Passwords remain central to authentication, but the ecosystem is changing: passkeys are gaining ground, 2FA is becoming standard, and password managers are a necessity. This overview covers current practices for 2026: how to organize password storage, when to switch to passkeys, and how to minimize risks. Basic rules for creating passwords are in the strong password guide.
Password managers: a necessity
One unique password for every service is impossible without a password manager. Memorizing dozens of random passwords of 16+ characters is impossible. A manager solves this problem: one master password (or passkey) unlocks a vault containing all your credentials.
Password manager architecture
A good manager uses a zero-knowledge architecture: passwords are encrypted on the client using a key derived from the master password. The server stores only an encrypted blob and does not know its contents. Even if the server is breached, an attacker cannot obtain the passwords without the master password.
Selection criteria
| Criterion | Importance |
|---|---|
| Encryption | E2E; only the client has the key |
| Code audit | Open source is a plus |
| Sync | Cloud or local, depending on preference |
| 2FA/Passkey | Protects the vault with a second factor |
| Export | Ability to export data |
Popular password managers (2026)
Bitwarden — open source, self-hosted option, cross-platform. The free plan is sufficient for most people. Browser extensions, mobile apps, CLI.
1Password — closed source, strong reputation, convenient. Paid. Excellent integration with browsers and apps, family plans.
KeePass / KeePassXC — local storage, with a database file on disk. Full control, but no cloud sync out of the box. Syncing through Dropbox, Nextcloud, or Git is up to the user.
Proton Pass — from the creators of Proton, with integration with VPN and email. E2E encryption. Free plan with limitations.
Dashlane — paid, focused on convenience and automatic password changes on popular sites.
The choice depends on privacy requirements, budget, and whether self-hosting is needed.
Master password
The master password is the only password you need to remember. It should be as strong as possible: 20+ random characters or a passphrase of 6+ words. Do not use it anywhere else. Enable 2FA to unlock the vault if your manager supports it.
Two-factor authentication (2FA)
2FA adds a second factor besides a password: a device, app, or biometrics. Even if a password is leaked, an attacker cannot sign in without the second factor.
Types of 2FA
| Type | Examples | Security | Convenience |
|---|---|---|---|
| SMS | Code in a message | Low (SIM swap) | High |
| TOTP | Google Authenticator, Authy | High | Medium |
| Push | App notification | High | High |
| Hardware key | YubiKey, Titan | Very high | Medium |
| Passkey | Built into the device | Very high | High |
SMS is vulnerable to interception and SIM swapping. TOTP (codes from an app) is the minimum for critical accounts. Hardware keys and passkeys provide the highest level of protection.
Where to enable 2FA first
- Email (Gmail, Outlook, Proton)
- Banks and payment systems
- Cloud storage (Google Drive, Dropbox)
- Admin panels and hosting
- Social networks (especially those linked to other services)
Backup codes
When enabling 2FA, save your backup codes in a safe place (a password manager or encrypted file). Without them, losing your device or app means losing access.
Passkeys: passwords without passwords
Passkeys (WebAuthn / FIDO2) authenticate using cryptographic keys on a device. Instead of entering a password, you use biometrics or a PIN. The key is tied to the device and domain, so phishing will not work: a fake site cannot obtain the key.
Benefits
- Phishing resistance — the key is not sent to the server
- Convenience — a fingerprint or Face ID instead of typing
- Sync — Apple, Google, and 1Password support syncing between devices
Limitations
- Not all services support passkeys
- Device binding means a lost device requires account recovery
- A backup password is still needed for many accounts
Migration strategy
- Enable passkeys wherever available: Google, Microsoft, GitHub, Cloudflare, etc.
- Keep the password as a backup sign-in method
- Use a password manager that supports passkeys to sync keys between devices
Hybrid model 2026
A typical configuration:
- Password manager — stores passwords and TOTP codes
- Passkeys — as the primary sign-in method wherever supported
- 2FA (TOTP or key) — on all critical accounts
- Backup codes — saved in a manager or offline
Passwords will not disappear in the coming years: legacy systems, B2B integrations, and account recovery still rely on them. But their role is shifting toward a backup mechanism, with passkeys or 2FA becoming primary.
Breaches and monitoring
Regularly check your email address on Have I Been Pwned. If there is a breach, immediately change the password on the affected service and anywhere else it was used (if you reused it).
Password managers with monitoring features (1Password Watchtower, Bitwarden) warn you about compromised passwords. Use this feature.
Recommendations for organizations
- Implement a password policy: length, uniqueness, and no password reuse
- Require 2FA for employees with access to critical systems
- Use a team password manager (Bitwarden Teams, 1Password Business)
- Gradually transition to passkeys for corporate applications that support WebAuthn
Account security checklist
- A password manager is installed and used for all services
- The master password is strong and unique
- 2FA is enabled for email, banks, cloud storage, and admin panels
- Backup codes are saved
- Passkeys are set up wherever available
- Email has been checked for breaches (HIBP)
- Passwords in the manager have been checked for compromise
Rules for creating strong passwords are in the password guide.
Hardware security keys
YubiKey, Google Titan, and similar devices are physical second factors. They are phishing-resistant: a key will not provide data to a fake site. They are supported by major services (Google, GitHub, Microsoft, Cloudflare).
Recommendations:
- Have two keys — a primary and a backup (in case one is lost)
- Register both with critical accounts
- Keep the backup in a safe place
Account recovery
If you lose access to your password manager or second factor:
- Backup codes — save them when enabling 2FA
- Password manager — export to an encrypted file and store it offline
- Recovery keys — some services have recovery codes for regaining access without a second factor
Without backup codes, recovery may be impossible. Plan ahead.
Browser password managers vs. dedicated managers
Built-in password managers in Chrome, Edge, and Safari are convenient, but:
- They are tied to an ecosystem (Google, Apple, Microsoft)
- Sync may be less transparent
- For critical passwords (banking, email), a dedicated manager with E2E encryption is preferable
For most users, a browser password manager is better than reusing passwords or writing them on paper. For maximum security, use Bitwarden, 1Password, or a similar manager.
The future of authentication
Passkeys and FIDO2 are the direction of development. By 2027–2028, the share of services supporting passkeys will increase. Passwords will remain a backup mechanism, but biometrics or a PIN on the device will become primary. It is recommended to enable passkeys wherever available now and get used to the new sign-in flow.