Password Managers and Crypto: The Right Way to Use Them Together

A password manager is one of the highest-leverage security tools a crypto holder can use. If you are currently remembering your passwords or using the same password across multiple sites you are operating with one of the most common and easily exploited security vulnerabilities in existence. Password managers solve this completely — but there is a right way and a wrong way to use them with crypto.

What a Password Manager Does

A password manager generates and stores long, complex, unique passwords for every account you have. Instead of remembering dozens of passwords you remember one master password to access the vault. The vault itself is encrypted so even if the password manager's servers were breached the stored passwords remain protected.

Reputable password managers include Bitwarden (free and open-source), 1Password, and Dashlane. We recommend Bitwarden for most clients because it is open-source, independently audited, and has a generous free tier. Its security model has been vetted by the security community in ways that closed-source alternatives cannot be.

What You Should Store in a Password Manager

Your exchange login credentials: yes. Your email account password: yes. Two-factor authentication backup codes: yes. The PIN for your exchange account: yes. Website logins for any financial or crypto-related service: yes.

What you should NOT store in a password manager: your hardware wallet seed phrase. Your seed phrase is the master key to your crypto at the hardware level. If it is stored in a password manager and that password manager is compromised — through a phishing attack on you, a breach of the service, or malware on your device — your crypto is gone. The seed phrase belongs in physical form, stored in a fireproof location, not in any digital system.

Securing the Password Manager Itself

Your password manager's master password needs to be strong and unique — one you have never used anywhere else. Enable two-factor authentication on the password manager account using an authenticator app, not SMS. And make sure you have the recovery kit or backup codes for the password manager stored somewhere secure.

We set up password managers correctly as part of our Entry Vault and Asset Essentials packages. If you would like help getting this right in person, book a free consultation below.