Is a password manager worthwhile?

A large part of our lives now takes place online. Whether it is shopping, our social contacts or finances. In the process, countless accounts and logins accumulate, each of which has to be protected with a password.

Often the security of our data fails not because of the providers of online services, but because of the human weak point. Far too simple or identical passwords are often used, and not just for one account but possibly for all of them at once.

Yet there is a solution to this problem. What counts as a secure password and what does not has changed considerably in recent years. Creating a secure password is not as complicated as you might first think. Even so, quite a few passwords add up, but there is a remedy for that too. So-called password managers let you manage the multitude of passwords without having to remember each one individually. Instead, you only need the master password to gain access to the rest.

What should you look out for in a secure password?

At least 8 characters
At least one number
At least one capital letter
At least one special character

These, or something similar, are the password requirements at many providers. However, these standards are now outdated. According to the National Institute of Standards and Technology (NIST), digits and special characters give the appearance of security without actually providing any.

This is because brute-force attacks make short passwords easy to crack, despite special characters and numbers. Brute force means exactly what it says; a fitting name. Instead of approaching the problem in a sophisticated way, all possible character combinations are simply tried until one works. Hundreds of millions of combinations are tested per second.

Germany’s favourite passwords

Every year, the Hasso Plattner Institute examines the most frequently used passwords in Germany. The top 10 reveals a great deal about how seriously people take the problem of online security; the top 5 are short sequences of numbers, with “123456” in first place.
“hallo” follows as the first word in sixth place and “passwort” sits in a proud seventh. It should be clear to everyone that none of these passwords is secure.

To be as safe as possible from such attacks, NIST has placed particular emphasis on the length of the password in its guidelines. This is because with every additional character in the password, the number of possible combinations increases exponentially. Two methods appear to be particularly well suited to creating complex yet relatively easy-to-remember passwords.

Diceware: With the Diceware method, several random words are chosen by rolling a die and then simply written one after the other as the password.
For the second method, take an easy-to-remember sentence and use the first letter of each word in the sentence. So “Meine Oma hat immer gerne Spiegelei mit Speck zum Frühstück gegessen” simply becomes “MOhigSmSzFg”

You should now add special characters and numbers. This makes the password considerably more secure again

But as helpful as these methods are, it is virtually impossible to remember such a mnemonic for every service, even with only minor variations. It is therefore advisable to create one such password and protect the rest with a password manager.

Online security with password managers

As the name suggests, password managers manage your passwords for you. This means you only need to remember the master password to gain access to your database. Most programs also take on the task of creating a password for each account for you. A password generator creates a random password that provides the necessary security. When you then need the respective password, the manager enters it automatically.

But is it really advisable to secure all your data in just one place? It has to be said that the providers of these managers are certainly not one hundred percent safe from attacks either. However, the databases are usually encrypted in such a way that hackers cannot do much with the data they obtain

Nevertheless, two-factor authentication is recommended. This means that in addition to the password, a further step must be completed before access to the database is granted. This can be a code received via SMS or email, or a fingerprint. The fingerprint is particularly popular on smartphones, as most devices today are already equipped for it.

If all this still is not secure enough for you, you can also resort to an offline version of a password manager. Normally, the passwords are stored and secured in the provider’s online storage. This makes it possible to synchronise the login credentials across multiple devices.

Many providers offer browser plug-ins and apps in addition to the desktop version. Alternatively, you can manage synchronisation manually by transferring the changes to each device individually or storing everything in your personal cloud storage.

Which password manager is the right one?

However, not all providers offer all features. There are differences in convenience, in two-factor authentication and in whether the program is available for all platforms. That is why it makes sense to compare different providers. This way you can choose the one that best suits your needs.

Last Pass

For users of a Windows PC, the program Last Pass is probably one of the best choices. It is considered very secure and also allows the use of two-factor authentication. It has many additional functions, such as the form assistant, and is generally very easy to configure to personal needs. Should you forget the master password, you can restore it via an emergency email address.

Compatibility also leaves little to be desired. There is a matching app for both Android and iOS. Supported browsers include Chrome, Firefox and Microsoft Edge. This means passwords can be synchronised across all important devices. Transferring the data into the browser on the smartphone usually works without problems as well.

The program is available in a free and a premium version. The premium version costs $2 per year. However, the free version lacks only a few important functions and should be sufficient for most users.

1Password

1Password is particularly recommended for owners of an Apple product. The Windows version lacks some functions, which is why one of the alternatives should be preferred there. Among other things, under iOS the database can be synchronised locally via Dropbox or iCloud, but unfortunately not under Windows.

With 1Password, the user-friendliness deserves particular mention. Everything is easy to set up and the program also offers two-factor authentication. The app is likewise available for both platforms, but here too the iPhone version is well ahead of the Android one. The databases can also be synchronised easily across different devices here.

In case you ever forget the master password, 1Password offers the Emergency Kit. You need to print this out once at the start and then hide it until the eponymous emergency arises. With the details on the sheet, the database can then be restored.

1Password only offers a free version for trial purposes. After that, the service costs $2.99 per month.

Keepass

If the security of your data is particularly important to you, you should take the time to look into Keepass. It is not as intuitive as the other programs, but as an open source program with offline data backup, it does not have the same weaknesses either.

You create the data vault as a file on your hard drive and can carry the program and the database on a USB stick. Extensions allow features such as two-factor authentication, as well as many others, to be added.

However, you pay for the security with convenience. Integrating the extensions is rather complicated, and you also have to synchronise with the app manually, as the database is not online. Likewise, compatibility with the various browsers is quite prone to errors.

As the program is open source, it is completely free, but it does not offer the same support as the alternatives either. So it is entirely up to you whether you make the effort to familiarise yourself with it.

Conclusion

Even if it seems strange at first to store all your passwords in one database, you should not be put off by password managers. Experts agree that this type of encryption is more effective than using individual passwords, and Stiftung Warentest has come to the same conclusion.

However, you should definitely find out about the provider in detail beforehand and weigh up which one to choose. There are many more than those presented here, and each program naturally has its own particularities. That is why it is worth investing the time, because it concerns the security of your most important data.