Guide
Where to store passwords safely: what security experts advise
- First step
- Turn on two-step verification
- Recommended tool
- A password manager
- Your browser
- Safe on your own devices
The UK's National Cyber Security Centre recommends passkeys wherever a site offers them, and says a password manager, built into your browser or installed separately, is a tool that lets every account have its own strong password. Here is its advice, where a notes app falls short, and where DigiSafe fits.
Checked against the official sources on 18 October 2026. DigiSafe is a private app, not connected with these offices.
A real moment
“Your passwords live in your head, a diary and two browsers. Every new site asks for one, so you end up reusing the same two everywhere.”
The UK's National Cyber Security Centre recommends passkeys wherever a site offers them, and a password manager, built into your browser or from a third party, for everything else, with two-step verification, so every account can have its own strong password. It says saving passwords in your browser is safe on your own devices, but never on a shared device outside your home.
Advice from the UK's NCSC, with sources
Passkeys, password manager, browser or notes app
Where DigiSafe helps, and where it does not
First step
Turn on two-step verification
Recommended tool
A password manager
Your browser
Safe on your own devices
Never
The same password on two accounts
Start with two-step verification
The NCSC calls turning on two-step verification the first and most important step, because it protects you if a password is phished or leaked. Set it up on your email, banking and other important accounts, even the ones with strong passwords.
Use passkeys where a site offers them
The NCSC now recommends making passkeys your first choice of login and using them wherever they are offered. A passkey signs you in with a key protected by your device's own unlock, such as your fingerprint, face or passcode. For accounts without passkeys, keep using a strong, unique password and two-step verification. DigiSafe does not store passkeys.
Let a password manager do the remembering
A password manager stores your passwords so each account can have a unique one you never need to remember. Many also have extras, the NCSC notes: a generator for strong passwords, syncing across your devices, warnings when a password has leaked, and autofill, which helps against phishing because the password only fills in on the correct website.
Your browser counts, on your own devices
Chrome, Edge and Safari all offer to save passwords, and the NCSC says that is safe on your own devices and the easiest way to remember them. Never save a password in the browser on a shared computer at a college, library or other public place, and keep your browser and phone updating themselves, because saved passwords are only as secure as the device.
Why a normal notes app is a weak spot
Many phone notes apps keep their text open to anyone who unlocks the phone, and a note called Passwords is easy to find. A paper diary at home is out of reach of online attackers, but it can be lost, seen or left behind when you travel.
Strong passwords: three random words
The NCSC suggests combining three random words to make a password that is long enough and strong enough, or letting a password manager create one for you. Whichever you pick, never use the same password on two accounts, so one leak cannot open the rest.
Where DigiSafe fits
DigiSafe keeps logins, bank accounts, cards and Wi-Fi details next to your documents, behind a second lock that needs your fingerprint, Face ID or account password, with a generator and a Password health check. It does not autofill, so for everyday logins a password manager with autofill gives you the phishing protection the NCSC describes. DigiSafe suits the family's key details, which you can choose to leave for a nominee. It is free today.
Step by step
- 1
Turn on two-step verification on your email and bank accounts.
- 2
Use a passkey wherever a site offers one.
- 3
For other accounts, pick a password manager: your browser's own, or a separate app.
- 4
Give every account its own password, from three random words or a generator.
- 5
Never save passwords in the browser on a shared or public computer.
- 6
Keep the family's key details, such as bank accounts and Wi-Fi, somewhere a nominee can reach.
Questions people ask
What is the safest place to store passwords?+
Use passkeys where a site offers them: the UK's National Cyber Security Centre recommends them as your first choice of login. Otherwise it recommends a password manager, built into your browser or from a third party, so every account can have its own strong password.
Is it safe to save passwords in Chrome?+
The NCSC says saving passwords in your browser is safe on your own devices. Never do it on a shared computer outside your home, and keep automatic updates switched on.
How do I make a strong password?+
The NCSC suggests combining three random words, or letting a password manager create a strong, unique password for you.
Is it OK to use the same password on two sites?+
No. If one account is compromised, an attacker can try the same password on your other accounts.
Can I store passwords in DigiSafe?+
Yes. Logins, bank accounts, cards and Wi-Fi details sit behind a second lock that needs your fingerprint, Face ID or account password. DigiSafe does not autofill, so you copy and paste.
Where this comes from
Official sources, dated.
Every official detail on this page comes from the pages listed here, last checked on 18 October 2026. Fees, rules and links can change after that date. DigiSafe is a private app, not connected with these offices, and cannot guarantee them, so check the official page before you pay or rely on them.