A password manager won’t fill in a fake site’s login box, and that is its best feature
Britain's cyber security agency recommends one alongside two-step verification, and passkeys wherever a service offers them.
Reuse one password across email, banking and shopping, and a single breached site hands an attacker the key to try everywhere else. That is the warning from Britain’s National Cyber Security Centre, which puts one step ahead of everything: turn on two-step verification.
Since nobody can remember a different strong password for every account, the NCSC recommends a password manager. It does four jobs:
- Generates a strong, unique password for each account.
- Autofills only on the genuine site. Land on a convincing copy of your bank’s login page and it fills nothing, which is a warning in itself.
- Syncs your passwords across your devices.
- Alerts you when one of your passwords turns up in a breach.
Browser or separate app?
The major browsers all save passwords, and the NCSC calls that safe on your own devices, as long as automatic security updates for the browser and operating system stay switched on. On a shared public computer, at a library or college, never save a password. On a family device, if in doubt, decline.
A separate app earns its place when your phones, laptops and browsers come from different makers. The NCSC’s test for choosing one is simple: whatever fits your devices and you find easiest to use.
The primary password
It unlocks everything, so make it memorable to you, and turn on two-step verification for the manager account itself. Many managers offer recovery routes such as secure hints or emergency access through a trusted contact.
What about a notebook?
The NCSC accepts a written password book for people who rely on family to help with their accounts, provided the passwords aren’t guessable, the book is kept where others can’t reach it, and the service’s terms allow it; some banks forbid writing passwords down. The catch: paper can’t spot a fake website the way a manager can.
And passkeys
Where a site offers them, the NCSC recommends passkeys as your first choice: they sign you in with your fingerprint, face or device PIN, with nothing to type. Where they aren’t offered yet, stick with a strong, unique password plus two-step verification.
Photo: A hand typing on a laptop. By Shixart1985, CC BY 2.0, via Wikimedia Commons.
Source: UK National Cyber Security Centre (NCSC), “Managing your passwords”, reviewed 21 May 2026, read 20 October 2026.
Kuwait One, once a week.
The most useful stories we published this week, in your inbox.
No spam. Unsubscribe anytime.
