Almost everyone I know has a password system. Very few have one that survives contact with reality. The system usually looks like this: three or four passwords reused across a hundred accounts, a browser that remembers most of them, and a notebook somewhere with the "important" ones written in it. It works — right up until a site gets breached, a phone gets lost, or a relative needs to log into your account while you are in a hospital corridor.
The password manager vs written passwords debate is usually framed as a morality play: managers are good, paper is bad. That framing is wrong and it makes people worse at security. A dedicated manager is a genuinely better tool for most people with many accounts and several devices — but it is a tool with a setup cost, a recovery path you must actually test, and failure modes of its own. A physical written record is not automatically stupid: for a person with eight accounts and one laptop, a notebook kept in a drawer can be more secure than a badly configured cloud vault with a reused master password.
The real question is not "which is better" but "which one can I operate correctly for the next five years." That question has a checkable answer, and this article walks through it — the mechanism, the setup, the numbers, and the places where both approaches break. It is the kind of ground that a structured path such as Digital Literacy & Online Safety covers step by step, but you can get most of the way there on your own if you are willing to be honest about your own habits.
What a password manager actually does (and what it does not)
A password manager is a local encrypted database plus a key-derivation function. Your vault is encrypted with a key derived from your master password — typically through a deliberately slow algorithm (PBKDF2, Argon2, or similar) so that guessing is expensive. The vendor stores ciphertext; in a properly designed product, the vendor cannot decrypt it for you. That last sentence is the whole value proposition and also the whole risk: if you lose the master password and the recovery material, nobody can restore your vault.
What it does well:
- Generates long random passwords (20+ characters) that no human would memorize, unique per site.
- Fills them automatically, which removes the incentive to reuse.
- Syncs across devices so the same credential works on a laptop, a phone, and a tablet.
- Stores notes, recovery codes, and answers to security questions in one encrypted place.
What it does not do:
- It does not protect you if your device is already compromised by malware that reads the screen or the clipboard.
- It does not fix a breached password on a site that was hacked — only rotation does that.
- It does not replace two-factor authentication. A stolen vault password with no second factor is still a stolen vault.
A written record is the opposite trade-off. It is offline by construction — no server, no sync, no vendor. It cannot be phished remotely. But it is a single physical point of failure: a fire, a flood, a burglary, a curious housemate, or a cleaner who knows where the drawer is. And it does not scale: at 40 accounts, a handwritten list becomes unreadable, and people start abbreviating, which is where transcription errors creep in.
The walkthrough: choosing your scheme in four checks
Here is the calculation a practitioner actually runs. It takes about twenty minutes and produces a defensible answer.
Check 1 — How many accounts do you really have?
Open your browser's password list and your email inbox. Count the sites that have sent you a login-related message in the last year. Most people are surprised: the honest number is usually 30–80, not 10. Write the number down.
- Under ~15 accounts, one device: a written record is viable.
- 15–30 accounts, one or two devices: either works, but the manager starts to win on rotation effort.
- Over 30 accounts, or more than one device: a manager wins on operational cost alone. Rotating 50 passwords by hand after a breach is a weekend project nobody finishes.
Check 2 — Do you sync across devices?
If you log into the same accounts on a phone and a computer, a paper list forces you to either carry it (bad) or re-type passwords (which pushes you toward short, memorable, reused passwords — the exact failure you were trying to avoid). Sync is the manager's core advantage. If you genuinely use one device, sync is a feature you do not need and a risk surface you do not have to accept.
Check 3 — Who else has physical access?
This is the check people skip. A notebook is only secure if the space is secure. Roommates, family members, a shared office, a landlord with a key, a cleaning service — each one is an access path. Ask a blunt question: if someone in my household wanted to read my passwords, could they? If the answer is yes, the written record is not a security scheme, it is a hope.
Check 4 — What is your recovery path?
Every scheme must answer: what happens when I forget the master credential or lose the device?
- For a manager: an emergency kit — the master password written once, stored offline, plus the recovery codes and a note on which email and phone number the account is tied to.
- For a notebook: a second copy in a different physical location, or a sealed envelope with a trusted person.
If you cannot describe your recovery path in one sentence, you do not have one. Test it: on a spare device, log out and back in using only the recovery material. If that fails, you have found the problem before it mattered.
Two-factor authentication: the part that makes either scheme work
Neither a manager nor a notebook is a substitute for two-factor authentication (2FA). 2FA is the layer that turns a stolen password from a disaster into an inconvenience. The setup order matters:
- Start with the accounts that can reset everything else — your primary email, your phone carrier account, your bank, and your password manager itself.
- Prefer an authenticator app or a hardware security key over SMS. SMS codes are vulnerable to SIM swapping, where an attacker convinces the carrier to move your number to a new SIM. A carrier account PIN and a switch to an app-based code closes most of that path.
- Save the recovery codes at setup time, not later. They are shown once. Print them or write them into the vault — not into a screenshot folder on the same phone.
- Register a second device or a backup key so that losing one phone does not lock you out of everything.
A common mistake: enabling 2FA on the bank but not on the email that resets the bank password. The attacker does not need to beat the bank's 2FA if they can reset the password through your inbox.
Where both schemes break
Every security scheme has failure modes that are not the user's fault. Recognizing them early is what separates a working habit from a false sense of safety.
The vendor changes the rules. A manager can change pricing, discontinue a platform, or alter its export format. If your vault only exists inside one product, a business decision you did not make becomes your outage. Early sign: announcements about plan changes, or an export that produces a file you have never opened. Late fix: keep a periodic encrypted export and know how to import it into a different tool.
The device dies at the wrong moment. A phone with the authenticator app and the vault is a single point of failure. Early sign: you have never logged in from a second device. Late fix: if you are already locked out, use the recovery codes — which is why they must exist before the failure, not after.
The physical copy is discovered. A notebook is secure only while it is private. Early sign: the notebook lives in a bag that leaves the house, or in a desk drawer in a shared space. Late fix: if a written list may have been seen, treat every password on it as compromised and rotate the critical ones first — email, bank, manager master password.
The recovery path itself is stale. The recovery email is a decade-old address, the recovery phone is a number you gave up, the security questions have answers you no longer remember writing. Early sign: you cannot recall which email is on the account. Late fix: log in while you still can and update the recovery details — this is the one maintenance task worth doing every six months.
Password security habits that outlast the tool
Tools change; habits transfer. Four habits carry most of the value:
- Unique passwords on the accounts that matter. You do not need 80 unique passwords on day one. Start with email, banking, the manager itself, and any account tied to money or identity. Reuse everywhere else is a smaller risk than reuse on those four.
- A rotation trigger, not a calendar. Rotate a password when a site reports a breach, when you shared it with someone, or when a device is lost — not on an arbitrary schedule that trains people to make tiny variations of the same password.
- A written emergency kit, stored offline. One page: master password, recovery codes, the email and phone tied to the account, and a note on where the backup copy lives. Sealed, dated, and reviewed once a year.
- A yearly audit. Count accounts, check that 2FA is on for the critical ones, and confirm the recovery email still works.
For the money-adjacent side of this — how account takeover turns into financial loss, and why an emergency fund and a separate payment card matter — the logic overlaps with Financial Literacy and Personal Capital. The same principle applies: the scheme you can maintain beats the scheme that looks optimal on paper.
Learning paths and their honest trade-offs
There are three realistic routes to competence here.
| Path | Time | Cost | What you get |
|---|---|---|---|
| Self-study from vendor docs and articles | A few evenings | Free | Good coverage of setup, weak on your specific recovery path and on scam patterns |
| Guided course with feedback | A few weeks, part-time | Paid | Setup checklists, someone to check your decisions against, coverage of phishing, SIM swapping, and family scenarios |
| Trial and error in real life | Months | Potentially very expensive | Lessons learned from actual lockouts and losses |
Self-study is genuinely enough for a technically confident person with a small number of accounts. The barrier appears when the situation is messier: a parent's phone, a teenager's social accounts, a shared family email, a small business with a handful of employees. There, the questions stop being "which app" and become "who holds the recovery codes and what happens when that person is unavailable." That is where feedback matters — not because the information is secret, but because the wrong answer is only discovered during a crisis.
A structured course closes exactly that gap: it walks through the setup with checklists and gives you a place to test your decisions before they matter. The asibiont.com course is text-based and personalized, adapting to the student's level, with instant checking on multiple-choice and fill-in tasks and a course AI chat where you can ask for feedback on your own written answers. It is one route among several, and the honest alternative — a careful self-study plan plus a recovery test — is a legitimate one.
Who this suits and who it does not
This material suits people who have realized their password habits are held together by luck: parents managing accounts for a household, older users who have been told "use a manager" without being told how to recover it, employees without an IT background who handle work logins, and anyone who has already been through one lockout or scam call.
It does not suit people looking for a technical deep dive into cryptography, nor organizations that need a formal access-control policy — that is a different discipline with its own standards and audit requirements. And no course replaces the discipline of actually running the recovery test once a year.
The point of all of this is not to pick the "correct" tool. It is to be able to answer four questions about your own setup — how many accounts, how many devices, who has physical access, and how you recover — and to have a scheme that survives the answer. The Digital Literacy & Online Safety course walks through that calculation with examples, from password storage and 2FA setup to phishing recognition and account recovery, and gives you a place to check your decisions before a real lockout does it for you. Start with the recovery test on your primary email — everything else builds on it.