Every breach report we read says the same thing in different words. The attacker did not break the encryption or find a clever exploit. They logged in, with a real password, belonging to a real person, that had been used somewhere else first.
The problem is reuse, not complexity
Most password rules were written for the wrong threat. Forcing a capital letter, a digit and a symbol every ninety days produces Summer2026! across the whole office, and it does nothing about the actual risk: a password you used on a site that later got breached, now being tried against your email, your bank and your remote access.
Attackers automate this. They take username and password pairs from one breach and replay them everywhere else, which is why a strong password you reused is worth less than a mediocre password you used exactly once. Length beats complexity, and uniqueness beats both.
Do not walk the keyboard
When people are told to invent something complex, most of them trace a path across the keys. It feels random under the fingers and it looks like nonsense on screen, which is exactly why it is so convincing and so weak.
- Straight runs:
qwerty,asdfgh,zxcvbn,qwertyuiop. - Column walks:
1qaz2wsx,qazwsx,1q2w3e4r— the ones that feel clever because they zigzag. - Keypad shapes:
147258,159753, and anything that draws a line or a box on a number pad. - Shift tricks on a real word, such as
P@ssw0rd!orTr0ub4dor. Every substitution you can think of is already in the cracking rules.
Password cracking tools do not guess character by character. They run dictionaries of leaked passwords, then apply pattern rules — keyboard walks among the first — on top of them. A keyboard pattern is not a random string; it is a short list of well-known shapes, and it falls in seconds.
The reliable fix is to stop choosing. Let the manager generate the password, because a machine has no fingers and no favourite corner of the keyboard. Where you do have to remember one, such as the vault passphrase itself, use four or five unrelated words rather than a pattern: long, memorable, and not on anybody’s list.
What a password manager actually changes
A manager moves you from remembering many passwords badly to remembering one well. Every account gets a long random password you never see or type, and you unlock the vault with a single passphrase plus a second factor. The practical effect is that a breach at one supplier stops at that supplier.
KeePass costs nothing and runs on everything
KeePass stores your passwords in a single encrypted file, usually with a .kdbx extension. That file is the whole database, which is the source of both its strengths and its quirks: nobody hosts it for you, so nobody else can lose it, and syncing it between devices is your job.
The arrangement that works in practice:
- Put the
.kdbxfile in whatever sync folder you already pay for — OneDrive, Dropbox, Google Drive or Nextcloud. The file is encrypted before it ever reaches them. - On Windows, macOS and Linux, use KeePassXC. It is actively maintained and has browser extensions for Firefox, Chrome and Edge.
- On Android, use KeePassDX or Keepass2Android. On iPhone and iPad, use Strongbox or KeePassium. All of them open the same file.
- Protect the database with a long passphrase, and consider adding a key file kept somewhere the sync folder is not. Two factors, one of which never touches the cloud.
- Back the file up somewhere separate. Sync is not backup; a deletion syncs just as fast as a change.
The honest weakness is editing on two devices at once, which can produce conflicting copies. Close it on one device before working on another and you will not meet the problem.
Other options worth knowing
- Bitwarden — open source, and the free tier includes unlimited passwords and sync across all your devices. If you would rather not manage a file yourself, start here. You can also self-host it later if you want the data on your own server.
- Proton Pass — a reasonable free tier from a company whose business model is privacy rather than advertising.
- 1Password — not free, but the most polished of the group. Worth the money if the alternative is that nobody in your office uses anything at all.
The best password manager is the one your staff will actually open. A free tool in daily use beats an expensive one that everybody works around.
Small teams: what you can share cheaply, and what you should not
A handful of people can get a long way on very little. Bitwarden offers shared collections on its inexpensive team plans, and for a small business that is usually the right first purchase: shared logins live in a collection, personal ones stay personal, and people join and leave without anybody emailing a spreadsheet.
A single shared KeePass file on a network drive also works, and we have seen it run for years. Be clear-eyed about what it cannot do:
- There is no record of who opened which credential, or when.
- Everybody with the file has every secret in it, forever, including the copy they synced to a personal laptop.
- When somebody leaves, the only honest response is to change every password in the file. If that sounds impractical, that is the finding, not an excuse.
Where free stops being appropriate
The moment you are handling regulated data, or holding credentials that administer other systems, the requirement changes from keep passwords safe to prove how passwords are controlled. That is a different product category.
For privileged credentials — domain admin, database roots, service accounts — a privileged access management platform such as Delinea Secret Server or CyberArk gives you things a personal vault never will: automatic rotation after use, check-out and check-in, recorded sessions, and an audit trail per user and per secret.
For staff logins generally, the stronger move is to have fewer passwords at all. An identity provider such as Okta or Microsoft Entra ID puts applications behind single sign-on with enforced multi-factor authentication, and ties access to employment: one account disabled on someone’s last day closes every application at once.
From vaulted credentials to just-in-time access
A vault is a real improvement, but notice what it does not remove. The administrator password still exists, it is still valid at three in the morning on a Sunday, and anyone who obtains it — or the session of somebody who has it — can use it. The vault controls who may take the key. It does not stop the lock from opening.
Just-in-time access changes that shape. Nobody holds privilege by default. When an engineer needs it, they request it against a ticket, an approver grants it, and the platform issues access for a fixed window — an hour, a maintenance evening — then takes it back automatically. The industry term for the end state is zero standing privilege: between requests, there is no account to steal.
In practice it looks like one of these:
- Time-bound roles. Microsoft Entra Privileged Identity Management activates an admin role for a set period, with approval and a reason recorded, then deactivates it.
- Brokered sessions. Secret Server or CyberArk connects the engineer straight into the server and the password is never shown, never typed, and rotated the moment the session ends.
- Short-lived credentials. Cloud platforms issue temporary tokens rather than permanent keys — an AWS role assumed for an hour beats an access key that lives in somebody’s home directory for three years.
- Ephemeral accounts. The account is created for the task and deleted afterwards, so there is nothing left to find later.
Two things follow, and both matter more than they first appear. The window in which a stolen credential is useful shrinks from years to about an hour, which changes the economics for an attacker entirely. And every elevation now carries a request, an approver and a reason, which is the access review an auditor asks for — produced as a by-product of the work rather than reconstructed from memory once a year.
This matters for compliance in a specific, practical way. HIPAA’s Security Rule requires unique user identification, audit controls and authentication safeguards — requirements a shared vault file quietly fails, because it cannot tell one user from another. PCI DSS expects individual credentials and logging for anyone touching cardholder data. SOC 2 audits ask you to evidence who had access to what, and when it was revoked. GDPR expects you to show appropriate technical measures.
No product makes an organisation compliant on its own. What these tools provide is the evidence: the logs, the rotation records and the access reviews an auditor asks for, which a folder of shared passwords cannot produce at any price.
A sensible ladder
- On your own: KeePass with a synced database, or Bitwarden free, with every password generated rather than invented. Cost: nothing.
- A small team: a paid team tier with shared collections, so joining and leaving are ordinary events. Cost: a few pounds per person per month.
- Regulated, or running privileged accounts: an identity provider for staff access, a PAM platform for admin credentials, and just-in-time elevation so nobody carries standing privilege between jobs. Cost: real, and considerably less than a breach notification.
If you are not sure which rung you are on, the test is simple. If somebody resigned this afternoon, could you say with confidence what they still had access to by tomorrow morning? If the answer involves a conversation rather than a report, you have outgrown the free tier.