. Sounds clumsy. It’s also the setup least likely to hand your whole vault to whoever touches that keyboard next.
The thing I think everyone skipped is what happens when you’re not around to unlock it. Paper survives you in the plainest way possible. A vault does not, unless you deliberately set up recovery. Bitwarden has emergency access where a trusted person can request the vault and you either approve or a timer runs out. Worth turning on if you’re the household’s unofficial IT person, because otherwise a locked-out spouse or a bad day means every account is gone at once. That’s the flip side of the concentration risk people keep mentioning, and it’s the part that bites families rather than individuals.
One correction to the general mood in this thread: moving off paper is not the actual upgrade. Generating unique random passwords is. If you migrate the notebook one to one and keep every reused password exactly as it was, you’ve just made a nicer looking list of the same weak logins. The value only shows up when you start rotating them, and that takes weeks, not one evening. Do email first like @git_kevin27 said, but treat the whole thing as a slow cleanup, not a move.
A password typed from a notebook can end up in clipboard history if you copy it, while a manager that fills the field directly may avoid leaving that extra copy behind. That was the detail that changed my view, because I initially thought autofill was only about convenience. I still would not trust the shared laptop with the entire vault open, but keeping the manager on your phone and using it to create unique passwords seems safer than relying on memory or predictable variations. Just check whether your phone keyboard or clipboard saves copied text, clear it after use, and never paste the master passphrase.
If most of the sites you’re moving already offer passkeys, the notebook-versus-vault debate matters less than everyone’s making it. A passkey never gets typed, copied, or read aloud, so the shared-laptop keylogger fear @0xbeacon8 raised mostly goes away for those accounts. You still want a manager to hold them, but the threat model changes.
Where I’d push back on the general mood: people keep treating this as a one-time move. Realistically your notebook and vault will coexist for a month or two while you rotate passwords, and that gap is when a login gets saved wrong and quietly breaks. Test each one, sure, but also expect to hit two or three sites that force a password change on next login and desync your entry. Not a disaster, just don’t cross anything out in the notebook until the new credential actually logs you in twice.