Password managers for crypto users

Your seed phrase protects your wallet, but your accounts protect everything around it: exchange balances, the email that can reset those accounts, and the social profiles scammers love to hijack. Reused passwords are the most common way those accounts fall.

Why reuse is the real problem

When any website you have ever used leaks its database, attackers try the same email and password on exchanges, email providers and social networks. This is called credential stuffing, and it is automated. A unique password for every site makes one leak cost you one account, not all of them.

What a password manager does for you

• Generates long, random, unique passwords for every account.
• Remembers them, so you only need one strong master password.
• Autofills only on the real domain. This is an underrated anti-phishing feature: if your password manager does not offer to fill on a login page, look very carefully at the address bar. You may be on a lookalike domain.
• Syncs across devices, encrypted.

Reputable options include both cloud-synced and local-only managers. Pick one with a public security track record, end-to-end encryption and support for security keys or an authenticator app on the vault itself.

Setting it up well

1. Choose a long master password: a passphrase of several random words is easier to remember and harder to crack than a short complex one.
2. Turn on two-factor authentication for the password manager account itself.
3. Save the emergency or recovery kit the manager offers somewhere offline.
4. Start by changing passwords on your most important accounts: email first, then exchanges, then social media.

What not to store in it

• Your seed phrase. A password manager is an internet-connected vault. If it or your device is compromised, a stored seed phrase means an instantly emptied wallet. Keep seeds offline. See seed phrases.
• Wallet private keys, for the same reason.

Storing your exchange password, exchange 2FA recovery codes and wallet app PINs is reasonable, if your manager is protected by a strong master password and 2FA.

Browser-saved passwords

Built-in browser password storage is better than reuse. But infostealer malware specifically targets browser-saved credentials and session cookies. A dedicated manager with a locked vault adds a layer. Whatever you use, keep the device itself clean. See device hygiene.