There's a habit spreading across the internet, and it looks reasonable on the surface.

Someone needs a new password, doesn't want to use their dog's name again or bother with a password manager, and figures: why not ask ChatGPT?

A second later, they've got something like T#9vLmq$2Rk! staring back at them.

Looks strong. Feels sorted. They paste it in and move on.

But it’s not as strong as it looks. And research backs that up.

AI isn't random. It just looks that way

A study last year tested 1,000 passwords generated by leading AI models, including ChatGPT, DeepSeek, and Llama. The results are quite sobering.

Eighty-eight percent of passwords from DeepSeek and 87 percent from Llama failed to withstand attack. ChatGPT performed better but still produced passwords that could be cracked in under an hour nearly a third of the time.

The same architecture that makes AI useful is what makes it unsuitable here.

AI language models work by predicting what comes next based on patterns in their training data. That's what makes them so helpful for writing, summarizing, translating, really, any tasks where pattern recognition is the whole point.

But generating a truly random credential requires something AI can't do: producing output that has no relationship to anything that came before it.

What you get instead is the appearance of randomness. The output looks chaotic, but at a statistical level, it clusters. Character placement, length preferences, the ratio of symbols to letters. These tendencies are baked in. And modern cracking tools are specifically designed to exploit exactly this kind of regularity.

There's another dimension to this that gets overlooked. If you and a colleague independently ask ChatGPT to generate a strong password today, the results won't be identical, but they will likely share structural fingerprints.

The pool of genuinely distinct outputs is smaller than most might assume. Scale that across millions of people making the same request, and the "uniqueness" of your AI-generated password starts to look a lot less unique.

What happens to the prompt itself

Output quality is only half the problem. The other half is what you're handing over just by asking

On the free, consumer-facing tiers of most major AI platforms, prompts can be used as training data for future model versions. That's standard practice, and it's disclosed in the terms of service most people don't read.

Essentially, the context of your conversation – what you asked for, what service it was for, anything else you said in that session – may not remain private.

This is a different risk profile from enterprise or business-tier access, where data handling terms are typically more restrictive. But for the average person using ChatGPT on their phone to sort out a banking app password? It's worth knowing.

The broader point is that the moment a password – even a freshly generated one – enters a public AI conversation, you're in a different security posture than you were before you opened that tab. It's not necessarily a breach. But it is a security event, and most people don't think of it that way.

What to use instead

The fix isn't complicated. Credentials should be generated by tools built specifically for that purpose – password managers have existed for years and solve this precisely.

The core requirement is cryptographically secure randomization: outputs that have no statistical relationship to each other and no pattern for an attacker to grip onto.

Storage matters as much as generation. Unless you delete your AI chat logs, all of your passwords that you’ve had an LLM generate for you are going to be discoverable to anyone who accesses your account.

And given that ChatGPT, Claude and most other major LLMs operate browser session persistence (i.e. you don’t need to log back in once you close the initial session, unlike say a bank account), this adds a significant vulnerability.

The usual objection is convenience. AI tools are already open, already familiar. The tension between security and ease is as old as the industry. The question is whether the friction you're avoiding is the kind that was actually protecting you.

The smarter default

AI is a capable tool. It's just not the right one for this job. Pattern recognition is what makes it useful for writing and research; it's also exactly what makes it unsuitable for generating credentials that need to be genuinely unpredictable. Use a password manager for passwords. Use AI for everything else.

Most cybersecurity failures don't come down to exotic attacks or sophisticated exploits. They come down to small, everyday habits and decisions that accumulate into either a safe security posture or a vulnerable one. Knowing which tool to reach for, and why, is where good security starts.

We've rated the best business password manager.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

• Bitwarden upgrades Individual and Family plan protection
• The update covers password strength, storage, 2FA, and more
• A new pricing structure is being introduced as part of the update

Modern threats have moved beyond the requirements of simple password protections, with users themselves quickly becoming the main targets of attacks.

That’s why Bitwarden is introducing a whole bunch of new updates to its Premium and Family plans that will improve credential security and help educate users on the threats they face.

As one of our picks for the best password managers, Bitwarden is introducing updates across vault protection, password strength, secure storage, two-factor authentication (2FA) storage, and phishing protection.

Better protection comes at a premium

For a start, Bitwarden is making updates to credential vault health alerts. Bitwarden will now alert you to reused, exposed, or weak passwords and suggest immediate actions that can be taken to secure them. Additionally, when you do choose to update a password, Bitwarden will actively coach you in creating a stronger unique password.

Attachment storage has now been increased to up to 5GB, allowing users to store documents and backup codes securely within your vault. 2FA storage has also been increased to allow users to store up to 10 authentication methods ranging from hardware keys, native biometrics, and passkeys.

Finally, Bitwarden has also added a new phishing blocker tool, but is being slightly hush-hush about its capabilities and functions. For now, the Bitwarden blog says the new tool will, “Proactively identify and block malicious websites before they can steal credentials”.

Of course, the increase in protection comes with a caveat. The price of both Individual and Family plans is going up. The Individual plan is increasing from $10 per year to $19.80, or from less than $1 per month to $1.65. The annual cost of the Family plan will go from $40 to $47.88 annually, or $3.33 per month to $3.99 per month.

The updated pricing will go into effect from the user’s next renewal date, with a 15 day warning beforehand. There is some good news for existing customers though, all existing Premium and some early Families 2019 customers will get a one-time 25% first year renewal discount.

• 1Password has announced a new phishing protection tool
• Autofill won't happen automatically on unrecognized websites
• The tool will warn users of malicious URLs if they try to paste credentials

Phishing attacks can cost businesses and consumers dearly, from million dollar losses to ruined credit scores and stolen bank accounts.

Luckily, 1Password, one of the best password managers, has unveiled a new built-in phishing protection tool.

The new tool will compare the URL saved alongside your stored credentials with the URL you are trying to access, and provide a warning if something doesn’t quite match up.

Spoof URLs may be a thing of the past

Hackers will often use a technique known as typo-squatting or URL hijacking to lure victims into handing over their credentials without them knowing. In fact, a recent 1Password survey found that 89% of Americans have encountered a phishing scam, and 61% have fallen victim at least once.

In some cases, hackers will remove a singular letter that could be easily overlooked or mistyped (gogle.com or google.co), or add characters within the URL that look correct if you don’t check properly (gccgle.com or gooogle.com).

Now, when accessing a potential phishing site, 1Password will compare the URL of the site to the URL stored in a user’s credential vault. If the two don’t match, 1Password won’t autofill the credentials.

If the user then tries to paste your stored credentials into the site, a popup will appear warning them that the URL doesn’t match any URL in the credential vault, and that the URL might not be legitimate.

The new feature will be enabled by default upon rollout for all individual and family plans, and administrators of 1Password for Business will be able to enable enhanced phishing protection for employees via the Authentication Policies in the 1Password admin console.

Dave Lewis, Global Advisory CISO, 1Password, said, “Getting ahead of phishing attacks is all about communication, that’s what disrupts the scammer’s plan. The most important thing an employee can do if they receive a suspicious message is tell someone.”

“A lot of attacks could be prevented by simply knocking on the cubicle next door and saying ‘hey, does this look right to you?’ If someone believes they’ve already been phished, they should notify IT immediately. Those are the skills you learn with good training, and they need to be constantly reinforced, so people remember them when they get those urgent, scary-looking messages.”

For more tips on spotting and avoiding phishing scams and more information on the new tool, take a look at the 1Password blog.

These days, the sheer number of passwords we have to deal with makes relying on simple, repeated, or easily remembered phrases a critical security flaw. This poor practice opens the doors to all kinds of threats, from data breaches to identity theft and everything in between.

The solution is to utilize a robust password manager. By securely generating and storing unique, complex passwords for every single login in a vault, it instantly eliminates the risk of password reuse and human error, acting as the ultimate shield for your entire digital identity.

If that sounds great, wait until you hear this. For a limited time, Keeper is making world-class security exceptionally affordable during the company’s Cyber Week sale that runs longer than other Black Friday sales.

Today's best password manager deal

Why choose Keeper as your password manager

For starters, Keeper’s foundation is built on a zero-knowledge architecture, which means your encrypted data is scrambled and protected before it ever leaves your device.

What’s more, even the password manager itself can’t access or decrypt your master password or the information within your vault, ensuring absolute privacy.

Beyond simply storing credentials, as we mentioned in our Keeper review, it offers advanced features such as automatic password generation, secure file storage for confidential documents, and a KeeperFill functionality that autofills your credentials across all your devices and browsers, making secure logins faster than ever before.

For families looking for a password manager, Keeper’s Family plan provides a private vault for each member while allowing for the secure sharing of passwords and files between trusted individuals, thus simplifying access to shared accounts like streaming services or utility logins without compromising security.

Proton VPN ranks fourth in our list of the best VPNs overall, offering impressive privacy features, audited apps, and servers around the world. Even so, you might decide it's time to cancel your plan: maybe you're comparing options or want a VPN that comes with more add-on tools, like NordVPN.

Plus, with this year's best Cyber Monday VPN deals still alive and kicking for a few hours, it's a good time to consider your options.

The good news is that Proton VPN makes it easy to cancel your subscription or downgrade to a free account. In this guide, we'll walk you through the exact steps to cancel Proton VPN, plus how to request your money back as per its 30-day guarantee.

How to cancel Proton VPN

There are two main ways to cancel a Proton VPN paid plan, though the process isn't quite as straightforward as with some competitors. You can either contact customer support or cancel manually through your account dashboard.

Option 1: Cancel via customer support

1. Log in to your Proton VPN account dashboard.
2. Click "Chat with us" or the chat icon to start a conversation.
3. Tell the agent that you'd like to cancel your plan or downgrade to a free account.
4. Give a short reason for cancelling when asked.

Option 2: Cancel manually

1. Go to your Subscription tab in the Proton VPN dashboard.
2. Scroll to the bottom and click "Downgrade account."
3. Confirm your choice to stop your paid subscription or move to the free plan.

If you subscribed through the Apple App Store, Google Play Store, or Amazon Appstore, you'll need to cancel directly through that platform's Subscriptions page.

Even if you cancel manually, keep in mind that refund requests must be sent to Proton VPN's customer support team.

How to get a refund from Proton VPN

All Proton VPN paid plans include a 30-day money-back guarantee, giving you time to test the service risk-free. If you cancel within this window, you can claim a full refund. Once the 30 days have passed, refunds are no longer available.

Keep in mind that refunds are only offered for payments made by credit or debit card, PayPal, or Bitcoin. Payments made with cash or a bank transfer aren't eligible.

To request a refund, contact Proton VPN's customer support through live chat or the online support form. Include your registered email address, date of purchase, payment method, and a short reason for your request. This helps the team process your refund faster.

If you're subscribed to a Proton Unlimited plan, refunds are prorated, meaning the refunded amount is reduced by the days you've already used in your current billing cycle. Once your request is approved, the refund will be issued to your original payment method, usually within a few business days.

Surfshark sits comfortably at #2 in our overall best VPN rankings, and for good reason. It delivers excellent streaming performance, consistently fast speeds, built-in antivirus tools, and pricing that stays friendly to most budgets.

Even so, there are plenty of situations where someone might want to cancel their subscription. Maybe another service fits their current setup better, or they're simply trying out different security toolkits to see what feels right. Or, better yet, maybe they're browsing through the Cyber Monday VPN deals that are still active (though time is rapidly running short).

The good news is that cancelling Surfshark isn't complicated. Whether you're looking to stop automatic payments, switch providers, or take advantage of the money-back guarantee, the process is quick and straightforward.

This guide breaks everything down step-by-step, from turning off auto-renewal to requesting a refund.

How to cancel Surfshark

Surfshark renews subscriptions automatically at the end of each billing cycle, but turning off auto-renewal is straightforward once you know where to find the setting. The steps take less than a minute and work the same on any device.

1. Go to the Surfshark website and open the account page.
2. Sign in with your credentials.
3. Select "My account" in the top-right corner, then choose "Subscription."
4. Open "Payments", navigate to "Auto renewal", and click "Cancel auto-renewal".

After confirming, Surfshark immediately stops future charges. Your current plan will remain active until the end of the period you've already paid for, so there's no interruption in service.

However, keep in mind that disabling auto-renewal only stops upcoming payments. Anyone looking to reclaim their money will need to follow the refund process outlined below.

How to get a refund from Surfshark

Getting a refund from Surfshark is pretty straightforward, as long as you purchased the subscription on the Surfshark website and you're still within the 30-day money-back guarantee.

Just remember, the money-back guarantee applies only to your first purchase, not to any renewal charges, and Surfshark issues only one refund per service.

The fastest way to start the refund process is by using Surfshark's live chat. A short message saying you want to cancel your subscription and get a refund is enough to get things moving.

Support will then ask for a few quick details:

• Your account email
• The plan you bought
• Your payment method
• A brief reason for cancelling

Once confirmed, Surfshark processes the refund and sends it back to your original payment method. The VPN submits refunds right away, but the actual arrival time depends on your bank or payment provider. Most people see the money returned within a few business days, though some payment methods may take a little longer.

Another way to get a refund is to email Surfshark, but chat tends to be faster and more direct. If you prefer this route, you can reach the team at support@surfshark.com. Replies usually arrive within a day.

However, there are a couple of limits worth keeping in mind before you request your refund. If you paid using an Alternative ID, Alternative Number, an anonymous Dedicated IP, or prepaid or gift cards, Surfshark says these payments generally can’t be refunded. The same applies if your subscription came through a smaller third-party reseller, as those refunds must follow that seller's rules rather than Surfshark's.

If you made your purchase through a major app store, the process works a little differently, which brings us to the next part.

If you signed up through the Apple App Store, Google Play Store, or Amazon Appstore, Surfshark can't issue the refund directly. Each store handles its own billing, so you'll need to go through them instead. The good news is, the steps are pretty simple:

• Open the store you used and go to your Subscriptions section.
• Find Surfshark, tap Cancel, and follow the prompts.

Important: cancelling the subscription only stops future payments. It does not automatically refund you.

To get your money back, contact the store's support team (Apple, Google, or Amazon) and submit a refund request.

A quick heads up for Android users:
Google Play has a small timing rule. If you bought Surfshark within the past 48 hours, you can request a refund directly through Google Play. After that window closes, you'll need to message Surfshark's support team, and they'll take it from there.

Apple, Google, and Amazon each have their own refund policies, so the exact process and response time can vary slightly. But once you're talking to the right support team, things usually move pretty fast.

It’s Black Friday time once again, and while you might be looking at deals on that new TV you’ve always wanted, VPN providers are getting in on the action, too. Some of the best VPNs on the market have already released massive sales, making it a great time to pick up a VPN for the first time or shop around for something new.

VPNs encrypt your internet connection and protect against anyone trying to snoop on your online activities, whether that’s your ISP or bad actors lurking on unsecured public Wi-Fi. However, the best VPNs go further and offer extra features: everything from password managers to built-in antivirus solutions.

While a bundled antivirus won’t be quite as good as a stand-alone solution, some VPNs include them as part of your subscription, so you won’t need to pay extra to reap the benefits. Today, we’ll take a look at the top deals for a VPN with antivirus this Black Friday, and why we think they’re worth checking out.

Surfshark

Surfshark plans pack a lot of value into bargain prices. The One and One+ subscription options offer the biggest bang for your buck, however, and that’s why Surfshark holds the no. 2 spot in our best VPN rankings.

Both of these plans come with Surfshark Antivirus, which is available for Windows, MacOS, and Android devices. It comes with webcam protection to alert you if a site or app tries to access your camera, the ability to schedule virus scans, and real-time scanning of apps and downloads to keep you safe from spyware and malware that might try to sneak onto your device..

Further protection comes in the shape of Surfshark’s CleanWeb. When you’re connected to the VPN, CleanWeb blocks ads, trackers, and malware. CleanWeb is also available in the Surfshark browser extension, where it blocks ads, including video adverts.

It also blocks website trackers, cookie consent pop-ups, and malware. This makes browsing sessions safer by alerting you to past data leaks and any known malware on the websites you visit.

Surfshark Antivirus has also been tested by the top antivirus lab, AV-Test. In 2024, Surfshark Antivirus blocked 100% of test threats, earning it AV-Test’s ‘Top Product’ certification. In our own testing, however, we found that NordVPN's Threat Protection Pro was more effective at identifying and blocking potentially dangerous sites.

Surfshark always has great deals for Black Friday, and this year is no different. You can pick up the Starter plan for only $1.99 a month, but if you want access to all Surfshark's features, including antivirus, you want the One plan at $2.19 or the One+ plan at $4.19.

Norton VPN

Norton is a company better known for its standalone antivirus offerings, but its VPN product has come on leaps and bounds since a recent revamp that saw several substantial improvements. Looking at it solely as a VPN, it’s not one we think merits a place in our best VPN list, but it's still a solid choice for people who want to go with a trusted name in cybersecurity.

Norton VPN’s Plus and Ultimate plans come with antivirus support that defends against malware and ransomware, in addition to AI-powered Scam Protection. This is a new feature that uses AI to alert users to suspicious texts and fraudulent websites. Users can consult the AI in real-time if they think they’ve received a suspicious message or email.

Plus, just like Surfshark, Norton VPN was also tested by AV-Test in 2024. The evaluation praised Norton VPN's commitment to protecting user privacy, with a strong no-logs commitment and no DNS or IP address leaks. Norton VPN is currently the only VPN with antivirus to have also earned an AV Comparatives certification.

While it doesn’t offer quite as many VPN protocols as some other providers, Norton VPN is no slouch when it comes to features. It covers all the basics we would expect from any VPN we recommend, including obfuscated servers, multi-hop connections, a kill switch, and download speeds that edge out some of our top VPN picks.

Norton VPN hasn't unveiled a specific Black Friday deal as yet, but TechRadar users can still get some money off with our exclusive Norton VPN discount. Please be aware that this special deal is only available to readers in the US, Canada, the UK, or Australia

As of September 26, age verification is now mandatory in Arizona for anyone attempting to access adult-only content. Under the AZ HB 2112 bill, any site displaying at least 33% adult-only content must verify users’ ages using either a government ID or another “commercially reasonable method.”

While the logic behind this seems reasonable – protecting children from accessing adult or other harmful content – it’s a huge privacy tradeoff, as handing over your personal data (biometrics, credit card info, or an identity document) to third parties puts you at risk of identity theft, scams, blackmail, etc.

As a result, the best VPNs have seen a huge uptick in signups, with users turning to them to safeguard their digital privacy and stay anonymous on what’s becoming an increasingly geo-restricted internet in the region.

If you’re in Arizona and hunting for a VPN, this is arguably the best time to grab one. The Black Friday sales are already underway, and some of the most private VPNs are available at massive discounts.

Age verification elsewhere in the US

Over 20 US states have now enforced (or are in the process of enforcing) some form of mandatory age verification requirements, causing quite the stir among the privacy-conscious.

Ohio’s mandatory age verification went live on September 30, and citizens are now required to prove their age either via photo ID or employment or educational records if they want to access content that's “obscene or harmful to juveniles.” Not only that, but online platforms must verify their users' ages every two years.

Additionally, platforms are directed to create and use a geofence system, which means that as long as your online location shows up in Ohio, you’ll have to go through the age verification process.

However, experts have warned that it sets a troubling precedent for increased government control over the open internet. Plus, the vague wording around what constitutes "harmful" content could end up blocking educational resources.

There's also a lot of conjecture around Wisconsin's new age verification bill, which reportedly seeks to mandate that all internet service providers distributing “material harmful to minors on the Internet” block users trying to access their content using a virtual private network (VPN).

However, the Wisconsin lawmakers’ view of VPNs as a loophole that needs closing could be extremely difficult, if not virtually impossible, to implement, seeing as there’s no practical way for websites displaying adult-only content to filter out VPN traffic coming specifically from Wisconsin users.

The most secure VPNs in the industry spoof your location, meaning the provider only sees the location you've chosen from a server, not where you're actually connected from.

The bigger risk here, therefore, is whether lawmakers will suggest blocking all VPN traffic, or shift the onus of blocking access onto VPN companies, which would be an even bigger privacy issue, as it would require VPN companies to track the online activities of their users.

PrivadoVPN is neatly placed at #5 on our best VPN rankings, and it has a lot going for it. Chief among them are its budget-friendly prices. In fact, its Cyber Monday deal takes the price of a 2-year plan to just $1.11 per month. Combine this with its streaming performance, speed, ease of use, and a strong set of core tools, and you have a solid VPN.

However, there might still be a scenario where you'd want to cancel your PrivadoVPN subscription and get a refund. Maybe you want to take advantage of the Cyber Monday VPN deals to check out your options, or move on to a VPN service that offers more servers and has more features under its belt.

If that's the case, keep reading. We'll walk you through the step-by-step process of cancelling your PrivadoVPN account and getting a refund.

How to cancel PrivadoVPN

Cancelling your PrivadoVPN subscription is a pretty straightforward process, regardless of whether you're using its desktop or mobile VPN apps. The steps may vary slightly depending on the device, but overall, the process is very similar.

Below, we’ll outline how you can cancel your subscription using the PrivadoVPN website:

1. Visit the PrivadoVPN website and log in to your Admin area.
2. Scroll all the way to the bottom of the page and select "Cancel Account,” located below the FAQs in grey text.
3. PrivadoVPN will ask if you need help troubleshooting any issues. If you do, you can click “Contact Support.” If you want to continue with the cancellation, click “Continue Cancellation” at the bottom of the screen.
4. You’ll now be prompted to give a reason for why you want to cancel. A simple response like “I no longer want to use the subscription” should be enough. Then, click “Cancel Subscription” to move to the next step.
5. On the next screen, PrivadoVPN will show you some promotional offers if any are active. But if you're not interested in getting PrivadoVPN at a discounted price, click “Continue Cancellation.”
6. That’s pretty much it. The final screen will confirm your cancellation. You’ll see a “Cancellation Confirmed” message along with the date your subscription will end.

It’s also worth noting that if you’re a Freemium user, i.e., if you’re using PrivadoVPN’s free VPN, you don’t have to do anything manually to cancel your subscription. It’ll automatically expire after 30 days of inactivity. And because there are no payments tied to it, there’s nothing you need to cancel on your end.

That said, if you want to permanently delete your subscription, you can reach out to the PrivadoVPN support team and they’ll sort it out for you.

How to get a refund from PrivadoVPN

If you followed through with the entire cancellation process mentioned above, requesting a refund will be as simple as clicking the link “please contact our support team here” on the cancellation confirmation screen.

It’s worth noting, though, that regardless of whether you follow this route or contact customer support directly, you will be asked to provide a reason for the refund request. Then, once your refund is approved, the payment will be processed within 5 business days.

Most important of all, you need to make sure that you’re within PrivadoVPN’s 30-day money-back guarantee window if you want to claim the refund. If you’ve crossed that threshold, you simply won’t be eligible for a refund.

There are upsides and downsides to even the best free VPNs on the market. Some free VPNs are reputable but severely limit users' monthly data or server choices, while others are downright dangerous, designed to steal and sell personal data.

Generally, you'll get the best experience from a VPN by paying for a subscription. Think better speeds, no data caps, and the best security tools the VPN has to offer. Plenty of freemium services offer both free and paid plans, too, so you can trial a free service and get a feel for how it works before upgrading.

The Black Friday sales season is heating up, and we're already seeing some of the biggest VPN discounts of the year. There's no better time to take the plunge, try out a paid VPN plan, and save serious money in the process.

Why should I upgrade to a paid plan?

There are plenty of good reasons to use a free VPN: if you're in a pinch and need to secure your traffic when travelling and relying on public Wi-Fi, if you only plan to use it lightly, or if you're especially budget-conscious.

However, a VPN's main priority should always be protecting your digital privacy, and most free VPNs limit access to their most powerful security-boosting tools to paid users. So, if you're serious about staying safe online or unblocking previously inaccessible content, paying for a premium plan gives you more ways to do so.

The good news is that there's no need to spend a fortune. Freemium VPNs are often budget-friendly, so the jump from a free plan to a paid version isn't massive. Plus, in return, you'll get all the benefits of the VPN without the limitations, which can include:

• Fewer server locations to choose from
• Features locked behind paywalls
• Monthly data caps
• Being restricted to free-only servers
• Fewer ways to reach out to customer service

For PrivadoVPN, the biggest benefit of upgrading is the removal of monthly data limits, meaning users can stream and game without worrying about hitting the 10 GB cap. Plus, paid users also get access to the Privado Control Tower - a suite of tools that can block ads and trackers, and even implement some parental controls.

A paid Proton VPN subscription is likewise more powerful than a free one. Users get the best speeds, 10 simultaneous connections (an upgrade from 1), and the ability to manually choose the server that they want to connect to, which makes streaming and unblocking content much more feasible.

Windscribe makes the majority of its toolkit available to free users, but there are exceptions. Free users have a limited version of R.O.B.E.R.T., which can block malware and ads, but upgrading expands its functionality, letting users block gambling sites, fake news, and adult content, and more. Plus, with unlimited data, paid users don't have to worry about the monthly 10 GB cap.

All of the freemium VPNs we've highlighted here are also covered by a 30-day money-back guarantee, so you can see the difference between a free plan and a paid subscription for yourself, risk-free.

Black Friday 2025 is fast approaching, and two of today's best VPNs have already released discounts ahead of the big day.

Surfshark and Private Internet Access (PIA) are budget-friendly VPNs that lead our best cheap VPN rankings, and their Black Friday deals are some of the best we've seen this year, reducing the cost of a plan to around $2 per month.

Both providers offer unlimited simultaneous connections. That means you can install the VPN on as many devices as you want and use them at the same time, without worrying about usage caps. It’s ideal for folks in big households with tons of gadgets.

While Surfshark and PIA launched these deals early, they won’t be around forever.

Why do unlimited simultaneous connections matter?

While today's top VPNs have apps for pretty much every device you can imagine, they also tend to limit how many devices you can use with the VPN at the same time. NordVPN, for instance, limits users to 10 simultaneous connections.

That might sound like a lot, but if you live in a large multi-device household, you might quickly hit the cap. Surfshark and PIA solve this problem with unlimited simultaneous connections. One subscription is enough to protect a small army of gadgets - whether they belong to you, your friends, or your family.

It is worth noting that unlimited simultaneous connections aren't a must-have feature for every VPN user. Folks who live alone with a smaller number of gadgets won't find as much value in unlimited connections, and the industry average of 8-10 simultaneous connections is usually enough to cover their favorite devices.

The good news is that the Black Friday deals offered by Surfshark and PIA both come with a 30-day money-back guarantee. This gives you plenty of time to try them for yourself, and see how unlimited connections can impact your household.

While Private Internet Access (PIA) isn't one of our top five best VPNs overall, it still has a lot to offer. You get unlimited simultaneous connections, servers across all 50 US states, and a proven no-logs policy that's been independently verified on two separate occasions. It's why PIA remains a top choice for privacy purists.

Maybe you're taking advantage of the Cyber Monday VPN sales and weighing up your options, or want a VPN with more additional features. Either way, cancelling your PIA plan is nice and easy, as is claiming your money back (so long as you're within the refund window).

In this quick guide, we'll explain how to cancel PIA, stop automatic renewals, and request a refund without losing a penny.

How to cancel PIA

All PIA subscriptions renew automatically at the end of each billing cycle, but you can turn off auto-renewal at any time. The exact steps may vary slightly depending on your device or payment method, but the process is simple and takes only a few minutes.

To cancel your PIA subscription:

1. Go to the Private Internet Access website and log in to your Client Control Panel (CCP).
2. Select Next billing from the menu.
3. Click Turn off auto-renewal.
4. Confirm your choice when prompted (PIA may remind you of its key benefits before continuing).
5. Choose a reason for cancellation from the list (or enter your own), then select Continue with cancellation.
6. If asked whether there's a problem PIA can help with, click Turn off auto-renewal again.
7. You'll see a confirmation screen showing that your subscription has been cancelled and auto-renewal is now inactive.

How to get a refund from PIA

Turning off auto-renewal stops future payments, but it doesn't automatically trigger a refund. To get your money back, you'll need to contact PIA's customer support team directly. The easiest way is to open a support ticket through your account dashboard or email support@privateinternetaccess.com.

Make sure to include the email address you used to sign up and your original order number. Refund requests must be made within the 30-day money-back guarantee window: if that period has expired, PIA won't be able to process your request.

Once the support team verifies your details, they'll confirm the refund and send the funds back to your original payment method. Processing usually takes between 5 and 10 business days, depending on your bank or provider. It's a straightforward process, and most users report quick responses from PIA's customer service.

The rollout of age verification laws is one of 2025’s biggest digital privacy stories — particularly in the United States and the United Kingdom.

The restrictions are in place to protect children from accessing "adult-only" sites, but privacy advocates have warned that handing out personal information to third parties to access sensitive content could create more problems than it solves.

To protect their data and digital privacy, people are increasingly turning to VPNs. Unsurprisingly, though, lawmakers in Wisconsin aren’t pleased about it and have drafted a bill (called Wisconsin AB 105/SB 130) that could make it illegal to use a VPN to access adult content.

The proposed legislation would require anyone attempting to access adult content via a VPN to disconnect and prove their age, effectively blocking access to the content in the meantime. However, it's not clear yet how this would work in practice.

For the time being, VPNs are still a great way to shore up your online security in Wisconsin. So we’ve rounded up the best VPNs with the best Black Friday VPN deals to help you stay secure for less.

Can I trust a VPN with my data?

If you’re wary of third-party data handlers, you might wonder what makes VPNs different. Can they be trusted with identifiable information?

As is often the case, it depends on the VPN. We only recommend secure VPNs and typically suggest sticking to paid providers.

Legitimate VPNs don’t keep logs of what you do online or store any data that could be traced back to you or used to build a profile of your activity.

The same can’t be said for unsafe VPNs. Often, they:

• Provide weak encryption, leaving data vulnerable to interception
• Don't invest in new, privacy-boosting tools
• Don't undergo third-party audits
• Flood apps with ads
• Potentially log, store, and sell user data to turn a profit

This is especially true of free VPNs (though there are a few secure exceptions). Running and managing a VPN service is costly, after all, and if users aren’t paying with a subscription, they’re often paying with their privacy (and data).

A recent report from Zimperium zLabs claimed that a huge portion of free Android and iOS VPNs are categorically untrustworthy. They were found to use outdated code and request an excessive amount of permissions.

Plus, back in April, the Tech Transparency Project (TTP) investigated the top 100 free VPN apps on the US App Store, revealing that millions of users had sent their data to China without realizing it.

Should I avoid free VPNs?

Still, despite their risky nature, free VPNs are always going to be a tempting option. A TechRadar survey conducted in May even confirmed that almost 1 in 4 readers still used free VPNs.

If you want to be certain that you’ve picked a VPN (free or paid) that you can trust with your data, here’s what it needs to have:

• Regular audits of its no-logs policy
• A privacy policy that’s easy to read and that clearly states what data is collected, why, and how it’s stored
• Modern VPN protocols, like OpenVPN and WireGuard
• Well-implemented encryption, usually AES-256
• Core security tools, like a kill switch, obfuscation, and even multi-hop

Tired of constantly forgetting your passwords? Sick of feeling guilty because you've been reusing the same weak password for a bunch of different websites? Then maybe it's time to start using a password manager.

Since I started using one a couple of years ago all my accounts have become a lot more secure and, just as importantly, easier to access.

Obviously, it's really important that you trust the company you're going to use to store all your passwords and so it's worth using a company that knows a thing or two about digital privacy and cybersecurity.

Thankfully, these VPN apps have a great track record with both and also offer password managers, so you can protect your browsing data and passwords all with one subscription. Even better, they're now offering some great prices as part of their Black Friday discounts.

Just remember to follow best practice by using two-factor authentication and a strong master password for the vault!

Why combine a password manager with a VPN?

VPNs can help improve your digital security in certain situations but they can't do everything. Weak, reused passwords still pose a massive threat, regardless of any other tools you might be using.

A major reason people use weak passwords is because there's just too many to remember. A password manager solves all of those issues by generating unique, secure passwords that you don't need to be remember.

By combining your VPN and password manager you'll be simplifying things for yourself and improving your digital security with one subscription.

However, putting all of your passwords in one digital location does require a lot of trust and it's genuinely worth repeating: chose a strong master password and make sure you use two-factor authentication for your password vault! You really don't want to lose access because you forgot your password, or make all your accounts vulnerable because of one weak password.

Not only have we conducted in-depth reviews of NordVPN, Proton VPN and FastestVPN, we've also carried out in-depth research into NordPass and Proton Pass, so you can decide what the best combination of password manager and VPN might be for you.

Recently, a spate of high-profile, malicious cyberattacks on the retail sector has thrust the risks of a breach into the spotlight once more.

In April, Co-op disabled its IT systems to prevent attackers from installing malware. Since then, the company has faced problems with ordering and stock management, although spokespeople say they avoided the worst outcomes of the breach.

Attackers hit fellow retailer M&S even harder. M&S stopped accepting online orders, leaving shelves bare, following a successful cyberattack. The company is still navigating the aftermath of the breach, estimating business operations won’t return to normal for months.

The common thread between these high-profile retail breaches? Attackers used employee data to execute SIM swaps and gain system entry—a tactic that’s growing in popularity at an alarming rate.

SIM swapping involves attackers using stolen personal information to impersonate individuals and contacting their mobile carriers, fraudulently claiming to need a new SIM card due to loss or damage.

If they’re successful, the mobile carrier then transfers the victim’s mobile number to the new SIM card and delivers it to the attacker, allowing the attacker to bypass two-factor authentication and gain access to the victim’s accounts.

The National Fraud Database reports a 1,055% increase in SIM swapping attacks in 2024. Unsurprisingly, SIM swapping falls under the “identity-based” attack umbrella, which is consistently the largest threat organizations face year-over-year, accounting for 66.2% of all security incidents among Expel customers in Q1 2025 alone.

With M&S confirming that human error caused the fallout, it's clear attackers continue to exploit human—and credential-based vulnerabilities—leaving organizations at risk for potentially catastrophic financial and reputational loss.

The rise of vulnerabilities in internet-facing network appliances

Out of the threats Expel observed in Q1 this year, 20.9% were non-targeted malware attacks—many of which were delivered through misconfigured or exposed appliances, such as firewalls and VPNs.

Exploited appliances are likely used as broad entry points, not just in targeted attacks, but also through mass scanning and opportunistic exploitation of common misconfigurations or vulnerabilities. These appliances normally create a protective barrier for systems, but can provide a springboard for attackers when compromised.

Elsewhere, ClickFix techniques—where attackers manipulate users into executing malicious code via fake update-prompting pop-ups—contributed to 51% of all malware incidents and 78% of all infostealer malware incidents that we observed in Q1 this year. This includes the likes of CAPTCHA and QR codes, which trick users into infecting their own computers.

The increased use of these techniques reveals how relatively easy vulnerable endpoints can be turned against an organization. Even seemingly small user interactions, or passing appliance misuses, can result in code execution, turning protective systems like VPNs and firewalls into liabilities.

Enhancing security hygiene and reducing risks

Robust security hygiene is vital for protecting critical systems, as it only takes one lapse to create critical access points for threat actors.

Regularly updating systems and emphasizing security hygiene among employees can reduce exposure to threats. For example, organizations should enforce the use of the best password managers for all employees, including contractors or freelancers. Exercising security best practices helps ensure that the org isn’t an easy target for attackers, and could even encourage them to move on to different targets.

Businesses can also consider using managed detection and response (MDR) services to ensure that threats can be identified, prioritized and resolved efficiently, whilst any suspicious activity can be spotted, flagged and dealt with. It’s now more a matter of when, not if, attackers get in, and having the ability to identify and neutralize threats quickly is critical for minimizing business disruption.

This is so true that when I was at Microsoft, we had a mantra in everything we did in cyber. “Assume breach. Design your environment with the assumption that attackers will succeed.” This changes the perspective of cybersecurity completely.

To stay ahead of threats, it’s imperative that security and IT management sets aside time to run tabletop simulations of real-world cyber incidents, bringing key stakeholders across the business—think CFOs, communications managers, CEOs— come together to practice incident response in a collaborative way.

This focuses on decision-making and processes, and tests an organization's response plan by identifying gaps, reinforcing team roles and enhancing communication. These exercises help an organization build and develop its own incident response muscle, helping tame the intense stress that can be seen during an actual cyber incident.

Why businesses need a cybersecurity playbook

Regardless of the layered protection organizations put in place, the ever-increasing threat of credential-based attacks means that a cyberattack can—and most likely will—still occur.

Therefore having concrete and stress-tested plans for incident response in place is pivotal. This means having visibility into the affected systems, and the ability to both contain and mitigate successful attacks.

These recent incidents are a reminder of the potentially devastating, long-term business impacts that result from successful attacks.

M&S, for example, estimated that its loss of profits from this security incident would total approximately £300 million once it fully restores its services.

Co-op reacted quickly, taking its IT systems offline when its security team detected attackers in their system. As a result, Co-op is reportedly recovering faster than M&S, proving that a proactive, coordinated, and predetermined security plan can save companies millions.

These recent examples of UK retailers emphasize the pressing need for organizations to be prepared for abnormal access behaviors and credential misuse.

Act now, save later

The data shows that attackers are targeting identity tools, exploiting misconfigured systems, and using automation to scale their attacks. In a new age of cyber threats, reactive security is no longer viable.

Businesses must ensure that their networks are protected, maintained, and consistently patched to quell the rise of cyberattacks before they get worse. It’s time businesses treat network security as a strategic and operational priority, not simply an exercise in compliance.

We list the best online cybersecurity courses.

This article was produced as part of TechRadarPro's Expert Insights channel where we feature the best and brightest minds in the technology industry today. The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/news/submit-your-story-to-techradar-pro

We need to stay vigilant year-round when it comes to protecting our passwords. Today is World Password Day, which is a reminder of the importance of strong, secure credentials.

And in honor of this day, we have been tracking top deals from some of the best password managers in the business. If you are in the market to secure your digital footprint—whether for yourself, your employees, or your family—then these deals will help you do just that.

A good password manager does more than just store passwords— features like a password generator are just as important. Businesses benefit greatly from using password managers, too—these tools help manage employee access and identity across multiple platforms.

Password managers for families should allow members to easily access shared passwords and collaborate safely without compromising individual privacy.

We've done the heavy lifting and rounded up the best password manager deals available right now.

If you're interested in finding more about World Password Day, why it's celebrated, and insider tips from experts, our World Password Day live blog is tracking all the latest news and updates in the industry.

Top Password Manager deals

• Insecure solar systems allow cybercriminals to steal data and ransom access
• Millions of solar inverters remain vulnerable to severe cybersecurity threats
• Forescout – Vedere uncover flaws allowing attackers to take full control over solar systems

The increasing use of solar power has exposed critical cybersecurity vulnerabilities in inverters, cloud computing services, and monitoring platforms, creating an insecure ecosystem where hackers can manipulate energy production, disrupt power grids, and steal sensitive data, posing serious risks to global energy infrastructure, experts have warned.

A study by Forescout – Vedere Labs identified 46 new vulnerabilities across three major solar inverter manufacturers, including Sungrow, Growatt, and SMA. Previous findings showed that 80% of reported vulnerabilities were high or critical in severity, with some reaching the highest CVSS scores.

Over the past three years, an average of 10 new vulnerabilities have been disclosed annually, with 32% carrying a CVSS score of 9.8 or 10, indicating that attackers could fully compromise affected systems.

Millions of solar power systems face security risks

Many solar inverters connect directly to the internet, making them easy targets for cybercriminals. Attackers can exploit outdated firmware, weak authentication mechanisms, and unencrypted data transmissions to gain control.

Exposed APIs allow hackers to enumerate user accounts, reset credentials (ideally stored in password managers) to default values, and manipulate inverter settings, leading to power disruptions.

Additionally, insecure object references and cross-site scripting (XSS) vulnerabilities could expose user emails, physical addresses, and energy consumption data, violating privacy regulations such as GDPR.

Beyond grid instability, compromised inverters create further risks, including data theft, financial manipulation, and smart home hijacking - some vulnerabilities allow attackers to take control of electric vehicle chargers and smart plugs.

Cybercriminals could also alter inverter settings to influence energy prices or demand ransom payments to restore system functionality. As a result, the report recommends that manufacturers should prioritize patches, adopt secure coding practices, and conduct regular penetration testing.

Implementing Web Application Firewalls (WAFs) and adhering to cybersecurity frameworks like NIST IR 8259 could help mitigate risks.

Regulators are also urged to classify solar inverters as critical infrastructure and enforce security standards such as ETSI EN 303 645 to ensure compliance with best practices.

For solar system owners and operators, securing installations requires isolating solar devices on separate networks, enabling security monitoring, and following guidelines from organizations like the U.S. Department of Energy to reduce risks.

Installing the best antivirus software adds an extra layer of defense against threats, while deploying the best endpoint protection solutions further safeguards connected devices from cyberattacks targeting solar infrastructure.

You may also like

• These are the best green web hosting providers
• We’ve rounded up a list of the best web hosting providers
• Adapting the UK’s cyber ecosystem

• Apple's Password App has been patched after a vulnerability was discovered
• The flaw left users exposed for three months, experts claim
• Users were at risk of social engineering attacks

A bug in the iOS 18.2 Passwords app which left users vulnerable to phishing attacks for over three months after its release, has been fixed, according to an update from Apple.

The flaw was discovered after security researchers at Mysk noticed that their device’s App Privacy Report showed the Passwords App had contacted 130 different websites over insecure HTTP traffic.

The app used the HTTP protocol instead of a more secure HTTPS when opening links and downloading app icons. Upon further investigation, the researchers found that the app also defaulted to opening password reset pages with the unencrypted protocol. This left users vulnerable as an attacker “privileged network access could intercept the HTTP request and redirect the user to a phishing website,” the researchers told 9to5Mac.

Patch now

The risk in this attack is that cybercriminals will use the vulnerability to carry out social engineering attacks by redirecting victims to insecure websites.

The Password app will now use HTTPS for all connections by default - so ensure your Apple devices are all updated and using iOS 18.2 or later.

Research has shown security attacks on password managers have soared in recent months, with reports finding a threefold increase in malware that targets credentials in password stores.

The attacks are also growing in sophistication , with cybercriminals prioritizing “complex, prolonged, multi-stage attacks” delivered with an all-new generation of malware. This new malware, like infostealers, comes with more persistence, stealth, and automation.

The best, and most secure, password manager tools will safely store, generate, and crucially autofill your website and app passwords. These can help you create and manage your unique and strong passwords without the hassle of having to remember each one.

You might also like

• Take a look at our picks for the best password generators around
• Check out our choice for best antivirus software
• How phishing attacks are hitting the supply chain – and how to fight back

With the digital-first reality of the modern day, teams are now more scattered than ever before. The wider adoption of remote working, worldwide distributed teams, and complex interconnected workflows has created an urgent need for the secure exchange of credentials such as passwords and secrets. Secrets are sensitive digital credentials, such as passwords, API keys, and encryption keys, used to authenticate and secure machine-to-machine access to IT systems and data, for example for automated DevOps workflows.

Legacy solutions for sharing credentials, such as spreadsheets, consumer-grade password managers, or even messaging apps, are no longer sustainable. These antiquated practices expose organizations to severe security risks, inefficiencies, and compliance problems. Inefficient credential collaboration can lead to unauthorized access, data breaches, and business downtime. As regulatory requirements continue to intensify, organizations must prioritize secure, scalable, and transparent credential management solutions that serve the demands of the contemporary workplace.

Key Collaboration Challenges in Modern Teams

Modern workplaces rely on a mix of employees, contractors, and external partners who all require different levels of access to company credentials. Managing these access rights securely without inhibiting business effectiveness is a complex challenge. Organizations must adopt a fine-grained approach to credential sharing to prevent unauthorized access while facilitating productivity.

Many businesses operate with separate systems for different kinds of credentials. IT teams might use one solution for SSH keys, API tokens, and database credentials, while business teams manage logins for CRM, financial or human resources systems, and marketing tools elsewhere. This fragmented approach with siloed solutions creates security gaps, inefficiencies, and compliance headaches. A unified credential management solution has the potential to eliminate these issues.

Without proper credential collaboration measures in place, organizations face numerous security threats, including:

Unauthorized access: Weak or shared passwords can be exploited by cybercriminals.

Credential leaks: Storing credentials in plaintext files or unsecured locations increases exposure.

Lack of auditability: Without visibility into who accessed which credentials and when, tracking security incidents becomes difficult.

Poorly structured credential collaboration slows teams down. Employees waste time searching for credentials, requesting access, asking a colleague how to best share it, or resetting forgotten passwords. Small groups may manage credentials manually, but as an organization grows, so do the complexities of access management. Without software-based automation and governance, businesses risk operational bottlenecks, security risks, and non-compliance with industry regulations.

Organizations have different security and compliance demands, which influence their choice between cloud-based (SaaS) and on-premises credential management solutions. While SaaS solutions take away the burden of software maintenance, on-premises deployments provide full control over data residency, security policies, and compliance with regulatory frameworks.

With increasing regulations such as GDPR, HIPAA, and SOC 2, organizations must have transparency and control over credential access. A credential collaboration solution must support audit trails, access logs, and role-based access (RBAC).

Practical use Cases for Secure Credential Sharing

The below scenarios reflect the importance of sophisticated credential collaboration software.

For example, upon the departure of an employee, revoking shared credentials is a top priority. Individual accounts (e.g., Google or Microsoft) can be easily revoked, but shared credentials pose a greater challenge. If not properly managed, a former employee may retain access to critical systems, increasing the risk of data breaches. A departing employee might still have access to shared credentials, thus posing a potential security threat. Organizations need systematic policies to manage credential revocation efficiently.

A secure credential sharing system should offer:

Password expiration capabilities: Administrators can revoke access immediately or set expiration dates in advance.

Selective password rotation: Instead of resetting all shared credentials, organizations can identify and rotate only those used by the former employee.

Compliance benefits: Automated alerts and enforced expiration policies ensure governance and regulatory compliance.

Imagine another situation: when a coworker is out on vacation, teams may face challenges accessing critical accounts protected by multi-factor authentication (MFA). MFA is a security method that requires a second verification step in addition to a password, which is usually provided by a time-based one-time password (TOTP) generator. This typically means that when logging into an account, such as email, cloud storage, or business software, the user must give a second form of verification.

Reliable credential collaboration

One of the most familiar examples of MFA is entering a verification code received via SMS. Consider logging into an online company system, and after entering the correct password, the system requests a code sent to the mobile number registered for MFA. If the phone is with the vacationing colleague, they would have to be contacted in order to relay the code, causing delays and inefficiencies. Moreover, sharing the code through unsecured channels like email or messaging apps could expose it to interception, increasing security risks.

Thus, a reliable credential collaboration system should have:

MFA credential delegation: Secure ways of sharing temporary or emergency MFA access so that if a team member is unavailable, authorized colleagues can safely retrieve the required MFA codes.

Audit logs and access monitoring: Ensuring all TOTP sharing actions and access attempts are tracked for security and compliance.

Essential Requirements for a Credential Collaboration Solution

Besides the specific credential collaboration features outlined above, the following general considerations should be taken into account when selecting a software solution for your organization.

A highly modern security architecture provides maximum protection against threats. The most robust approach today is private-public key cryptography, which ensures secure authentication, encryption, and data integrity.

Organizations must use role-based permissions (RBAC) and the principle of least privilege (PoLP) so that workers only have access to the credentials they need. This minimizes risk and enhances security posture.

A secure credential management system must encrypt credentials in transit and at rest, thereby introducing a so-called zero Knowledge architecture. This ensures that even if data gets intercepted or compromised, it remains inaccessible to unauthorized parties.

Teams need the ability to share credentials securely without compromising usability. A credential collaboration tool should make sharing simple while enforcing access controls to constrain risk.

Logging and reporting

Comprehensive and detailed logging and reporting features provide organizations with visibility into credential usage. This assists with security monitoring, breaches investigation, and regulatory compliance.

Credential collaboration needs to seamlessly fit into existing DevOps pipelines, cloud environments, and enterprise IT infrastructures. Integrations with tools such as CI/CD systems, cloud platforms, LDAP, Single Sign-On (SSO) and identity providers streamline operations and enhance security.

A credential management solution needs to support small teams as well as scaling to meet the needs of large enterprises. Automated provisioning, centralized access control, and robust governance capabilities ensure long-term sustainability.

Organizations should have the freedom to choose between cloud-based and on-premises solutions based on their security and compliance requirements.

Unlike proprietary solutions, open source credential management tools provide full transparency into how credentials are stored and managed. Independent audits ensure that security vulnerabilities are identified and addressed promptly.

Organizations that must conform to strict privacy laws should have authority over where their credential data is stored. Hosting in GDPR-regulated regions ensures compliance and increased legal safeguards.

Frustration with Legacy Tools Leads to Risky Workarounds

Software users expect intuitive, user-friendly applications. When faced with legacy, cumbersome credential management software, such as business password managers and Privileged Access Management (PAM) solutions, they often become disappointed. These systems are usually too inflexible, complex, and difficult to onboard. Thus, they suffer from low user adoption.

When usability suffers, members of the team may resort to insecure workarounds, such as keeping credentials in spreadsheets or sending them over unsecured channels, which undermine security efforts. To prevent this, organizations must transition to modern, agile credential management solutions that:

• Combine security with ease of use to ensure adoption.
• Automate credential provisioning and deprovisioning to reduce friction.
• Offer easy to understand security workflows that can be trusted by users.

If organizations fail to modernize their credential management strategy, they are not only at risk of security breaches, but also poor utilization rates, which drives users back to insecure workarounds. It’s imperative to balance the need for strong security against easy usability in order to keep teams on board with secure credential collaboration.

How to Select the Right Credential Collaboration Tool

In short: Selecting the right credential collaboration tool requires careful evaluation of your organization's unique needs and security profile.

Team size and security requirements: Identify the size of your operation and the sensitivity of the credentials.

Integration requirements: Does the tool allow for integration with existing workflows and platforms?

Compliance necessities: Verify compatibility with industry regulations.

Usability vs. security: Balance ease of use with stringent security controls.

Cost-effectiveness: Evaluate pricing against feature sets and long-term needs.

For organizations handling sensitive data, self-hosting in jurisdictions with strong privacy laws offers greater security, regulatory compliance, and control over data residency.

We showcase the best identity management software.

This article was produced as part of TechRadarPro's Expert Insights channel where we feature the best and brightest minds in the technology industry today. The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/news/submit-your-story-to-techradar-pro

Have you ever forgotten the Wi-Fi password and had to rely on a sibling or parent to share it with you? Ever needed access to a streaming service or device when they're not home? You're in the right place.

The best password managers for families provide a safe and secure way to store and share all the usernames and passwords you use in your household, without having to worry about sending them again, and again, and again...

Our experts at TechRadar Pro have spent upwards of 2,000 hours testing 32 of the best password managers - looking at security and encryption protocols, number of devices each plan provides, secure sharing options and ease of use.

Now, from our extensive testing, I have assembled the best password managers for families based on the factors that matter most for household sharing, such as device limit, password vaults, device and browser compatibility, and sharing options, at a range of price points to suit different budgets.

Roboform remains my top pick for the best password manager for families thanks to its robust security features and great affordability for all budgets. Here are my recommendations:

Top Three

The best password managers for families of 2025 in full:

Best family password manager overall

Roboform has been in the password management industry for over two decades, which means that their platform has had to evolve and improve over the years to stay competitive, and it has paid off. This is currently the most affordable password manager on the market, and is a great option for families looking to improve the security of their credentials.

Roboform uses AES 256-bit end-to-end encryption to keep your passwords, files, and vaults secure, with the option to use the app as a two-factor authenticator. Roboform also supports biometric verification and has fully accessible 24/7 customer support.

The app is intuitive and easy to use with an old-school look. You can also turn on 'local mode' to keep your credentials stored only on your phone, meaning they won't be synced with Roboform's servers - particularly handy for the highly security-conscious.

The family plan offers 5 premium accounts with unlimited devices, meaning you can sign in and save your passwords with almost no restrictions. It also supports a wide range of platforms and browsers, making it my top pick for the best password manager for families.

Read our full Roboform review.

• ^ Back to the top

Best family password manager for security

The NordPass family plan is a great option for those looking for a highly reliable password manager from a great provider, especially if you already use some of Nord's other services such as NordVPN.

NordPass has some excellent security features such as its XChaCha20 encryption, and the option to use a USB stick or bluetooth device as an additional method of authentication when accessing your credentials.

The device limit is the only downside, but if you don't have more than six devices that you want to use it on, then this isn't a massive issue. There also isn't any guest credential sharing, so if you have visitors and want to share the Wi-Fi password or Netflix login, you'll have to do it the old fashioned way.

The customer support and help center are great for troubleshooting and solving any issues you might have. NordPass even lets you store your credit cards and payment details and share them securely with your family members.

You can even make it even more affordable if you can find a NordPass coupon to add an extra discount.

Read our full NordPass review.

• ^ Back to the top

Best family password manager for medium budgets

Bitwarden is a the best open source offering on this list, granting you transparency into the apps mechanics. Bitwarden also undergoes regular security audits, so you can trust that nothing shady is going on in the background.

Despite having a fairly basic desktop app, it offers far more web browser compatibility than any of the other password managers on this guide, working even with Tor. You can also benefit from Bitwarden's breach detection that notifies your of weak and leaked passwords.

The user experience is good, but some features aren't as slick as I'd like them to be, but given that it is an open source platform, users can contribute towards its development to iron out some of the kinks.

Overall Bitwarden is the best option for families looking to spend a little extra on their password manager, and offers some excellent features in return.

Read our full Bitwarden review.

• ^ Back to the top

Best family password manager for big families

Dashlane's family plan offers 10 premium accounts making it the perfect choice for those looking to protect the whole family's credentials.

Unfortunately, there isn't a email masking feature and you can't share credentials with people who don't have a Dashlane account - but negatives aside, this service has some great features.

Dashlane has a built-in VPN service, allowing you to better secure your home's internet traffic as well as your credentials. You can also store unlimited passwords and passkeys alongside receiving real-time phishing alerts.

You can also access your password history for your accounts, to help provide some visibility into which accounts may have had the same passwords, or just to see other combinations you have used.

Dashlane also offers a friends and family dashboard to help you manage each account, and live chat customer support for any issues or guidance.

Read our full Dashlane review.

• ^ Back to the top

Best family password manager for breach alerts

1Password offers all the features you would expect from a password manager, except for emergency vault access. This means that you won't be able to assign emergency access to your password vault if you get locked out of, or lose your device.

Logging in to 1Password doesn't just require your master password, but also a secret key that has to be copied and pasted in, which is a bit annoying. There is a 14 day free trial however, so you can test the service without paying anything up front.

The service has good browser extensions for all of the most popular browsers, and works across all of the most well known platforms, making it perfect for households with a mix of Windows, Macs, iPhones and Androids.

Overall, 1Password is a decent app for families looking to store their credentials securely, but the lack of emergency vault access knocks off some of its points as it is a fairly key feature for a family password manager.

1Password are also offering a limited time secure tax filing promotion until the 16th of April 2025.

Read our full 1Password review.

• ^ Back to the top

Best family password manager for deep pockets

Keeper is better suited for organizations looking to protect their credentials, but it also serves as a fairly decent password manager for families - if you can afford the price tag.

It offers good compatibility with a range of platforms and browsers, but breach monitoring isn't something that you get included for the rather pricey subscription. You'll have to pay extra for that.

Keeper's autofill is really good, and allows for fast and smooth input of your passwords, helping you to log in faster and fill out the important details.

You can also access 10GB of secure cloud storage for all your treasured files that you and your family need regular access to, and it automatically generates cloud backups of your important data to keep if safe.

Overall, you might be better suited using one of the other services on this list as a family password manager, but Keeper does a solid job across all the basics with regular updates to improve the service and great customer support.

Read our full Keeper Security review.

• ^ Back to the top

Tested by

Comparison table

The best password manager FAQs

How we tested the best password managers

We tested close to 30 of the most prominent password managers around, and picked out the very best to feature in this guide. During our testing, we made sure to try them out on every platform possible, to make sure they offered a consistent experience across all manner of devices and browsers.

We spent a considerable amount of time with each password manager to ensure that there were no nasty surprises that wouldn't necessarily crop up during a brief run through. We also tried to use them in every kind of situation we could think of, again in an effort to reveal any shortcomings that may have otherwise gone unnoticed.

The last thing you want to do is to change your password manager after discovering major flaws or aspects that you personally can’t live with, so we do our best to be as thorough as possible and consider all the different types of users that will deploy password managers for their specific wants and needs.

However, it is worth noting that good password managers usually offer easy ways to export your vault from one manager to another, so if you don’t personally like a manager after spending a lot of time with it, don’t feel you’re stuck; most vendors offer easy-to-follow guides on switching to their manager from others - they want to win your custom, after all.

Read more on how we test, rate, and review products on TechRadar.

Get in touch

• Want to find out about commercial or marketing opportunities? Click here
• Out of date info, errors, complaints or broken links? Give us a nudge
• Got a suggestion for a product or service provider? Message us directly

• You've reached the end of the page. Jump back up to the top ^

• Picus Security says the number of attacks against password managers skyrocketed in 2024
• The malware is growing more sophisticated
• Users should deploy MFA with password managers, research suggests

Cybercriminals are increasingly targeting password managers in an attempt to break into various important digital accounts.

Picus Security detailed its findings in the newly-released Red Report 2025, based on an in-depth analysis of more than a million malware variants collected last year, finding a quarter of all malware (25%) targeted credentials in password stores. This, the researchers claim, represents a three-fold increase compared to the year before.

“For the first time ever, stealing credentials from password stores is in the top 10 techniques listed in the MITRE ATT&CK Framework,” they said. “The report reveals that these top 10 techniques accounted for 93% of all malicious actions in 2024.”

Multi-factor authentication

The attackers are using all sorts of sophisticated extraction methods in their attacks, Picus Security co-founder and VP of Picus Labs, Dr. Suleyman Ozarslan said, including memory scraping, registry harvesting, and compromising local and cloud-based password stores.

To tackle the threat, Ozarslan added, it is pivotal people use password managers together with multi-factor authentication (MFA). Furthermore, they should never reuse a password, especially for their password manager.

The attacks are not just growing in volume, but in sophistication, as well. Picus said it’s seen threat actors prioritizing “complex, prolonged, multi-stage attacks” that require a new generation of malware. That malware, infostealers included, comes with increased stealth, persistence, and even automation. The researchers likened this increasing sophistication to “the perfect heist”, since most malware samples come with “more than a dozen malicious actions designed to help attackers evade defenses, increase permissions and exfiltrate data.”

A password manager is a tool that securely stores, generates, and autofills passwords for websites and apps. It helps users create and manage strong, unique passwords without needing to remember them all. It is considered one of the key pillars of good cybersecurity hygiene.

You might also like

• How to choose the perfect password manager for you
• We've rounded up the best password managers
• Take a look at our guide to the best authenticator app

Cybercrime is a costly affair, with nearly £11.5 million stolen last Christmas alone, according to the UK's National Cyber Security Centre. That’s £695 on average per victim. With the festive season in full swing, the rush to snag post-Black Friday bargains and buy Christmas gifts online has led to a sharp rise in threat levels. For cybercriminals, this is the perfect opportunity to deploy their latest techniques, targeting unsuspecting shoppers to steal money and personal data.

UK Fraud Minister Lord Hanson issued a stark warning in November on the dangers of holiday scams. However, the sheer volume of online interactions, the sophistication of cyberattacks, and the increasing reliance on digital shopping during the holiday season make it far more challenging to identify a scam at first glance.

AI-Driven Phishing: More Deceptive Than Ever

Phishing has long been one of the most common forms of cybercrime, but the emergence of AI has revolutionized the way these attacks are carried out. Previously, phishing emails were easy to spot, often riddled with spelling mistakes and strange phrasing. However, with AI, cybercriminals can now analyze the communication styles of businesses, studying their marketing emails and messages to replicate the tone, branding, and even the content of legitimate communications.

Attackers can now seamlessly impersonate colleagues, executives, and even customers, making it harder for targets to identify a scam. It has become easier–and cheaper– than ever to undertake these targeted spear-phishing attacks, which are much more likely to succeed.

AI and Human Behavior: Exploiting Vulnerabilities

AI’s ability to analyze human behavior has also made it easier for cybercriminals to exploit psychological triggers. By studying past interactions and identifying patterns in behavior, attackers can craft messages that play on an individual’s emotions. For example, during the busy holiday season, cybercriminals exploit the stress of missed package deliveries. Imagine receiving a seemingly legitimate text from a courier service, urging payment for redelivery. One victim, distracted and eager to resolve the issue, entered card details on a convincing fake site—only to realize later the text came from an unknown mobile number, not the courier. It’s a reminder that vigilance can’t take a holiday.

AI can also be used to time phishing emails or fake social media ads to coincide with busy shopping periods such as Black Friday and Christmas sales. Cybercriminals can also create fake websites offering massive discounts or time-limited offers, hoping to lure in shoppers eager to make a purchase quickly. Under pressure, people are more likely to fall for scams.

In the same way, AI can be used to create fake bank alerts or financial notifications that play on a customer’s fear of fraud or account security issues. These phishing attacks, which often contain urgent warnings or threats, push the recipient into a state of panic, encouraging them to click on a malicious link or provide sensitive details. It can also be very hard to spot when the destination site or notifications look identical to the official source.

In fact, while it may seem simple to check if a website is secure by looking for the HTTPS prefix or a padlock icon, these are no longer foolproof indicators of a secure site. Cybercriminals have become adept at creating fake sites that look identical to trusted brands, making it easy for consumers to be misled.

Deepfake Technology: Social Engineering with a New Face

Alongside phishing, AI is increasingly being used in social engineering attacks, particularly through deepfake technology. Earlier last year, ARUP lost $25 million to fraudsters after an employee was tricked into believing he was carrying out the orders of his CFO. And everyday people aren’t immune either. A kitchen fitter from Brighton was scammed for £76,000 because he believed a deepfake advert purporting to be Martin Lewis, the money-saving expert.

This method is highly effective because it bypasses traditional security measures we rely on, such as email filters, multi-factor authentication, or the ‘sniff test’, which means that something is awry. Deepfakes create a sense of urgency and authority, making it easier to manipulate people into taking actions they would otherwise refuse. And their realism, especially when duplicate social media profiles are concerned, makes such scams harder to detect, even for those with extensive training.

Protecting Against AI-Enhanced Threats

As the sophistication of AI-driven phishing and social engineering attacks grows, it is essential for both businesses and consumers to adopt proactive security measures. For individuals, vigilance is key. Avoid clicking on links in unsolicited and junk emails, texts that claim to come from businesses or government agencies, or even ads seen on social media platforms. Always manually type in the URL of a website, rather than clicking on embedded links, to ensure that you are visiting a legitimate site.

Multi-factor authentication should also be implemented wherever possible, as it adds an additional layer of security beyond traditional login credentials. Password managers can also help users create and store strong, unique passwords for each account, reducing the risk of credential theft. Passkeys, which rely on biometrics and device management, are the next level of protection that is slowly being adopted.

For businesses, investing in advanced threat detection and response systems is essential. These systems can identify and mitigate phishing and social engineering attacks before they cause significant damage. Machine learning algorithms within these systems can detect patterns of malicious activity that traditional security measures might miss. Regular employee training is also crucial, as the human element remains one of the most vulnerable points of attack.

Moreover, businesses should work to ensure that their employees and customers are aware of the risks posed by deepfakes and other forms of AI-driven social engineering. Implementing robust verification processes, such as requiring multiple confirmations for financial transactions, can also help reduce the risk of falling victim to these kinds of scams. Ultimately, staying ahead of evolving AI threats requires collective vigilance and a stronger commitment to safeguarding personal information.

Checkout our list of the best business password managers.

This article was produced as part of TechRadarPro's Expert Insights channel where we feature the best and brightest minds in the technology industry today. The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/news/submit-your-story-to-techradar-pro

If I thought losing my beach body over the festive break was bad enough, I nearly lost a whole lot more recently, my entire online identity, in fact.

I'm no stranger to a data breach. I was hit by the Yahoo! breach back in 2013, and a number of smaller incidents since – I'm looking at you Roll20 – and I had come to the realization that, however hard I try, nothing I have online will be safe.

The thing is, this time was different. None of my multiple alert systems had warned me. There were no new alerts. Nothing. But there they were, tens of emails from the likes of LinkedIn, Outlook, and EA, all saying one thing: I'd requested to change my password, which, of course, I hadn't.

Who'd want to impersonate me? Or, worse, see the terrible state of my FC 25 Ultimate Team? No clue, but it could've been a whole lot worse if it wasn't for a few simple, and free, steps.

An unwanted truth

If I lay my cybersecurity habits bare for a second, I'm awful with passwords. No, I'm not using Password123 or anything to secure my most private information, but I don't create something closer to Klingon to ensure my life remains safe. Maybe I should?

The reality is the simpler the password, the less time, if any, it'll take to crack. What's worse, once a password is compromised, it could be used again and again on different accounts by hackers. The most popular passwords of 2024 could all be cracked in under a second and, while none of mine are on that list, my history with data breaches suggests it mightn't have taken a hacker much longer.

In this instance, I'd tried everything from patterns to vegetables to war ideologies – because why not – so something was finally going to have to give. At least, this time, that something was free.

A simple (and free) solution

It's easy to pontificate about simple ways to improve your online security but this one is easily achievable and probably tops the lot. While the best VPNs, best antivirus software, and the like will set you back your precious dollars, a password manager can be completely free and might be all you need to keep your data safe.

Right now, we rate Bitwarden as the best free password manager out there, but bending the concept of "free" is a better shout. Many of the best security programs, such as VPNs and antivirus software, now come with a password manager included – and far too many customers aren't using them!

The key benefit of a password manager is that you don't need to stress about going full-goldfish and forgetting all your passwords. By setting up a password manager on your devices, you can not only access all of your – now hopefully extremely unique – passwords whenever you need, but you also can update them in one click when a website might require you to.

Doing the security two-step

Now, I never mention actually being breached when telling my tales of woe. As it happens, none of my services have ever been completely compromised. The reason? Two-factor authentication.

I know, it's a pain in the backside – why willing add yet another set of phone notifications? But 2FA really can stop you from losing everything. By combining two-step authentication and a password manager, not only are you warned of any unwanted attempts to access your accounts, but you also have an easy way to store a new unique password that'll rescue your data.

Don't be me

It's simpler than you think to avoid a situation like mine – and I wish I'd known that sooner. While not all solutions are free, it doesn't have to cost you a fortune to keep your online life as secure as possible.

A great example of this is Proton's Proton Unlimited plan. This plan gives you a complete bundle of protection including secure email, password management, and secure cloud storage. A Proton Unlimited plan starts from $9.99/month which, despite appearing costly, is very good value given the quality of the products included.

To my dearest hackers

So, to the people in Vietnam, Tapei, and various other places where I'd apparently attempted to log in, sorry! You've got a few more steps to get through to become me than you might like, and I didn't have to pay for any of them! Hopefully, now that I've told my story, I won't be alone in being a tough nut to crack.

If you spend a substantial amount of time online, you’re probably aware of the multitude of websites and apps that require that you set up a login and a password. These are set in order to protect whatever personal information you might save on the website and it’s a valuable target for malicious actors, like hackers, to target. This fact is why so many companies will force you to have a complex alphanumeric password that fulfills a list of requirements, why it’s suggested that you don’t use a single password on a number of platforms, and why you’ll sometimes be prompted ot change your password even if you haven’t forgotten it.

While I understand the necessity of measures like these and even further ones, but it does get a little frustrating having to remember a number of distinct passwords and having to make up and memorize new ones fairly regularly. Luckily, there’s a pretty good solution that you can enlist for free or often at a pretty low price: password managers.

Now, password manager apps aren’t new, in fact, they’ve been around since the 90s, but they’re still handy to be aware of. In this article, I’ll list some that come recommended and how you can get them for yourself. They do vary in how many features they offer, often depending on whether you get a free or paid version, and in complexity, so I’m sticking to pointing out either free apps or apps that are very affordable for individual users. Many password managers will also give you offline access to make sure you can configure them and see your information even if you’re not connected to the internet.

A great free password manager: Bitwarden

This free, open-source password manager securely stores your passwords and boasts impressive compatibility across different platforms, including Windows, macOS, Linux, Android, iOS, and major web browsers like Chrome, Firefox, Safari, Edge, Opera, and Brave. This ensures you can access your passwords from any device. It also includes features like a built-in password generator and support for two-factor authentication.

If you’d like to use it for business purposes, there is a monthly fee, but for personal use, it’s free.

You can download Bitwarden from the official website.

Other recommended free password managers: KeePass (also open-source!), KeePassXC (a more streamlined alternative)

An excellent paid (but not expensive) password manager: 1Password

A popular password manager designed to securely store and manage your password (and other sensitive information). It also has a ‘Watchtower’ feature which alerts you to weak, reused, or compromised passwords, enabling you to change these and prevent your accounts from being compromised. It also offers cross-platform support, offline access to your login details, and a password generator.

1 Password offers a number of different plans, but for individual users, it’s €2.65/a month (which is approximately $2.76/a month in the US, £2.24/a month in the UK, and A$4.40/a month in Australia).

Other free ways to help manage your passwords

If you use Chrome or Firefox, these browsers have free built-in password management features, namely Google Password Manager and Firefox Password Manager. If you use a Mac device, you can use iCloud Keychain (which can sync and also be used on iOS, iPadOS, and visionOS). If you choose one of these options, make sure you keep your browser updated so that your browser or operating system has the latest protections made and distributed by their respective companies.

If you’re a casual PC user, you might wonder whether you really need a password manager, especially when browsers and operating systems already offer built-in options. However, consider this: in today’s increasingly digital world, the security of your online accounts is only as strong as your weakest password. It’s easy to fall into bad habits, like reusing passwords across platforms or creating ones that are too simple to be secure.

A password manager can simplify your life and improve your digital security by taking the burden of remembering countless (often complex) passwords off your shoulders. Whether you opt for a free tool like Bitwarden or a reasonably priced option like 1Password, the small effort of setting it up can pay off in spades by protecting your personal information and saving you from future headaches.

If you're looking for a password manager for your professional activities, check out our Techradar Pro guide.

YOU MIGHT ALSO LIKE...

• How does a password manager work?
• Looks like Android is making life easier for those with password managers
• Apple might be about to launch its own password manager

Okay, hands up – how many of you are still reusing the same passwords across a bunch of accounts? Uh-huh. I see you. You've probably heard this before but it bears repeating: using the same password over and over is a massive privacy no-no.

If you're wondering how you're supposed to keep track of dozens of unique logins, however, then I have good news – a password manager will do it for you. They'll even generate new passwords and encrypt your existing ones. Even better? Plenty of today’s best VPNs also have their very own password managers.

We're right in the middle of the Cyber Monday VPN sales, though there's not a lot of time left to bag a bargain. So, if you’re intrigued by password managers and want all the benefits of a VPN, take the plunge. Your digital privacy will thank you for it.

Why password security matters

Cybercriminals are crafty little creeps, and the first and best way of preventing them from accessing your accounts (and all of the potentially sensitive data stored within) is with a secure password. Plus, you’ll also be reducing the risk of being involved in costly data leaks.

A weak password is, as you can imagine, a lot easier to crack than one stuffed with symbols and numbers. Ensuring that your password is at least 16 characters long means it’ll take billions of years to figure out – whereas an 8-character password only takes a few hours.

Of course, you won’t want to use that one solid password for everything, as reusing passwords is massively risky. If a bad actor gets access to one account, and you’ve been sharing passwords across multiple sites, they could get access to everything else – your social media, banking platforms, and medical accounts.

Then, the bad actor has everything they need to lock you out of your account and sell your data for profit – or even go on to commit identity fraud.

Top tips for strengthening your passwords

So, with all this in mind, you might be wondering about the ingredients to a perfect password. Let’s go through the recipe one at a time:

• One password per account: every time you log in to a site or create a new account, you should be using a different password – and a password manager can help you generate and remember these unique logins.
• Get creative with symbols and numbers: the best passwords are an eclectic mix of characters – numbers, symbols, and non-dictionary terms included. Get weird with it if you’re generating your own.
• Don’t include personal information: gone are the days when including your pet, children, or spouse’s name in a password was acceptable. It’s a nice homage, but it’s predictable, and a hacker combing through your social media will incorporate these details into their brute-force attacks.
• Switch it up regularly: change your passwords every three months or so to keep your accounts locked up tight and, if you receive an alert that a login has been involved in a data leak, change the associated password right away.
• Enable multi-factor authentication: MFA is a must-have wherever it’s available, as it requires you to input a unique code whenever logging into a site or app. You’ll receive the code via text, usually, which means that a hacker won’t be able to access your accounts unless they have your phone, too (which is seriously unlikely).

My VPN recommendations

In an age where data breaches and privacy concerns are increasingly common, securing email communication is more critical than ever. Migrating from a less secure email service to a more secure one can seem daunting, but the transition can be smooth and efficient with a step-by-step approach. Below is a comprehensive guide on migrating your existing email account to a secure email platform.

1. Choose a Secure Email Provider

Before you can migrate to a new email service, selecting a secure and reliable email provider is important. Look for services that offer end-to-end encryption, which ensures that only you and the intended recipient can read the contents of your emails. This adds a crucial layer of security, especially if you often share sensitive information.

Additionally, review the provider’s privacy policy carefully. A strong privacy policy should clearly outline how your data is managed, what information is collected, and whether it is shared with third parties. Opt for providers that minimize data collection and prioritize user privacy.

When considering jurisdictions, it’s beneficial to choose email providers that operate under laws that protect user data, such as the General Data Protection Regulation (GDPR) in the European Union or the Federal Trade Commission (FTC) regulations in the U.S. These laws establish strict guidelines on data handling and user privacy.

Some of the best secure email services that align with these criteria include:

ProtonMail: Based in Switzerland, ProtonMail offers robust end-to-end encryption and has a strong privacy framework, as Swiss laws provide significant protection for personal data.

Tutanota: Based in Germany, Tutanota features end-to-end encryption for emails and the entire mailbox and address book. It complies with GDPR, making user privacy a priority.

By evaluating these aspects, you can ensure that your transition to a new email service protects your privacy and enhances your security.

Features to consider

When choosing a secure messaging app, prioritize features that protect your communications. Look for end-to-end encryption, which ensures that only the intended recipient can decrypt your messages, minimizing interception risks.

Two-factor authentication (2FA) is also crucial, as it adds an extra security layer by requiring both your password and a secondary verification method, like a code sent to your phone. This reduces the chances of unauthorized access.

Consider the app's server location concerning data privacy laws. Apps operating under strong regulations, like the EU's GDPR, often provide better data protection.

Using open-source technology enhances trust, allowing independent experts to audit the code for vulnerabilities and ensuring transparency.

Lastly, apps with zero-knowledge architecture ensure that the service provider cannot access or decrypt your messages, protecting user privacy even in a data breach.

By considering these factors, you can select a messaging app that prioritizes your security and privacy.

2. Setting up a new account

Creating your new account is a breeze once you've chosen your secure email provider. Here's a quick walkthrough:

Head to the provider's website and locate the signup page. Most providers offer free email accounts, so you shouldn't worry about upfront costs.

Choose a username and password. Your username will be your email address, so select something memorable and professional. For your password, choose a strong combination of letters, numbers, and symbols you won't use for other online accounts.

Set up two-factor authentication. This extra layer of security helps protect your account from unauthorized access. When enabled, you'll receive a code via text message or authenticator app whenever you try to log in from a new device.

Configure your recovery options. If you ever forget your password, you'll need a way to recover your account. Choose a recovery email address or phone number that you can access.

Start using your new secure email account! Knowing your communications are protected, you can now send and receive emails with peace of mind.

3. Export old emails

If you want to keep your old emails, you'll need to export them from your current service. Most email services offer a way to download your data. This process will vary depending on your provider, but generally, you can follow these steps:

For Gmail:

1.  Go to Google Takeout.

2.  Select only "Mail" or choose specific labels.

3.  Choose the file format and delivery method, then click “Create export”.

For Outlook:

1.  Open Outlook and go to File -> Open & Export.

2.  Select “Import/Export” to open the wizard.

3.  Choose “Export to a file” and select “Outlook Data File (.pst)”.

4. Import emails to your new secure email account

After exporting your emails, it’s time to transfer them to your new secure email account. Many providers offer import tools or support resources, so check the documentation of your new service for specific procedures.

For complex migrations involving multiple accounts or extensive archives, consider using tools like MailStore or Thunderbird. MailStore helps create backups and restore emails easily, while Thunderbird provides powerful import options that maintain folder structures and metadata.

Before starting the migration, organize your emails by deleting unnecessary messages and categorizing important ones. This will streamline the import process.

Ensure you have a stable internet connection during the transfer, and be prepared for it to take some time, especially with large amounts of data. Monitor the progress and address any errors that arise.

With proper tools and some preparation, you can successfully transfer your emails to your new service. Don’t forget to explore the new features and security options available to enhance your email experience.

5. Update your email address across services

Switching to a new email address requires some digital housekeeping to ensure a smooth transition. It's essential to approach this process methodically to avoid any disruption in communication or access to important services. 

Start by listing all the services, subscriptions, and contacts associated with your old email address. This includes vital accounts like online banking, e-commerce sites, and subscription-based services like streaming platforms, newsletters, and software applications. Take note of any promotional or loyalty accounts requiring email verification for updates or rewards.

Additionally, don't forget your social media profiles. Updating your email on platforms like Facebook, Twitter, LinkedIn, and Instagram is crucial, as these platforms often use your email for notifications, security alerts, and important updates. Check any associated apps that may require your new email for notifications or account recovery.

Professional contacts are equally important. Inform colleagues, clients, and networking connections about your new email address to ensure you remain reachable. It may be helpful to send a blanket email from your old account explaining the change and requesting them to update their records. 

Moreover, consider updating your email address in any personal or work-related documents containing your old address. This might include resumes, cover letters, or any documentation for ongoing projects. 

Taking the time to update these records methodically prevents missed notifications, ensures you receive important information and maintains seamless communication with the people and services that matter most. Remember to monitor your old email account for a while after the transition, just in case any messages slip through the cracks, allowing you to redirect important communications to your new address.

6. Set up email forwarding

To set up forwarding on your old email account, start by logging in to your account. Once you're in, navigate to the settings menu, which is usually represented by a gear icon or found in the account dropdown. Look for an option labeled "Forwarding" or "Mail Forwarding."

After selecting that option, enter your new secure email address in the designated field. Make sure to check any boxes that may allow you to keep a copy of the forwarded emails in your old account, which can be helpful for backup purposes.

Some email providers may ask you to verify this new forwarding address. If prompted, follow the verification steps, which might include clicking a link sent to your new email. 

Once the setup is complete, try sending a test email to your old address to ensure that it is being forwarded correctly. Monitor both accounts for a few weeks to confirm that all incoming messages are being redirected properly. This will help you catch any important emails during the transition period and ensure that you don't miss out on critical communications. 

Additionally, consider updating any contacts or services that use your old email address to avoid future confusion.

7. Secure your new email account

Congratulations on setting up your secure email account! To keep it secure, regularly update your password with a strong combination of at least 12 characters, mixing uppercase and lowercase letters, numbers, and special characters. A memorable passphrase made up of random words can help with this.

Check your account settings for enhanced security features like two-factor authentication (2FA) or multifactor authentication (MFA). Enable additional protections like advanced spam filters and anti-phishing measures. Familiarize yourself with options to report suspicious messages or block unwanted senders.

Stay vigilant by reviewing your login activity regularly. Many email providers have a security log to help you monitor recent logins. If you spot any unfamiliar activity, take immediate action, such as changing your password.

By following these steps, you can help ensure your account remains secure and your communications private. Stay informed about the latest security threats and best practices to maintain your email security.

8. Educate yourself about phishing and scams

Moving to a secure email provider is a significant step towards better security, but it’s also essential to remain vigilant about phishing attacks and scams. Phishing attacks often come in the form of unsolicited emails that appear to be from legitimate sources, such as banks, online services, or even colleagues. These emails may urge you to click on links or provide personal information, such as passwords or credit card details.

To protect yourself, take the time to educate yourself about the common signs of phishing attempts. Look for discrepancies in email addresses, poor grammar or spelling, and generic greetings that don’t use your name. Additionally, always verify the legitimacy of any requests by contacting the institution directly through official channels rather than relying on the contact information provided in the email.

Utilizing additional security measures, such as enabling two-factor authentication, can further safeguard your accounts. Being cautious and skeptical about unsolicited emails will help you maintain better control over your personal information and enhance your overall online security. Stay informed and proactive in recognizing potential threats to ensure a safer digital experience.

9. Regularly backup your emails

Set up a schedule to regularly back up your emails either using built-in options provided by your secure email provider or using third-party software. Most email services offer automatic backup features that can be configured to run daily, weekly, or monthly. If your provider does not offer this, consider using third-party software like MailStore or Backupify, which can efficiently archive and back up your emails to local or cloud storage.

When setting up your backup schedule, ensure that you also consider the retention period for your backups. It’s a good practice to keep multiple versions of backups for a certain period to safeguard against corruption or unexpected issues. Additionally, routinely check the integrity of your backups by attempting to restore a few emails or folders to confirm that the process is functioning correctly.

Make sure to use secure methods to store your backups, such as encryption or secure cloud storage options, to protect sensitive information. Regularly reviewing and updating your backup plan based on your evolving needs is also recommended, as this helps ensure that you are always well-protected against potential data loss due to accidental deletions or malicious attacks.

Conclusion

Migrating to a secure email service is an important step toward protecting your personal information and enhancing your online security. By following these detailed steps, you can ensure a smooth transition to your new secure email provider, and enjoy greater peace of mind knowing your communications are better protected.

For any issues during migration, don’t hesitate to reach out to the customer support of your new secure email provider. They can provide guidance specific to their service, ensuring a seamless transition.

Conclusion

Switching to a new password manager can be daunting, especially if you have relied on one service for a long time to store your sensitive login credentials. The thought of securely transferring all that data can feel overwhelming. However, by following these essential steps, you can ensure a smooth and secure transition to a new password manager.

What is a password manager?

Creating and remembering unique, strong passwords for online accounts can be challenging, especially with the rise of cyber threats. This is where a password manager proves invaluable.

A password manager is a secure tool that stores usernames, passwords, and payment information in a digital vault protected by a single master password—the only one you need to remember. 

These tools offer encrypted storage to keep your passwords safe from unauthorized access. Even if hackers gain access, they cannot decipher your data without the master password. Additionally, password managers often include features like autofill and auto-login, streamlining account access and providing protection against phishing attacks. They can also generate strong, random passwords, eliminating the risks associated with weak or reused ones.

Using a password manager reduces the burden of memorizing multiple passwords and allows you to use complex, unique passwords for each account. They facilitate secure password sharing and promote diverse password usage, all while simplifying the management of your online accounts.

Choose the right password manager

When selecting a new password manager, consider the following best practices:

1. Do the research

Before switching to a password manager, conducting thorough research is essential to identify one that best suits your individual needs and preferences. Start by exploring different options and comparing their security features. Look for password managers with robust encryption methods, such as AES-256-bit encryption, ensuring your data remains secure. 

Usability is another crucial factor—choose a password manager with an intuitive interface that is easy to navigate. Check if it’s compatible with your devices and browsers and whether it supports autofill for passwords, which can significantly enhance your experience.

Customer support is also crucial. Investigate the level of support offered, whether it’s 24/7 assistance, live chat, or email support. Reading user reviews can provide insights into the reliability of the service and how effectively the company addresses user concerns.

Pricing is also important; look for a password manager that fits your budget while still providing necessary features. Some may offer free versions with essential functions, while others offer premium services with advanced capabilities.

Furthermore, look for attributes such as two-factor authentication (2FA), which adds an extra layer of security by requiring a second form of verification. Zero-knowledge encryption is another critical feature, ensuring that even the company cannot access your data. Lastly, check if the password manager allows you to seamlessly import data from other passwords, making the transition smoother and hassle-free. Evaluating these aspects will help you choose a reliable and effective password manager that fits your needs.

2. Export Your Passwords

The first actual step in making the switch is to export your passwords from your current password manager. This process generally involves navigating to the settings or 'Tools' section of the application. Look for an option labeled 'Export' or something similar; this will often lead you to a choice of file formats for saving your data. Most password managers allow you to export your information as a .csv file, which is a common format that can be opened in spreadsheet applications like Microsoft Excel or Google Sheets.

Important: Before proceeding with the export, ensure that your computer is secure. Double-check that your antivirus software is up to date and that there are no malicious programs running in the background. Remember that .csv files are not encrypted, which means your passwords will be stored in plain text and could be easily accessed if the file falls into the wrong hands. Once you've exported your passwords, it's advisable to delete the .csv file as soon as possible or store it in a highly secure location, such as a vault or an encrypted drive.

3. Backup Your Data

As a precaution, it’s always good to have a backup before making major changes. This backup could be in the form of an encrypted file stored on a secure external drive or another location that only you can access. To ensure the integrity of your backup, consider using reliable backup software that provides encryption options. 

When selecting an external drive, opt for one with a strong reputation for durability and security features, such as hardware-based encryption and password protection. Additionally, it’s wise to regularly update your backup to capture any recent changes or important data. 

You might also want to store copies in multiple locations, such as a cloud storage service that offers end-to-end encryption, to further protect your information from loss or theft. By implementing these practices, you can have peace of mind knowing that your data is secure and recoverable in case of unforeseen issues.

4. Import Your Passwords to the New Manager

Once you have chosen a new password manager and successfully exported your passwords from the previous service, it's time to import the data into your new manager. Most modern password managers provide a straightforward import function to facilitate this process.

Locate the Import Feature: Open your new password manager and navigate the settings menu. Look for an option labeled "Import" or "Import Passwords." This feature is often found under a section dedicated to managing your vault or settings.

Choose the File Format: Ensure that your exported file is in a compatible format. Most password managers accept .csv files, but some may allow others like .json or proprietary formats specific to certain services. If you chose a .csv format, double-check that it follows the guidelines specified by the new manager.

Upload Your Exported File: Follow the prompts to upload your exported file. Be prepared to navigate to the location on your computer where the file is saved.

Map the Fields: Depending on the password manager, you may need to map the fields from your old file to the corresponding fields in the new manager. For example, ensure your username, password, and website fields align correctly. Many applications automatically detect these fields, but it helps to review them.

Review and Confirm: After uploading, the password manager may give you a preview of the data being imported. Take the time to review this information for accuracy. Verify that all entries are correct and complete before finalizing the import process.

Finalize Import: Confirm the import once you are satisfied with the preview. The password manager will process the file and add your passwords to your new vault.

Organize and Secure: After the import is complete, organize your passwords into folders or categories if your new manager allows it. Review your security settings and consider enabling two-factor authentication for added protection.

5. Organize and Audit Your Data

After importing, take the time to organize your passwords into any categories or folders as offered by your new service. This is also the perfect opportunity to update any old or weak passwords. Use your new password manager's password generator to create strong, unique passwords for each account. Some managers also have a security audit feature that can analyze your passwords and suggest changes to enhance security.

6. Update Device and Browser Integrations

Update your browser extensions or mobile apps with your new password manager to ensure that your passwords autofill correctly when you're navigating online. This will typically involve signing into the new service and enabling any necessary permissions so that the password manager can operate effectively across all your devices.

7. Double-Check Everything

Before you say goodbye to your old manager, double-check that all data is transferred correctly and that you can access your accounts through the new manager. It's vital to ensure that no accounts have been left behind or overlooked during the transition.

8. Decommission Your Old Password Manager

Once you're satisfied that the new password manager is functioning properly, it's safe to decommission your old password manager. Log out of all devices, browser extensions, and apps, and go through the proper process to delete your account, assuming you do not plan to return to it.

Conclusion

Migrating to a new password manager doesn’t have to be complex or risky with careful planning and execution. Take your time with each step, ensuring the security of your data throughout the process. Moving to a password manager better suited to your needs can give you enhanced security, convenience, and peace of mind. Enjoy your new level of password organization and the features your new service provides.

Maintaining strong and unique passwords for our online accounts is crucial for security. However, remembering complex passwords for dozens or even hundreds of accounts can be a daunting challenge, even for those with exceptional memories. This is where password managers come in. 

In this article, we will explore what a password manager is and how it enhances your online security, freeing you from the burden of memorizing numerous passwords.

What is a Password Manager?

Creating and remembering unique, strong passwords for our online accounts has become increasingly overwhelming. With the rise of cyber threats and data breaches, it's crucial to ensure that our passwords are memorable and secure. This is where the role of a password manager becomes invaluable. 

A password manager is a sophisticated software tool designed to store and manage online credentials safely and securely. It acts as a digital vault where usernames, passwords, and sometimes payment information are securely stored. A single master key protects access to this vault: your master password, the only password you need to remember.

Password managers have several core features that enhance security and user convenience. One of the primary features is encrypted storage, which ensures that your passwords are stored in a format that's unreadable by anyone else without the master key. This means that even if a hacker accesses the password manager, they won't be able to decipher your stored data without that valuable master password. The master password is the linchpin of this system, significantly reducing the cognitive load on users who might otherwise struggle to remember dozens of different passwords.

Password managers often include features such as autofill and auto-login to streamline the process of accessing online accounts. These functionalities not only save time spent entering credentials but also provide an additional layer of security. By automatically filling in passwords only on genuine websites, password managers help protect against phishing attacks that attempt to capture your login details. Moreover, the ability to generate strong, random passwords for each site elevates your security approach, effectively eliminating the risks associated with weak or repeated passwords.

Among the most compelling arguments for using a password manager are its many benefits. It alleviates the need to memorize every single password, which can lead to simpler, weaker passwords. A password manager allows you to store complex, unique passwords for each account, shielding your information from unauthorized access. Furthermore, these tools facilitate secure password sharing, which can be particularly useful in collaborative environments, and they promote healthy online security practices by encouraging users to adopt diverse passwords. Their user-friendly interfaces simplify the management of numerous online accounts, making the entire process less daunting.

Security is paramount for password managers, and they implement several methods to maintain the integrity of your data. Robust encryption algorithms, such as AES (Advanced Encryption Standard), scramble your data, rendering it indecipherable to unauthorized users. Many reputable password managers operate on a zero-knowledge architecture, meaning that even the service provider cannot access your stored passwords, adding an extra layer of security. Incorporating two-factor authentication (2FA) introduces an additional layer of protection, requiring users to verify their identity through a second method, such as a text message or authenticator app, before gaining access. Moreover, many reputable password managers undergo regular independent security audits to identify and rectify potential vulnerabilities, ensuring they remain resilient against emerging threats.

Setting up a password manager is typically straightforward. It involves selecting a reputable password manager, creating a memorable master password, and importing your existing passwords. Most password managers offer features for organizing and categorizing passwords for easy access and browser extensions and mobile apps for convenience. Additionally, many of them include a security audit feature that helps users identify weak or reused passwords, further strengthening their online security posture and encouraging good password practices.

How Does a Password Manager Work?

There are a lot of components to password managers, including the following:

1. Encrypted Storage

Password managers encrypt your password data with sophisticated algorithms like AES (Advanced Encryption Standard). When you enter a password into your manager, it is encrypted and stored in the password database. This encrypted database is only decryptable with your master password – known only to you – which acts as the key.

2. Master Password

The master password is the linchpin of your password manager's smanager'sIt encrypts and decrypts your password database. The strength and secrecy of your master password are vital. Not even the password managers should know this critical information.

3. Autofill and Auto-login

Most password managers feature autofill and auto-login capabilities to ease the login process. They can automatically recognize the website or service you are attempting to access and fill in the corresponding username and password. This feature relies on secure connections and careful verification to ensure passwords are only filled in when genuine requests are made.

4. Password Generation

Many password managers offer built-in password generators. These create strong, random passwords that provide greater security than manually created passwords. Every time you sign up for a new service or update an existing password, the password generator can be used to ensure your password's passwords uniqueness.

5. Cross-Platform Synchronization

Most modern password managers can synchronize your passwords across multiple devices. They often offer web, desktop, and mobile applications that can sync with your password vault, allowing for secure access to your passwords whether you’re on your computer, tablet, or smartphone.

Why Use a Password Manager?

There are numerous benefits to using a password manager. 

Password managers are often overlooked, yet they play a critical role in protecting our online lives. Their importance lies in their ability to enhance security and convenience—an essential balance many of us struggle to maintain daily. With the increasing number of online accounts an average person manages, from banking and shopping to social media and professional networks, using a unique and strong password for each account becomes an essential yet challenging task. This is where password managers become invaluable.

Password managers do more than store passwords; they cultivate an environment where your online security is strengthened without sacrificing ease of access. At their core, a password manager acts as a secure vault, keeping your login credentials safe under the protection of one master password. This dramatically simplifies remembering passwords—users only need to place a single, strong password instead of multiple complex ones. Moreover, these tools generate strong, unique passwords for each account, significantly reducing the risk of unauthorized access.

The threat of cyberattacks is ever-present, and cybercriminals' tactics are becoming increasingly sophisticated. Phishing schemes, where unsuspecting users are tricked into divulging their login information, are widespread. Password managers serve as a safeguard in this regard, as their ability to auto-fill passwords on recognized sites reduces the chances of entering your credentials on a fraudulent site designed to steal your information. Many password managers also alert users to reused or potentially compromised passwords, prompting them to make necessary changes to keep their accounts secure.

From a convenience standpoint, password managers ease the frustration of being locked out of accounts due to forgotten passwords. The time saved by not resetting passwords or contacting support teams is invaluable. For businesses, this efficiency can lead to significant cost savings and enhanced security. Sharing passwords when necessary is safer and more straightforward with a password manager. Authorized users can access shared accounts without revealing the passwords, which minimizes the risk of credential leaks or misuse.

The technical foundation of password managers is built on robust encryption technologies. Most employ strong encryption methods, ensuring that it remains unreadable even if data is intercepted. Adding two-factor authentication provides another layer of security, requiring a second form of verification before granting access. It's important to note that the best password managers operate a zero-knowledge protocol, meaning that only you can access your master password and stored data—not even the password manager’s team can access your vault.

Implementing a password manager is straightforward and requires minimal effort for its substantial benefits. The step involves selecting a reputable provider and setting up a master password, a process guided by recommendations to ensure its security. Importing existing passwords and setting up new accounts is typically intuitive, with most services offering detailed guides and customer support.

Conclusion

In conclusion, password managers are more than just convenient tools; they are essential for modern online security. As our online presence grows, so does the risk to our digital identities. Individuals and businesses can significantly improve their security with minimal effort by using a password manager. If you haven’t done so already, incorporating a password manager into your digital routine is a wise and forward-thinking decision. It helps maintain vital password hygiene and protects your online security from threats. Utilizing a password manager simplifies your online activities and strengthens your defenses against the ever-evolving landscape of cyber threats.

In the digital age, much of our lives are conducted online. From social media accounts to banking applications, each digital service requires a password, making it difficult to remember them all. This is why a password manager is essential. However, with so many options available, selecting the right one can feel overwhelming. This article will guide you through the process, ensuring your digital life remains secure and convenient.

How to choose the perfect password manager for you

The first step in choosing a password manager is understanding your specific needs. Consider the following questions:

Number of Devices: How many devices do you need to sync your passwords across?

Platform Compatibility: Which operating systems and browsers do you use?

Features: Are you looking for features beyond password management, such as secure note storage or password sharing capabilities?

Budget: Are you willing to pay for a password manager, or are you looking for a free alternative?

When it comes to security, not all password managers are created equal. Here are essential security features to consider:

Encryption: Opt for a password manager that offers end-to-end encryption, ensuring your data is encrypted before it leaves your device.

Two-Factor Authentication (2FA): This adds an extra layer of security, requiring a second form of verification beyond your master password.

Zero-Knowledge Policy: This ensures that the password manager company doesn’t store or have access to your passwords.

Security Audits: Look for a password manager that undergoes regular, independent security audits.

A good user experience is crucial for a password manager, as you’ll interact with it daily. Consider these factors:

Ease of Use: The interface should be intuitive, making it easy to store, retrieve, and generate passwords.

Browser Integration: Look for seamless browser integration that automatically fills in your passwords.

Mobile App: A user-friendly mobile app is crucial for accessing your passwords on the go.

What to look for

When selecting a password manager, several crucial features should be considered to ensure maximum security and ease of use. Let's explore the key features that define a top-tier password manager.

End-to-End Encryption

Encryption is at the heart of a password manager's security. End-to-end encryption means that your data is encrypted on your device before it's transmitted to any server. Ideally, a password manager should use industry-standard encryption, such as AES-256, to protect your sensitive data.

Zero-Knowledge Architecture

This security feature ensures that the service provider cannot access your stored data. A zero-knowledge protocol means the service encrypts and decrypts data locally on your device, and even the pass manager’s developers cannot access your passwords and information.

Two-factor authentication (2FA)

Adding a layer of security, 2FA requires you to provide two different authentication factors to verify yourself. This could be a combination of something you know (your password), something you have (a mobile device), or something you are (biometric data). A password manager with 2FA support dramatically decreases the likelihood of unauthorized access.

Password Generation

One of the most practical features of a password manager is the ability to generate complex, high-strength passwords. Look for a password manager that can create long, randomized passwords that are tough to crack, diminishing the risk of password-related security breaches.

Auto-Fill and Auto-Login

A password manager should integrate with your web browsers and apps to streamline your online experience. Auto-fill and auto-login features allow the software to automatically populate login fields with your username and password, saving you time and avoiding typos that can occur with manual entry.

Cross-Platform Compatibility

In our multi-device world, having a password manager that syncs across all your platforms is essential. Cross-platform compatibility ensures you can access your passwords anytime, anywhere, whether you switch from a PC to a smartphone or from Windows to macOS.

Secure Sharing

Sometimes, you need to share a password securely with a family member or colleague. A password manager with a secure sharing feature allows you to do this without exposing your password in plain text via messaging or email. Look for a manager that lets you share access through the manager itself.

Password Audit and Security Alerts

Top-notch password managers often include a security dashboard that analyzes your passwords for strength and security. The dashboard can alert you to weak, reused, or compromised passwords and prompt you to change them.

User-Friendly Interface

A robust array of features is valuable only if the password manager is user-friendly. The software should be intuitive so you can manage your passwords without any confusion or frustration.

Backup and Recovery Options

Your password manager should offer an efficient way to recover your data in the event of device loss or data corruption. Check for options like secure cloud or local backups to ensure you can always retrieve your passwords.

Customer Support

Reliable customer support is vital, especially if you encounter issues or have questions about your password manager. A responsible provider should offer comprehensive support through multiple channels, such as email, chat, or a knowledge base.

Why you need a password manager

Memorizing dozens of complex passwords is neither feasible nor secure, often leading to weak password practices that put us at risk. On the other hand, password managers offer convenience and a robust solution for securing our digital lives. Let's explore why a password manager is no longer an option but a necessity.

The primary appeal of a password manager is its ability to simplify your online experience. Password managers securely store and organize your passwords in an encrypted vault, ensuring that even the provider cannot access your login information. You only need to remember one strong master password to access your login details.

Humans prioritize memorability over complexity, leading to the widespread use of weak passwords. A password manager eliminates this problem by generating unique passwords for each account. This significantly reduces the risk of account breaches, as the others remain secure even if one password is compromised.

One of the most common security lapses is reusing passwords across multiple accounts. If a hacker gains access to one account, all accounts that share the same password become compromised. A password manager creates a unique, strong password for each account, ensuring that a breach in one does not lead to a cascade of unauthorized access.

Most people tend to avoid changing passwords regularly. However, periodic changes are crucial for security. A password manager can often automate this task, ensuring your passwords are routinely updated without your intervention, thus keeping your digital fortress secure.

There are times when sharing passwords becomes necessary. Unfortunately, sharing passwords via text messages or emails is inherently insecure. Password managers offer secure sharing features that allow you to share access without the recipient seeing the actual password, and you can easily revoke that access when needed.

In our multi-device world, digital access points are not limited to one computer or phone. Password managers sync across devices, ensuring you have access to your passwords whether you're using your laptop at a café or your phone while on the go.

Granting someone access to critical accounts can be essential in extraordinary situations. Many password managers provide an emergency access feature that allows trusted individuals to access your account under predefined circumstances, ensuring continuity without compromising security until then.

Password managers encourage better overall security practices by facilitating unique, complex passwords for each account and securely storing them. They remove the guesswork from digital security and make maintaining a secure online presence more accessible.

Types of password managers

Not all password managers are created equal. They come in different forms, each with unique features and storage methods. Understanding these differences is crucial in selecting the right password manager for your security needs and lifestyle. 

1. Cloud-Based Password Managers

Cloud-based password managers are the most popular type. They store your passwords on the provider's servers, allowing easy access from any device with an internet connection. This type of password manager offers convenience, as you can synchronize your passwords across all your devices and platforms. Examples include LastPass, 1Password, and Dashlane. They often have additional features like two-factor authentication, secure password sharing, and emergency access.

2. Local Password Managers

Local password managers store your passwords on your device rather than on an external server. This type offers heightened security, as your passwords are not exposed to potential breaches on cloud servers. KeePass is a notable example of a local password manager. They particularly appeal to those who prefer complete control over their data's storage location.

3. Browser-Based Password Managers

Most modern web browsers have built-in password managers, including Chrome, Firefox, and Safari. These tools automatically offer to save your passwords whenever you log into a new site. While they provide a basic convenience for managing passwords, their security features may not be as robust as dedicated password managers.

4. Desktop Password Managers

Desktop password managers are installed as a software application on your computer. They store the password database locally but can also offer cloud synchronization options. Examples include RoboForm and specific KeePass configurations. These managers blend the security of local storage with the optional convenience of cloud backups.

5. Mobile Password Managers

Designed specifically for mobile devices, these apps offer password management capabilities tailored to the needs of smartphone and tablet users. They provide convenient access to your passwords on the go and often include features like biometric login (fingerprint or facial recognition) for added security. Examples include Bitwarden and the mobile versions of 1Password and LastPass.

Conclusion

Choosing the right password manager depends on your priorities: convenience, security, or a balance of both. Cloud-based and browser-based managers offer simplicity and accessibility, while local and desktop options prioritize security. Mobile password managers cater to those constantly on the move. Regardless of your type, integrating a password manager into your digital routine is critical to safeguarding your online identity and information. Remember, the best password manager you regularly use fits seamlessly into your digital life.

• Here's our list of the best identity management services right now

Bitwarden has sought to calm user backlash in the wake of source code changes that had raised concerns among users.

Phoronix readers recently flagged concerns about the company's apparent shift away from an open source model. The password manager platform has traditionally operated on a ‘freemium’ model, providing some code as open source.

But a pull request earlier in October 2024 raised eyebrows due to the fact the Bitwarden client introduced a “bitwarden/sdk-internal” dependence to the desktop client.

Bitwarden changes

The firm’s license statement noted: “You may not use this SDK to develop applications for use with software other than Bitwarden (including non-compatible implementations of Bitwarden) or to develop another SDK.”

This statement in particular prompted speculation that the move could mean the Bitwarden client would no longer be freely available to users, with a GitHub issue further fueling speculation over the rumored move.

It looks like this is part of a deliberate campaign by Bitwarden to fully transition Bitwarden to proprietary software, despite consistently advertising it as open source, without informing customers about this change,” one user wrote.

“For wherever the opinion of one user is worth, I’ve switched away from Bitwarden due to this.”

While initial concerns were raised, Bitwarden has since clarified the issue. In a comment on GitHub, Bitwarden founder and CTO Kyle Spearrin sought to calm user concerns, commenting this was the result of a ‘packaging bug’.

Spearrin confirmed that Bitwarden has “made some adjustments” to how the SDK code is organized and packaged. This will allow users to continue building and running the app with only GPL/OSI licenses included, Spearrin added.

“The sdk-internal package references in the clients now come from a new sdk-internal repository, which follows the licensing model we have historically used for all of our clients,” he said.

“The sdk-internal reference only uses GPL licenses at this time. If the reference were to include Bitwarden License code in the future, we will provide a way to produce multiple build variants of the client, similar to what we do with web vault client builds,” Spearrin added.

Following the move, the original sdk repository will be renamed to ‘sdk-secrets’, Spearrin revealed. This will retain its existing Bitwarden SDK License structure for the platform’s secrets manager business products.

“The sdk-secrets repository and packages will no longer be referenced from the client apps, since that code is not used there."

Open source licensing concerns continue

While Spearrin and Bitwarden have since clarified the changes, user concerns over a potential shift away from open source licensing aren’t without justification.

A host of open source solutions providers in recent years have made shock moves away from open licensing to more restrictive terms of use, such as MongoDB.

In 2023, HashiCorp sparked criticism from some industry stakeholders after it changed its source code license to the Business Source License (BSL).

More recently, Redis again prompted criticism when it revealed future Redis releases were to be made available under RSALv2 (Redis Source Available License) and SSPLv1 (Server Side Public License) licenses.

More from TechRadar Pro

• We've rounded up the best open source software around
• How open source communities work
• Mark Zuckerberg claims open-source is 'necessary for a positive AI future'

Some of the best password managers have teamed up with the FIDO Alliance to set new standards for secure passkey storage, even when switching between providers.

The new draft set of specifications were published by the Alliance’s Credential Provider Special Interest Group, which included major names in the password and identity management game, including 1Password, Apple, Bitwarden, Dashlane, Enpass, Google, Microsoft, NordPass, Okta, Samsung and SK Telecom.

Passkeys are a more secure and phishing resistant alternative to passwords, and are widely expected to replace passwords altogether in the near future.

Enhancing security, choice, and competition

Passkeys remove the need to type in a password, and instead use an authenticator app on a dedicated device, such as your phone, to check that the person attempting to log in is actually you, usually through some form of biometrics.

According to statistics presented by the FIDO Alliance, passkey adoption has been widely successful with 12 billion online accounts currently taking advantage of passkeys to log in. Moreover, passkeys significantly reduce the risk of phishing and improve log in speeds by 75%.

The new specifications hope to ensure users have a free choice of providers and are free to transfer their passkeys and passwords between their choice of service. This is the first standard of its kind to be introduced to the credential management industry. The draft specifications can be viewed on the FIDO Alliance blog.

Currently, the specifications are in a community review and feedback phase with regular updates to be published publicly for review until the final specifications are approved and implemented.

More from TechRadar Pro

• Take a look at the best free password managers
• Bitdefender's new tool should help to protect your digital life from scams and fraud
• These are the best password generators

Proton Pass, one of our picks for the best password manager around right now, has launched a new family tier to simplify credential management and storage for parents and children alike.

The Pass Family plan is being offered for a limited time at $3.99 per month (billed annually), and includes all of the features of the Pass Plus plan, but for six users instead of one.

Families will be able to benefit from integrated two-factor authentication (2FA), secure vault and link sharing, dark web monitoring and advanced account protection, all managed from an admin panel.

Family password protection

The new Proton Pass family tier makes sharing credentials for streaming services and household accounts easier and more secure, while also providing vaults for storing personal information such as emergency contact information that can be shared with other users. Each user account is segmented by a unique email address to mitigate data breaches and identity theft.

Password sharing has quickly gone from a big security no to a fact of life, especially within families. Statistics show that 43% of Americans share at least one password with someone else, emphasizing the need for secure password sharing tools.

"Password sharing among family members is common, but it also exposes them to significant cybersecurity risks," said Son Nguyen Kim, Product Lead for Proton Pass. "The Pass Family plan offers a safer, more organized way for families to manage their online identities, combining Proton's high standards of privacy and security with user-friendly features that everyone can use."

More from TechRadar Pro

• These are the best free password managers
• Identities and biometric authentication for Proton Pass have arrived
• Take a look at our guide to the best firewalls

The evolving and sophisticated nature of phishing campaigns has allowed cybersecurity threats via email to penetrate organizations more effectively than ever before. Credential phishing was the threat of choice in 2023, accounting for 91% of active threat reports published. This represented a 67% increase in volume compared to 2022, which can be attributed to the increased effectiveness of cyberattacks that exploit stolen credentials, particularly in environments lacking robust Multi-Factor Authentication (MFA).

An example of this is the Change Healthcare cyberattack, where stolen credentials were used to access a server that lacked MFA. This absence was attributed to the company’s recent acquisition by UnitedHealth, which was in the process of upgrading the systems. This breach exposed the sensitive health data of millions of Americans, underscoring the critical need for basic cyber hygiene, including robust password management and MFA.

Going Beyond MFA and Unique Passwords

While implementing these fundamental security measures is essential, they are only one part of a comprehensive security strategy. Relying solely on complex passwords is insufficient. Passwords must not be reused, as the compromise of a single password on one platform can leave an individual vulnerable to threat actors who frequently attempt to reuse the same credentials on other accounts. 

The recent RockYou2024 incident leaked nearly ten billion unique passwords on a popular hacking forum, reiterating this critical need for unique passwords. Security experts have long emphasized the need to avoid password reuse and to leverage password managers to enhance account protection. Some password management even offers advanced features that can scan leaked password databases and alert users to potential vulnerabilities.

While the implementation of MFA is important to stand as a layer of defense against threat actors, it is not infallible, and should be seen as a security practice complemented by additional defenses. The emergence of MFA bypass kits has demonstrated that these security measures can be circumvented. One recent example of this is the Tycoon 2FA bypass phishing kits. When individuals fall victim to these sophisticated attacks, they inadvertently grant threat actors access to their accounts, effectively bypassing MFA protections. 

This underscores the critical role of human vigilance in safeguarding against these evolving threats. Essentially, these phishing kits have reset the phishing arms race to where we were before the advent of MFA, where the primary defense against account compromise lies in the ability of individuals to recognize and avoid phishing attempts.

The Need for Human Vigilance

Threat actors are continuously looking for new ways to breach systems. Attackers take advantage of weak links in organizations, targeting employees with password expiration scams, and phishing emails that are becoming increasingly realistic. To effectively combat this growing threat, organizations must adopt a comprehensive proactive approach that extends beyond technical measures. Investing in security awareness training and education is crucial to empowering the workforce to become the first line of defense against cyberattacks.

Training employees across a company is one of the most substantial actions an organization can take to defend itself against threat actors, particularly in educating staff about the dangers of phishing emails from seemingly credible sources. This includes urgent requests for personal information or suspicious links and attachments.

Basic cyber literacy is becoming more common, but truly instilling a sense of suspicion when it comes to online interactions and activities takes time and serious investment on a company’s part. By equipping employees with the knowledge and skills to recognize and report phishing attempts, organizations can significantly reduce the risk of successful attacks. The reality is that a single employee falling victim to a phishing attack can have catastrophic consequences for the entire organization, with the potential for significant data breaches, financial losses, and reputational damage.

Organizations should establish a straightforward reporting mechanism and equip employees with the necessary tools to swiftly eliminate phishing threats. Training employees to spot malicious messages can significantly reduce the risk of falling victim to these scams and compromising sensitive data. Providing ongoing training and resources, along with encouraging open communication about potential threats, fosters a positive culture of cybersecurity awareness. Employees should feel comfortable reporting suspicious activities without fear of retribution, understanding that their vigilance contributes to the organization's security.

By investing in both technical and human-driven solutions, organizations can create a more resilient defense system capable of withstanding sophisticated cyberattacks. This comprehensive approach not only enhances immediate security but also builds a foundation for long-term protection against evolving threats.

We list the best business password managers.

This article was produced as part of TechRadarPro's Expert Insights channel where we feature the best and brightest minds in the technology industry today. The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/news/submit-your-story-to-techradar-pro

The consequences of a cyber-attack can be devastating, resulting in the loss of data, system downtime, and the erosion of consumer trust in cases where personal identifiable information has been compromised. Furthermore, the costs associated with recovering from a data breach can be financially crippling, with an estimated average cost of a breach reaching a staggering $4.45 million, according to IBM's Cost of a Data Breach 2023 report.

It is imperative for businesses of all sizes to adopt a multi-faceted approach in order to build their defenses and stay one step ahead of the evolving cyber threats. Below is a round-up of top 10 best cybersecurity practices of 2024.

1. Enforce the use of strong credentials & MFA

Roughly 80% of data breaches are due to poor password security. As such, it is crucially important to use strong, unique passwords that are long and complex, featuring letters, numbers, and special characters. Consider promoting the use of password managers to help employees securely store their passwords. You should also consider implementing multifactor authentication, which requires the user to input a special code after the correct password. MFA codes can be generated via automated text messages, authentication apps, or biometrics like face ID or a fingerprint scanner.

2. Carry out cybersecurity training

Cybersecurity awareness training is a crucial as it empowers employees to recognize and mitigate potential threats. A comprehensive cybersecurity training program should cover the fundamentals of cybersecurity, including information security and governance, threat and vulnerability assessment, and risk management. It should also educate employees on the importance of security controls, such as firewalls and antivirus software, as well as the relevance of cybersecurity frameworks. Additionally, understanding the consequences of non-compliance is vital in preventing cyber-attacks. By imparting this knowledge, employees can develop a sense of cybersecurity awareness, enabling them to make informed decisions and take proactive measures to protect the organization's digital assets.

3. Ensure that all software is regularly updated

The spread of the WannaCry ransomware attack in May 2017 was largely caused by organizations that had not updated their systems with the necessary security fixes. Many organizations were found to be using outdated Windows systems that had reached their end-of-life, highlighting the importance of regularly updating software and systems to ensure that any vulnerabilities are addressed in a timely manner.

4. Back up your most valuable data

Secure and reliable data backups are essential for organizations to maintain business continuity, minimize data loss, and protect their reputation. Regular backups prevent the loss of critical information due to hardware malfunctions, software errors, or human errors, and ensure that organizations can quickly recover from system crashes, ransomware attacks, or natural disasters. Additionally, proactive data backups save time and money in the long run by reducing the need for costly recovery efforts and minimizing financial losses.

5. Implement a Zero-Trust security model

The Zero Trust security model is a holistic approach to network security that rejects the traditional "castle-and-moat" approach, where anyone and anything inside the network is trusted by default. In contrast, Zero Trust requires strict identity verification for every person and device trying to access resources on the network, regardless of their location inside or outside the network. This means that no one is trusted by default, and verification is required from everyone trying to gain access.

6. Establish a Virtual Private Network (VPN) for remote workers

As remote work has become more prevalent, the importance of using a VPN (Virtual Private Network) has become increasingly clear. When working remotely, especially on public or unsecured networks, the risk of unauthorized access and data breaches is high. A business VPN ensures secure remote access to company networks, servers, and databases, allowing employees to access necessary resources while working remotely. Additionally, a VPN enables companies to grant access to specific resources, restricting access to sensitive areas. A VPN also facilitates secure collaboration and file sharing among remote teams, ensuring that sensitive documents are transmitted through an encrypted tunnel.

7. Pay more attention to API security

APIs are vulnerable to weaknesses in backend systems, malicious requests, and denial of service attacks, and can be used to scrape data or exceed usage limits. As APIs are used extensively in modern applications, particularly in microservices and serverless architectures, API security is essential to prevent these types of attacks. Unlike traditional security, API security requires the protection of multiple API endpoints with different protocols, and the ability to adapt to frequent changes in API requests. Additionally, API security solutions must be able to detect malicious traffic from non-browser clients, such as native and mobile applications, and exclude automated traffic from API endpoints.

8. Install An Intrusion Detection & Prevention System

Just as an airport's baggage and security check system ensures that only authorized individuals can enter and proceed with their travel plans, an intrusion detection and prevention system (IDPS) plays a crucial role in protecting networks and systems from unauthorized activity. By requiring a "ticket" or authentication, the IDPS controls access to the network, much like a boarding pass grants access to a flight. Once inside, the IDPS conducts rigorous security checks to prevent malicious traffic and policy violations from proceeding. What sets IDPS apart from an intrusion detection system (IDS) is its ability to not only detect and alert unwanted traffic, but also take proactive measures to prevent potential incidents.

9. Keep a close eye on third-party vendors

Third-party vendors, contractors, and partners play a crucial role in an organization's operations, but they can also pose significant security risks if not properly managed. Poor cybersecurity practices have become a major contributing factor to supply chain disruptions, making it essential for organizations to prioritize the risk management of these third-party entities. 

The 2020 SolarWinds breach serves as a prime example of the devastating consequences of inadequate supply chain management. In this attack, nation-state hackers used a seemingly innocuous software update to deliver malware to over 30,000 organizations, compromising lots of systems, networks, and data. The magnitude of this breach highlights the urgent need for organizations to vigilantly monitor and manage the security risks associated with third-party relationships.

10. Adopt a real-time threat monitoring solution

A cutting-edge real-time threat monitoring solution provides a comprehensive approach to data security by consolidating data visibility, access control, threat detection, and classification into a single platform. This streamlined approach enables organizations to proactively prevent data breaches and security threats through automated, real-time threat detection and sophisticated user behavior analytics, as well as seamless threat response workflows. Additionally, the most advanced real-time threat monitoring solutions offer hundreds of pre-configured compliance reports, ensuring that data security strategies align with numerous compliance mandates, including GDPR, HIPAA, SOX, and more.

By adopting these cybersecurity best practices, businesses can effectively safeguard their sensitive data and IT infrastructure, minimizing the risk of data breaches and other security incidents.

We list the best identity management software.

This article was produced as part of TechRadarPro's Expert Insights channel where we feature the best and brightest minds in the technology industry today. The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/news/submit-your-story-to-techradar-pro

Nearly every modern business utilizes SaaS applications to enhance employee efficiency and productivity. With our workplaces becoming more interconnected, applications like Zoom and Google Workspace streamline workflows and facilitate seamless collaboration with employees and partners worldwide. These benefits have fueled SaaS growth. According to a report from DevSquad, the U.S. SaaS market is predicted to reach $225 billion by the end of 2025 — a 100% increase since 2020.

This SaaS explosion has created unnecessary complexity and risk as organizations grapple with securing users and data across hundreds, sometimes thousands, of applications. Improper management of SaaS identities could leave organizations vulnerable to critical security incidents. On average, businesses have four times as many identities as they know about, which creates opportunities for malicious actors to wreak havoc — and the risk doesn’t end after an employee leaves.

To combat these challenges, IT teams need to create and implement robust identity hygiene strategies, including proper offboarding protocols and access management auditing. A sound strategy can shield businesses from unauthorized access to sensitive data, credential leaks, and devastating data breaches and offer better visibility and management of access. But what should IT teams consider when creating and implementing a plan to manage SaaS apps?

Poor identity hygiene leads to SaaS security risks

Identity hygiene encompasses the measures taken by organizations to consistently uphold the security of data, infrastructure, and applications. The goal is to secure authorized access to vital information, effectively blocking any potential malicious breaches.

Unfortunately, it’s nearly impossible for enterprises to manually keep track of every app used within the organization, given the average management load of around 400 SaaS applications. In modern environments, strong identity hygiene practices often require automated tools to provide the necessary visibility into and control over applications and their associated identities. Left unchecked, these blind spots can become easy targets for hackers to infiltrate systems.

The recent ChatGPT breach is a good example. In this incident, more than 250,000 credentials were compromised and listed on the dark web, potentially granting unauthorized access to systems. If an employee installed and registered for ChatGPT without informing IT, it could lead to unauthorized access and potentially compromised or stolen sensitive data. This underscores the critical need to maintain proper identity hygiene to protect organizations.

Tips to implement proper identity hygiene practices

For an effective identity hygiene strategy, there are a few elements that should be considered to be most effective:

Ensure real-time visibility: Confirm that IT and security teams have visibility into the current SaaS apps in use, which individuals require access to specific data within an organization, and who currently holds such access. This offers more control over a company’s cyber risk profile and enables them to be proactive in their security strategies.

Create a standardized process: Establishing a standardized identity hygiene protocol throughout the organization is effective in ensuring uniformity among employees regarding the management of their SaaS applications and identities. Incorporating practices like using password managers, adhering to a consistent device update schedule, and promptly reporting newly downloaded SaaS applications to the IT team are some ways to standardize the process for all employees to minimize risk.

Leverage automated tools to manage SaaS apps: The volume of SaaS applications managed by organizations is vast, making manual management impractical for IT and security teams. Implementing automated tools can streamline this process and offer the necessary visibility without overwhelming teams. It can serve as a valuable asset in safeguarding organizations against critical security incidents.

Why companies need a proper offboarding process

The security risk posed by SaaS doesn’t cease when an employee leaves an organization — ex-employees’ credentials might retain access to SaaS apps and data. That’s why it is crucial for security and IT teams to complete proper offboarding procedures and regular access management audits. Not having these steps as part of an identity hygiene strategy not only poses a security risk but has wide-ranging implications for regulatory compliance requirements.

For example, a healthcare professional could have access to Practice Fusion, an electronic health record SaaS app, while working at a practice. Once they leave, if the employee isn’t properly offboarded, they could potentially still have access to that account and the medical information within it, which is a HIPAA violation. It could also leave an opportunity for a hacker to use the vacant account as an entry point if left unchecked after the employee departs. Both scenarios could have devastating consequences, such as data theft and monetary damage. Automating the offboarding process is the most effective way to ensure that teams stay up to date on access and that there are no unknown unauthorized access points.

The modern workplace presents security challenges, as the tools we use are increasingly connected. SaaS applications present a risk that should be a top priority for security teams to address. Tackling the complexity of modern SaaS environments requires a robust identity hygiene strategy that incorporates real-time visibility, standardized processes, and automated tools. Strong identity management is essential to ensuring your organization remains both productive and secure.

We've featured the best online cybersecurity course.

This article was produced as part of TechRadarPro's Expert Insights channel where we feature the best and brightest minds in the technology industry today. The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here:  https://www.techradar.com/news/submit-your-story-to-techradar-pro

OpenAI’s release of ChatGPT seems like yesterday, but so much has happened since its debut that it’s hard to remember a time before this advanced AI chatbot entered the public consciousness. During its first year, ChatGPT raised as many questions about generative AI as it answered. Two of the biggest issues are security risks and the notion that the use and development of generative AI use can be controlled or regulated.

Security Risks

Take the known security risks. ChatGPT often generates incorrect yet believable information that can lead to dangerous consequences when its advice is blindly followed. Cybercriminals use it to improve and scale up their attacks. Many believe that the greatest risk is its further development, or rather the next-generation of generative AI.

With all of generative AI’s advancements over the past year, the security risks are becoming more complex. This is evident when you consider both its plausibility and its perniciousness.

As skeptical and aware people, we are good at recognizing when something feels off. ChatGPT can make it feel on. Generative AI solutions are designed to generate responses that sound and look extremely plausible, but they don’t have to be accurate. They are trained on internet data, and as we know, one shouldn’t believe everything one reads online. Experts can identify the obviously-wrong answers, but non-experts won’t know the difference. In this regard, generative AI can be weaponized to overwhelm the world with false information. This is a fundamental issue with any generative AI solution.

More issues stem from the criminal use of these tools. For example, cybercriminals are using ChatGPT to generate very realistic phishing emails and URLs for spoofed websites. We have trained ourselves to spot phishing emails and detect subtleties that raise the red flag when something is off, like the email from a far-away prince asking for money. Now, however, that email may appear to come from your family, friend or colleague. ChatGPT and other generative AI solutions can create emails and URLs for phishing purposes that look and feel plausible, and cybercriminals are taking advantage of this highly pernicious capability.

What’s more, generative AI solutions can generate variants very quickly (without costs) to circumvent spam detectors. By weaponizing generative AI in this manner, malicious actors can rapidly scale up their attacks.

Generative AI will likely give password cracking attackers a leg up. Academics are just beginning to study the impacts of generative AI on password cracking, but it’s very likely that bad actors are doing so as well. Initial studies use inputs like previously leaked password databases to generate typical passwords and mimic the patterns that humans use when crafting their own passwords. 

However, future AI-enhanced tools might be based on more context: who the target is, where they live, what languages they speak, their interests or pop-cultural influences. This context might ramp up effectiveness. If the attacker is allowed to submit an unlimited number of guesses, then it doesn’t matter if the AI is wrong 10,000 times–the AI only has to guess correctly once. This will rapidly increase account compromise for those who do not use strong, unique and random passwords, such as by using one of the best password generators, or best password managers, to protect their accounts.

Privacy implications

The sharing of sensitive data is another security risk associated with generative AI tools. ChatGPT is available to anyone and everyone– even those with no understanding of cybersecurity or best practices. Users reveal information they think is kept private, but they don’t realize that all of their details are stored in a database and used to train future iterations of AI.

Even if the company that produces the generative AI solution is not leveraging user data for training, they may be recording it for quality control. That creates yet another copy of sensitive data susceptible to attack if an attacker should gain access to these transcripts. Cybercriminals sell sensitive information like this on the dark web or use the information to target their victims.

Why AI won’t comply

Despite the risks of generative AI, since ChatGPT’s debut it’s been a race to innovate, with the biggest names in tech in the running.

After OpenAI released GPT-4 in March 2023, the Future of Life Institute circulated a petition calling for a six-month moratorium on large scale experiments with AI. The moratorium would give AI labs and independent experts the time to develop safety protocols for advanced AI design that makes AI systems more accurate, safer, interpretable and trustworthy.

Is it possible to legislate the use and development of generative AI? No. Will the industry collaborate enough to create guardrails that can be universally followed? Possibly.

Generative AI has made regulating, censoring and legislating technology more complex than ever. Jurisdictions make moratoriums on research ineffective and even exacerbate problems. For example, imagine what would happen if the U.S. mandated a temporary pause on generative AI research. Researchers outside the U.S. do not have to comply. Instead of protecting against the presumed dangerous pace of AI innovation, the moratorium would create unfair Research and Development (R&D) advantages for the nations and researchers outside U.S. jurisdiction.

Any powerful technology can be wielded for good or evil. ChatGPT and its counterparts are no different. If it’s powerful, it also has a dark side. But should this lead to restricting further R&D? No. In fact, such thinking only restricts the very research that’s needed to counter the effects of dark side development and deployments. Suppose a jurisdiction temporarily bans research on the Large Language Models (LLMs) on which ChatGPT is built. Clever researchers could simply adjust their naming and report they are not researching LLMs but instead working on Medium Lift Neural Network Weighted Modules, which are not currently regulated. Beyond that, any moratorium disproportionately favors those using AI for nefarious purposes. Remember that criminals don’t follow congressional regulations.

Summary

More than one year in, ChatGPT is a reminder that change is the only constant in our universe. Even as the world grapples with these questions around security risks and the rapid pace of innovation, we know that another mind-boggling and ethically challenging advancement is likely around the corner.

We've listed the best cloud antivirus.

This article was produced as part of TechRadarPro's Expert Insights channel where we feature the best and brightest minds in the technology industry today. The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/news/submit-your-story-to-techradar-pro

No-one really wants to make a New Year's resolution, so this year we recommend committing to a tech resolution instead. These friendlier commitments aren't about self-improvement, giving up indulgences or hitting gyms – instead, they're little projects to help fortify you against the looming threat of January. And best of all, they all involve tech.

We polled the TechRadar team and our many contributors to find out what tech resolutions they'll be making for 2024 – and the results are below. The ideas vary wildly, from an in-depth plan to get back into Blu-rays to another writer's vow to restore their family's old photos using Photoshop.

For every laudable commitment to rediscovering comics on tablets or becoming a board games super-nerd, there are more sensible resolutions too – including one writer's explanation of how they're finally sorting out their passwords nightmare, plus another's plan to save money in 2024 with some nifty Chrome extensions.

Whichever part of your tech life needs some attention or a shot of new year's enthusiasm, you'll find some valuable advice and ideas on how to fix it below. And if it all goes wrong, you can always blame the gadgets...

1. 2024 is the year I feed my OLED TV with 4K Blu-rays, and you should too

Yes, the best streaming services are convenient, user-friendly and offer impressive image quality at times. But they still have notable weaknesses – and we're not just talking about movies vanishing from catalogues or downloads disappearing from your account. 

Read about why TechRadar's Matt Bolton (Managing Editor, Entertainment) has decided to bring 4K Blu-Rays back into his life in 2024 – and why you should consider doing the same, particularly given how easy it is to find second-hand bargains.

• Read the full story: 2024 is the year I feed my OLED TV with 4K Blu-rays, and you should too

2. I’ve had enough of password frustrations – here’s how I’m finally fixing them in 2024

Passwords aren't fun – in fact, they're now positively infuriating if you don't have them under control. 

TechRadar contributor Darren Allen has finally snapped and made a grand plan to tame them in 2024. You can benefit from his wisdom and research in this round-up, covering everything from his pick of the best password managers to his plan to embrace biometrics.

• Read the full story: I’ve had enough of password frustrations – here’s how I’m finally fixing them in 2024

3. I'm a Photoshop pro – here's how to restore your old family photos in 2024

Photo editing software has become ridiculously good in the age of generative AI – and one of the benefits is how easy it now is to restore old photos that are either low-resolution, damaged, lacking in color, or a combination of the above.

TechRadar contributor Chris Rowlands gives you a step-by-step tour to restoring those old family photos in this guide, covering everything from scanning them with your phone to retouching those blemishes. If you don't subscribe to Photoshop, there are also some tips on how to do it for free with online tools, too.

• Read the full story: I'm a Photoshop pro – here's how to restore your old family photos this Christmas

4. Escaping the algorithm – 5 new ways I'm planning to discover movies and music this year

Sometimes it feels like you're trapped in a feedback loop of the same movie, TV and music recommendations, all unimaginatively served up by an apparently all-knowing algorithm. How do you break free and go off piste?

TechRadar contributor David Nield has been wondering the same thing and has made this plan to discover the untrodden streaming worlds that Netflix and Spotify tend to ignore. Read about the podcasts, newsletters, subreddits, iPad magazines and more that could help you join him in 2024.

• Read the full story: Escaping the algorithm – 5 new ways I'm planning to discover movies and music this year

5. How to start using ChatGPT in 2024 – 7 tips for beginners

The internet loves nothing more than telling you how far you're falling behind by not using ChatGPT. But what if you've been really busy doing other stuff in 2023? 

Don't worry – if your New Year's resolution is to get up to speed with AI chatbots, we've made the perfect place for you to start. Our beginner's guide to ChatGPT will tell you how to write more effective prompts, make custom instructions and much more. 

• Read the full story: How to use ChatGPT – 7 tips for beginners

6. I’m ditching Spotify for Tidal in 2024 – here’s why you should too

TechRadar contributor, and former What Hi Fi? staffer, Verity Burns has been a loyal Spotify subscriber for nearly 15 years. So why is her tech resolution to switch to Tidal in 2024?

As with any long-term relationship, it's complicated – but you can find out why Tidal now holds such allure for music fans, and why it could make sense for you to switch, in this helpful breakdown of music streaming in 2024.

• Read the full story: I’m ditching Spotify for Tidal in 2024 – here’s why you should too

7. In 2024 I’m using my cheap tablet to rediscover my love of comic books

After an eight-year break from his X-Men and Spider-Man addiction, TechRadar's Senior Staff Writer Hamish Hector is reinvigorating his long-held love for comics in 2024 – with the help of a cheap, trusty Lenovo tablet.

Read about how Marvel Unlimited is going to fuel his comic book needs in 2024 and why the broader lesson of his project is that tech doesn’t need to be perfect, just perfect for you.

• Read the full story: In 2024 I’m using my cheap tablet to rediscover my love of comic books

8. Why it's a great time to buy second-hand camera lenses – plus our top picks

It's easy to fall into the trap of thinking that only that new piece of impossibly expensive mirrorless glass can take your photography to new heights. But these days, second-hand lenses offer incredible value – and in this guide we show you how to navigate the minefield to land some bargains. 

Whether you prefer wide-angle, telephoto or zoom lenses, our guide takes you through the best places to buy used lenses, the important things to check, and which lenses are offering particularly good value right now for Canon, Nikon and Sony fans.

• Read the full story: Why it's a great time to buy second-hand camera lenses – plus our top picks

9. I’m finally going to use these Chrome extensions to save me money in 2024

It's shaping up to be another financially-trying year for many of us. But rather than staring dolefully at mushrooming bills, TechRadar contributor Darren Allen has resolved to find ways to claw back a little cash  – and one of those things is harnessing the power of Chrome extensions.

Sure, they may not make you a millionaire, but the many shopping assistants, voucher finders and price-watching tools available now can certainly help you make some decent savings – and this guide rounds up some of the best Chrome extensions for doing just that.

• Read the full story: I’m finally going to use these Chrome extensions to save me money in 2024

10. 5 ways I'll be using my Apple Watch to run my life in 2024 

The Apple Watch is probably best-known for its fitness tracking, but did you know about its impressive range of other life-helping skills? 

TechRadar contributor and Apple expert Lloyd Coombes does – and he's written about the ones he'll be using maintain maintain good habits and keep his life running smoothly 2024. If you got an Apple Watch for Christmas, this is a fine primer on some of the smartwatch's lesser-known talents. 

• Read the full story: 5 ways I'll be using my Apple Watch to run my life in 2024

11. I'm a huge board games fan – here are the 7 best ones to help you survive January

In our book, a new year's resolution can be as simple as finding a way to get through the harsh realities of January – and there are few better ways of doing that than by pretending the Christmas holidays haven't ended with some brilliant board games.

Some call it denial, others a wholly necessary response to the least fun month of the year – and TechRadar's Hamish Hector (our resident board game fanatic) is firmly in the latter camp. Join him as he takes you on an uplifting tour around the finest board games you can buy right now.

• Read the full story: I'm a huge board games fan – here are the 7 best ones to help you survive January

12. 5 ways I'm using tech to survive January and romanticize my life in 2024

If board games aren't up your street, there are other emergency ways to help you survive January. TechRadar contributor and author Becca Caddy, who's literally written the book on how to live peacefully with your tech (see Screen Time), explains how she'll be using gadgets to 'romanticize' her life in 2024.

Whether you fancy starting a digital journal, experimenting with soundscapes or basking in finely-tuned smart lights, put aside some time to leaf through her ideas – before heading out for a phone-free walk through a forest.  

• Read the full story: 5 ways I'm using tech to survive January and romanticize my life in 2024

13. How to make your home theater setup sing in 2024 with a few simple tweaks

Sometimes, a new year's resolution is best spent on your favorite piece of tech. So if your own life is perfectly calibrated and singing beautifully (if so, please tell us how) it's time to make sure your home theater is doing the same in 2024 with these handy tips.

TechRadar contributor and former What Hi Fi? staffer Verity Burns tells you how to do everything from perfecting your TV settings (including which modes to avoid), fine-tuning your speaker placement, and arranging your room for the best audio and visual experience. What a way to see in the new year.

• Read the full guide: How to make your home theater setup sing in 2024 with a few simple tweaks

14. New year, new music – here are 7 ways I’m super-charging Spotify in 2024

While some TechRadar writers are ditching Spotify for Tidal, others are going in the other direction and fully embracing Spotify's music discovery powers. Rowan Davies, TechRadar's Editorial Associate and Apprentice Writer, is doing just that and has revealed his seven-stage plan for escaping musical echo chambers and finding hidden gems in 2024.

Rowan has the Spotify Wrapped stats to back up his credentials – 48,650 minutes of listening in 2023, including 1,633 artists across 71 genres. We're also talking about a Beyonce top 0.01%-er and a former music editor here – so if you're looking to become a Spotify power user in 2024, this is the place to start.

• Read the full story: New year, new music – here are 7 ways I’m super-charging Spotify in 2024

You might also like

• The 15 best Spotify tips and tricks – how to master the streaming service
• Google names the best Chrome extensions of 2023 with a glaring omission
• ChatGPT explained: everything you need to know about the AI chatbot

ExpressVPN Keys is one of the best VPN services around – it’s our pick for the number one spot, and has been for years. Aside from being a fantastic virtual private network, it has just added a password manager to its arsenal, making it an even better way to secure your data online.

The new password manager lets you save your logins, credit card data, secure notes and much more, safe from prying eyes. You’ll then be able to log in quickly and securely without having to remember any complex passwords or rely on the same login info on multiple websites.

Here, we’ll show you how to get up and running with ExpressVPN keys, from saving your first password to storing two-factor authentication codes for faster logging in. We’ve got all the help you need, whether you’ve used plenty of password managers before or are completely new to them.

Setting up ExpressVPN Keys is simple, but it does require you to have both a valid ExpressVPN account and the separate ExpressVPN app installed on your PC, so make sure you’ve sorted that out first. On a computer, ExpressVPN Keys works as a web browser extension, although there are iOS and Android apps if you want to use it on your mobile. Now that that’s out of the way, let’s get started.

Tools & requirements

• An ExpressVPN subscription
• A Chromium-based web browser such as Chrome, Edge, Opera, Brave or Vivaldi

Quick steps

• Download the ExpressVPN Keys extension from the Chrome Web Store
• Import logins from another password manager, if you have one
• Use ExpressVPN Keys to save and fill your login information on eligible websites
• Create secure notes and save credit card details using the extension
• Get your two-factor authentication codes sent to ExpressVPN Keys for faster logging in

Step by step guide

Final thoughts

ExpressVPN Keys is a handy way to boost your security online and remove the hassle of trying to remember complicated passwords. By handling everything for you, it also ensures you don’t get tempted to reuse the same login information on multiple websites, which can become a major vulnerability if one of those sites suffers a data breach – suddenly, every account you’ve used that login info for could be hacked into.

We already recommend ExpressVPN as the best VPN you can use right now, so it’s encouraging to see the developer add more ways to stay safe online. Because ExpressVPN Keys is free for existing users, getting set up and using it is a no-brainer if you’re already a subscriber.

ITV has announced the upcoming launch of their new show ‘Password’: a word association game which consists of teams receiving one-word clues to guess a mystery “password”. But what is the reality behind having your password cracked?

In real life, cybercriminals aren’t gifted with one-word clues and encouraged by flashing lights and comical noises, yet the ease and ability remain the same. Adversaries don’t have to “crack” passwords anymore, they just steal them when they are unencrypted. So gameshow or otherwise - no matter how ‘long’ or ‘strong’ passwords appear to be they are fundamentally flawed authentication methods. Therefore, companies continued heavy reliance on passwords as a means of validating user identities has left them open for attack.

Representing the weakest link in an organization's security chain, passwords can be easily guessed, obtained through clever social engineering tactics, or stolen while they unencrypted - for example when a user is typing a password into a web form. Despite attempts to implement more secure authentication methods, even first-generation MFA (Multi-Factor Authentication) solutions that combine passwords with an additional factor like one-time passwords via SMS/email or push notifications are now frequently circumvented, even by inexperienced attackers.

This situation poses a significant risk to organizations. According to the Verizon Data Breach Report of 2022, credentials were the most common type of data compromised in both the US (66%) and EMEA (67%), and more than 80% of data breaches directly result from password-related issues. Consequently, improving authentication and security measures remains a top priority for business leaders worldwide.

Just how easy is it to crack a password?

Unfortunately, there is no such thing as a 'strong’ or ‘secure’ password. The length and complexity of a password only become significant if attackers employ brute force tactics, attempting millions of combinations of characters and numbers until they find the right match. For example, it is often suggested that a 12-character password with a mix of upper and lower-case characters, numbers, and special characters would take billions of years to crack through brute force. However, this method is not how adversaries typically gain access to passwords.

In reality, attackers rely on social engineering techniques to trick users into providing their passwords directly. They may also infect endpoints with credential theft malware or employ attacker-in-the-middle (AitM) techniques to intercept passwords as they cross the network in the clear. In these cases, the length of a password becomes irrelevant, as malware can steal a lengthy password just as easily as a short one consisting of only four letters or numbers. Therefore, the focus should not solely be on creating ‘"strong’ passwords but on implementing additional security measures to counteract these tactics.

Poor password habits

Recently, we have seen the growing popularity of password managers with Google and other applications saving users’ passwords and providing a randomized password to ensure ‘greater protection’. While it ensures some degree of security - given it prevents attackers from using one set of stolen credentials for multiple accounts - several issues still remain.

Even the best password manager has limitations when it comes to stopping attackers at the endpoint or in the middle of login flow processes. While these tools may enhance security by generating complex and unique passwords for users, they don't fundamentally alter the login procedure. The password manager merely handles the password generator, with the user's login experience remaining unchanged. Additionally, they don't provide full protection against social engineering attacks, as unsuspecting users may still be manipulated into revealing relevant information to attackers, bypassing the Password Manager's safeguards.

Another significant drawback of password managers is that they centralize the risk for users and create an enticing target for hackers. If attackers manage to steal the main password from the password manager vendor, they potentially gain access to all customer credentials in one go. This concentration of sensitive information can lead to severe consequences in case of a successful breach. A real-life example of this risk materialized in December 2022 when LastPass disclosed an incident where hackers gained access to backups of their customers' data. Such incidents highlight the vulnerabilities associated with relying heavily on password managers as the sole defence against security threats.

The solution? Passwordless authentication

Organizations now have the opportunity to transition towards a modern and highly secure passwordless, Multi-Factor Authentication (MFA) system that effectively resists phishing attempts. This advanced approach makes use of biometrics and passkeys, following the standards set by the Fast Identity Online (FIDO) Alliance. This industry association operates openly, with the primary goal of reducing the world's dependence on passwords by establishing robust authentication standards.

The FIDO Alliance's mission involves promoting and supporting the development, usage, and adherence to authentication and device attestation standards. Its efforts aim to revolutionize authentication by offering open standards that surpass the security provided by passwords, while simultaneously being more user-friendly for consumers and easier for service providers to implement and manage.

By embracing these innovative passwordless technologies, enterprises can significantly raise the bar for adversaries attempting to hack into their systems. Additionally, it liberates users from the burden of managing passwords, which is a responsibility they are eager to be free from. The adoption of FIDO-based authentication systems represents a crucial step forward in enhancing overall security and user convenience for organizations worldwide.

Given passwords remain a key feature for many businesses and even new gameshows, adopting a passwordless approach might appear a lengthy task for an organisation’s cybersecurity team. However, adopting the passwordless authentication approach is crucial for any company that seeks to have full protection through a robust security strategy. Remove passwords and you remove the weak link in your defense.

We've listed the best identity management software.

Passwords, one of the earliest forms of online security, are crucial for safeguarding accounts, applications, devices, and data. Despite various challenges surrounding them, they are unlikely to become obsolete soon. The main issue with passwords is their number and frequency of use. With the need to access various websites and apps daily, people often have to remember more than dozens of passwords, leading to password fatigue. 

To counter these challenges, password managers have emerged as a viable solution. These software applications create complex passwords and store them in an encrypted database accessible through a single master password. Available in different forms, some of the leading password managers are standalone applications, while others are integrated with operating systems or are browser-based. In the 2023 Bitwarden Password Decisions Survey, password management software was recognized in among 84% of respondents as the go to solution for managing passwords at work.

The dual edges of password managers

Password managers are sophisticated applications designed to store an extensive database of a user's passwords, making the challenging task of remembering complex credentials a thing of the past. The primary key to this vault is a singular master password. Upon its input, users gain access to all their passwords within the manager.

Many of these utilities have automatic password generators, churning out complex credentials on demand. They offer the advantage of autofill capabilities, eliminating the manual chore of copying credentials – an advantage especially valuable for mobile device users.

However, given the potential vulnerabilities of the hosting servers, utilizing online password managers poses risks of their own. Hence, these tools considerably elevate security standards but don't offer absolute invulnerability.

The pitfalls of automatic auto-filling

Though conceived for bolstering security, password managers auto-fill functionalities can inadvertently populate credentials into dubious or malicious websites.

Cybercriminals deceive these managers by skillfully manipulating website components or crafting persuasive phishing sites. This becomes a greater issue when users don’t put in their due diligence to ascertain the site's authenticity and instead lean too heavily on the auto-fill feature. Such negligence could inadvertently hand over their credentials to adversaries, leading to potential account breaches.

Moreover, Google's advisory in January unveiled that several password managers were susceptible to mistakenly auto-filling credentials on untrustworthy pages, posing a tangible risk of account breaches for users.

Specifically, Safari browsers, and extensions, such as Bitwarden and DashLane, were identified as potentially auto-filling login details within forms embedded in sandboxed iFrames. Fortunately, by the advisory's release, these flaws had been addressed.

Understanding password managers

In light of these revelations, our security research team undertook comprehensive tests on prevalent browsers and password managers, evaluating their responses to same-origin and cross-origin iFrames, notably those unsandboxed.

Our observations highlighted Chrome and Firefox's robust security stance - neither auto-filled credentials nor presented the option. Contrastingly, the Edge browser did auto-fill the username or email field, although it left the password field untouched.

For password managers, Passbolt and 1Password emerged as frontrunners in security, refraining from both auto-filling and offering the option to users. BitWarden and LastPass, whilst adopting a different approach, present users with a precautionary prompt when credentials may be forwarded to a divergent domain. This pivotal prompt allows users to auto-fill or decline, even in unsandboxed cross-origin iFrames.

Secure password management not only relies on users choosing strong passwords but also using due diligence when choosing a password manager and utilizing its functions. We strongly recommend users disable any auto-fill features and only manually trigger the feature when users are confident that the form presented is legitimate and should be filled.

Best practices for a robust password

Password security is paramount, not only for individual users but for the broader integrity of databases. While protective mechanisms can counteract some user lapses, individuals remain particularly vulnerable when employing weak passwords. So, what constitutes a robust password?

1. Incorporate alphanumeric characters: While recent studies suggest that simply adding upper and lowercase letters might not drastically enhance password strength, their inclusion, even marginally, can fortify defences. 

2. Embrace length: One of the most effective strategies is lengthening your password. Extended character sequences significantly challenge recovery attempts. Familiarise yourself with the latest methods advocating for comprehensive passwords. 

3. Integrate symbols: Current research underlines the effectiveness of symbols. Their inclusion proves more potent than switching between upper and lowercase letters. 

4. Prioritise unpredictability: Crafting unconventional passwords is key. Avoid the temptation of dictionary words or predictable sequences. Aim for originality, confounding potential intruders.

What to look for in an enterprise password manager?

When security administrators consider password management solutions for their businesses there are a couple of key aspects that they pay attention to. The right choice can obviously be vital for businesses of any size. Unlike the consumer versions, enterprise password managers allow setting and enforcing of password policies (length, complexity, change frequency, etc.). Moreover, they often have a feature that analyzes passwords for potential vulnerability according to current security trends. 

While no longer solely the domain of enterprise password managers, MFA and strong encryption are the key elements to analyze before choosing one. A growing trend is the incorporation of behavior analysis powered by machine learning and analytics, which helps administrators identify and address risky user behaviors.

Today's enterprise password managers are increasingly sophisticated, but many still lack tools for developing effective password compliance programs. However, this functionality is expected to become more prevalent, enhancing the capacity of security teams to enforce and manage password security effectively.

By adhering to these principles, users can significantly reduce their vulnerability in the digital sphere. Password management services require a two-way relationship. It’s important we don’t rely solely on this advanced technology and instead remain judicious and proactive in our online conduct. Despite being formidable allies in online security, they are not without their intricacies. Understanding the nuances and potential hazards linked to auto-fill features is central to user protection. We advocate for a more cautious stance - disable the automatic auto-fill function and opt for a manual trigger instead. Users should activate auto-fill exclusively when they are certain of the form's authenticity.

We've listed the best business password managers.

If you thought using a longer password is better for your security than a short one, then you may want to think again.

New research from Specops Software has found that even passwords 15 characters long make it into the top ten of the most common password lengths to be compromised (placing eighth). The most compromised length was eight characters, accounting for 212.5 million out four billion in the company's Breached Password Protection Database.

Specops surmises that this is the most common since eight characters is the default length for Active Directory passwords. As expected, as the character length increases, the share of compromised passwords decreases.

Time to crack

This led Darren James, Senior Product Manager at Specops Software, to conclude, "longer passwords are better... however, it’s important to understand that equipping users with strong, lengthy passwords isn’t a foolproof way to avoid compromised credentials."

He added, "attackers can still find workarounds – and user behavior can undo a good password policy."

When it comes to the actual content of the passwords themselves, it is again not much of a surprise that topping the list for eight character phrases is "password". For 15 characters, the phrase 'Sym_newhire' appears as the second and third most commonly compromised passwords - "Sym_newhireOEIE" and "Sym_newhireOAIE".

It is essential for business to have strong passwords, as Specops also cites figures from Verizon that claim that a massive 86% of all attacks begin by making use of stolen credentials. 

Increasing length can safeguard against brute force cracking. Specops calculates that to crack an eight character password, even those that contain numbers and both upper and lower case characters, can take a mere five minutes. On the other hand, a 15 character password can take up to 37 million years to crack.

However, the report warns that this "shouldn't give organizations a false sense of security, as this is only part of the password security battle." For instance, it won't matter if the credentials are stolen via phishing attacks.

Using one of the best business password manager solutions can help to secure your passwords further, as they often come with dark web monitoring features that notify users if any of stored credentials have been leaked in a known data breach.

Looking further ahead, though, the whole discussion may be academic, since passkeys, the new passwordless technology that is taking hold, mean there are no credentials that can be cracked or even phished. Some identity management solutions and business password managers are giving enterprise this capability already.

MORE FROM TECHRADAR PRO

• Here is the best endpoint protection for your business
• AI can crack most passwords in less than a minute
• What are Passkeys?

Today is world password day, an event kickstarted by Intel and held on the first Thursday of every May both to remind people of the importance of passwords in securing their digital lives, and to raise awareness of the best practices to use. However, with the advent of new passwordless technologies, some think they are often no longer fit for the digital world we live in. 

There’s no doubt that there are good and bad passwords, and that the quality of your password can have a significant effect on your security posture. Strong passwords are long, random and have multiple character types, and you should use a unique one for every account you have. Password managers are the best way to achieve this, as they can create and store all the strong unique passwords you’ll ever need - without them, you’ll almost certainly fall into bad habits.  

But even if you’re using the best password manager, some still think this isn’t good enough to keep your credentials secure. Your password manager itself could be hacked, as we saw infamously with LastPass, as well as others including Norton Lifelock and Passwordstate. And aside from outright breaches, there are examples of minor incidents, such as Keepass’s vault export bug and Bitwarden’s low risk iFrame exploit, that may still make people think twice about entrusting their most treasured information to a third party.  

More than a password

Despite this, we still recommend using a password manager, as they are still almost certainly more secure than relying on your own memory to come up with multiple complex passwords for every account. Even the largest corporations, including the likes of Nvidia, are guilty of using bad passwords for the sake of convenience. As you may have guessed, though, research shows that such logins are frighteningly easy to crack, with phrases like ‘password’ making up 88% of hacked passwords.

What’s more, if you only use a password with six characters, a computer could crack it 62 trillion times faster than a login using twice that number in a brute force attack. This means that if it took a second to crack the six string password, it would take over two million years at the same rate to crack a 12 string one - so the difference between a weak and a strong password really can mean the difference between being hacked or staying safe. 

But strong passwords alone are not enough to keep businesses and the precious data they hold protected. Don Boxley, CEO and Co-Founder, DH2i, maintains that “passwords must be considered a first-line, not the only-line, of defense.”

He explains that other tools, such as using the best VPN, can help firms stay protected online, but these are starting to fall out of favor, with Boxley citing their “limitations in terms of security, slow connection speeds, bandwidth constraints, configuration and management complexity, and high cost” as the main drivers. 

DH2i’s solution is Software-Defined Perimeters (SDP), which allow for a direct connection to endpoints in zero-trust networks, without the need for any intermediary such as a VPN. This means that, unlike VPNs, “SDP can prevent lateral network attacks, enhance data transfer rates by up to 3x, and offer complete control over the data stream,” claims Boxley.

Steve Santamaria, CEO of Folio Photonics, even goes as as far as to suggest using Linear tape-open (LTO) when it comes to backing up important data for your business. So-called Write Once Read Many (WORM) media is air-gapped - i.e. disconnected entirely from the internet - allowing data to be viewed multiple times but only written once, as the name indicates. This means the data cannot be tampered with unless someone has physical access to the WORM storage medium. The tape used is also certified to last up to 30 years without data integrity being compromised, beating most hard drive ratings.

As Santamaria puts it, “It can safeguard your assets while helping you recover from a ransomware attack or other data loss event; subsequently, reducing the impact that this disaster has on your business operations.”

Passkeys: the new password?

But what about going one step further - and ditching passwords altogether in favor of another solution?

Passkeys make use of cryptographic keys instead of passwords, a complex string stored on your device that is not known by anyone - even the user. Instead, only your device knows, and when this private key is combined with the public one stored in the cloud of the service you have an account with, grants you access to said account. All that is required to authenticate is the biometric data your device contains, such as a fingerprint scan or facial features. 

Although the technology is still nascent, plenty in the world of big tech support its use, including the likes of Amazon, Google, Microsoft, and Apple, which have united under the open industry FIDO alliance, which sets the standards for the technology under the FIDO 2 WebAuthen specifications. 

Jasson Casey, CTO at Beyond Identity, is very bullish about passkeys, going as far as calling for a boycott today, and urging us to consider it “World Password-less Day” instead.

Casey believes that regardless of how weak or strong your password is, they can still be compromised, as malware can be used in phishing attacks that trick victims into giving away their password unwittingly, or in data breaches of third parties who have access to your credentials, thus rendering even the strongest passwords useless.

Casey instead recommends that businesses adopt passwordless solutions, which are resistant to such phishing techniques, “making it virtually impossible for attackers to gain access through traditional methods.”

“Organizations don't have to compromise their security or convenience,” he says. “Today they can switch to a modern, secure, phishing-resistant MFA that leverages the combination of biometrics and Passkeys based on the Fast Identity Online (FIDO) standards.”

“Each year, we 'celebrate' World Password Day, and then cybercriminals continue to exploit password-based authentication. Only by adopting passwordless, phishing-resistant MFA technologies can organizations make it much more difficult for adversaries.”

Casey isn’t the only one to be won over by passwordless security. When we spoke to Eve Maler, CTO of identity management firm ForgeRock, she was similarly critical of passwords' ability to provide adequate security for organizations. ForgeRock is the first of its kind to allow its customers to log into their services completely password-free.

She believes that passwordless systems allow businesses a greater degree of flexibility in providing authentication. She also spoke about the use of behavioral biometrics, which work in tandem with passwordless systems to seamlessly authenticate a user’s identity. According to Maler, they can “track our physical habits such as [our] gait, height or location and login patterns to build a map of a user and their ‘normal’ behavior”.

With the help of AI to work out a user’s identity, 2FA can also be done away with, again making it easier for organizations to manage worker security protocols. Maler also pointed out that as regulations change around the security that firms have to adopt, this kind of AI can help businesses to adapt with less friction. 

Another key aspect for Maler of passwordles systems is the fact that they are much easier to use than passwords, going as far as to say, “the only way a passwordless approach will succeed is if it takes a no-compromises stance between security and user experience.” 

However, when we recently spoke to veteran security expert Roger Grimes, he wasn’t as enthused as others when it came to passkeys and passwordless solutions. Despite saying they were a “good thing”, and admiring their phishing resistance, he was skeptical about the number of services and companies that would actually adopt them, believing that, “Passwords will be with us for at least another decade, if not forever.” 

It seems that many ordinary people share Grime’s trepidation. To mark the occasion, Bitwarden - our pick as the best free password manager - released its annual World Password Day Survey for 2023, which sought opinions from people around the world on passwordless technology. It found that only just over a half of respondents were excited about this new technology, with others concerned that their personal biometric data used in their place, such as fingerprint and face scans, may be used against them in some way. 

Grimes also expressed concerns about the close knit integration between passkeys and big tech companies: “Passkeys are currently locked into one platform…If you use multiple platforms you'll need to store, operate, and update your passkeys separately even if you are connecting to the same websites. Meaning if you set a passkey on a website using Microsoft it won't automatically be there to use if you go to the same website on your Apple product; and vice-versa. That's a problem in today's multi-platform world.”

Instead, Grimes prefers using a good password manager with MFA enabled, and spoke of the extra useful features password managers have that you don’t get with passkeys: “My password manager automatically notifies me when one of the websites I belong to gets compromised. It allows me to store secure notes that have nothing to do with logins, like my will. I can store my credit card information separately from my browsers. I can store electronic licenses and passports.”

Although experts can’t agree on what the future of credential security will or should be, what we do know is that for now, passwords still have to be dealt with. And no matter their pitfalls, or what they can accomplish on their own, making sure you have strong, unique passwords, using a secure password manager and bolstering them with MFA will certainly be preferable to reusing the same weak passwords time and again. 

Considering the continuing rise in cyberattacks and their increasing sophistication thanks to the emergence of AI, and even the possible threat of quantum computers to the very foundations of digital security, there has never been a more pressing time to think about passwords - and the technologies that may replace them - than now. 

• Here are the best business password managers

LastPass is a widely used password manager relied on by 100,000 businesses and 33 million individuals to secure their passwords. While password managers offer convenience, they also come with security risks and it's crucial to carefully consider the benefits and risks before adopting them in an organization. Poor password policies, lack of control, or even a single user error can result in disastrous consequences. However, in some cases, the very thing people fear most can occur – the password manager itself can be compromised.

The recent LastPass data breach is a cause for huge concern for organizations and individuals who have utilized this password manager. On December 22nd, LastPass revealed that a security incident that they had previously reported on November 30th was actually a massive data breach. The attackers are believed to have used information obtained from an August attack on the company to carry out another attack in November.

Unfortunately, it's not the first time this has happened; on June 15, 2015, LastPass announced that its network had been breached, compromising data such as email addresses, password reminders, and password hashes.

The most recent breach allowed an unauthorized party to access sensitive user account information, including personal information such as usernames, email addresses, phone numbers, names, billing addresses, and IP addresses. Additionally, the breach exposed stored website URLs, which could be used to launch phishing attacks, and stole vault data, including usernames, passwords, secure notes, and form-filled fields. Although this data remains encrypted, if an attacker cracks the master password, they would be able to access all the information stored in the vault. Changing the master password now would not solve the issue, as hackers have a copy of the vault.

For businesses that require employees to use LastPass as part of their official password policy, the risk is obvious. If an attacker cracks or steals an employee's LastPass master password, they will have unrestricted access to the company's most sensitive data.

Overall, this breach highlights several related issues that, when combined, can cause devastating consequences:

• A lack of password best practices: Many end users do not maintain good password hygiene, including password reuse and weak passwords. Unfortunately, 53% of people reuse passwords for both corporate and personal accounts, which means that even if different password managers are used for work and personal purposes, a breach can cause major damage 
• Uncontrolled use of password managers: While not all companies use LastPass, many employees install browser extensions themselves and use password managers for both work and personal credentials. In this case, system administrators cannot enforce password best practices or manage password manager software. In fact, some data shows that 97% of the cloud apps used in the enterprise are cloud shadow IT.

This puts both personal and corporate-managed users at risk, as the breach demonstrates the vulnerability of even well-established password managers. 

What can we do now?

To mitigate the risk posed by the LastPass breach, all users are advised to reset their passwords site-by-site, as simply changing the master password now would not solve the issue. They should also follow best practices for passwords and enable multi-factor authentication (MFA) where possible.

For sysadmins, the following recommendations should be considered:

• Monitor your managed devices for installed plugins, as not all users follow cybersecurity news and may be unaware of the problem.
• Pay particular attention to identifying LastPass installations installed as browser extensions, since they are not detected by most remote monitoring and management (RMM) and endpoint management systems by default. However, it is possible to automate LastPass extensions discovery through scripting, which saves time and effort.
• Adopt a risk-based approach to determine whether LastPass is the best password manager for the organization, or if a different solution is more suitable.
• Implement a password manager that is centrally managed and controlled by the IT team, to enforce strong password policies and prevent password reuse.
• Urge users to turn on multi-factor authentication (MFA) for all of their accounts, including those managed by LastPass, to add an extra layer of security. Ideally, use hardware token-based MFA if the service supports it, or at least app-based MFA, such as Google Authenticator. Avoid SMS-based MFA, as it is less secure and vulnerable to cell phone number hijacking.
• Conduct regular cybersecurity training and awareness campaigns for employees on the importance of using strong passwords and the dangers of reused passwords. If you’ve identified users relying on LastPass outside of the IT control, work with them directly, and articulate the dangers of this practice.
• Emphasize user education on recognizing social engineering attacks. Users need to be aware of the sophisticated methods used by threat actors to steal their master password. Attackers may pose as LastPass, regulatory bodies, or other organizations and deceive users into revealing their credentials. Users should also be mindful that phishing has evolved beyond simple emails and can involve multiple communication channels, including phone calls, SMS, messaging apps, and others
• Collaborate with users to develop good password policies, regularly review and update them to align with current security best practices. 

Conclusion

The LastPass data breach is significant in several ways. First, it serves as a valuable reminder for all of us to rethink password security practices. Second, it shows that even if an attacker initially gains access to a non-sensitive aspect of a company's infrastructure, they can still exploit security vulnerabilities and obtain sensitive customer data that resides in a different but interconnected environment over time. This reminds organizations on the importance of thoroughly examining security weaknesses if a successful attack occurs, in order to prevent future hacks, including taking prompt action to investigate any security incidents and identifying and remediating any security vulnerabilities. 

We've ranked the best business password managers.

There has been a lot of talk about the end of the password, with each new technology promising, among other things, to end the password and the dreaded need to remember so many complex passwords. Yet, none have succeeded so far, as we still rely on our passwords to enter our online accounts. This is, of course, a potential security risk, as all of our private data, finances and health are locked behind passwords, which we have to store somewhere and recall when we want to log in. Furthermore, people avoid two-factor authentication making the problem more complex.

Add to these vexing issues the need for password hygiene, i.e., a need to change passwords, use long and complex passwords, and never reuse a password, and you get the complete picture of the challenge. This also translates to businesses, which are increasingly relying on cloud services, with each one requiring a different password. 

Given the challenge of generating and remembering a distinct, robust password for each account, how can individuals realistically manage this responsibility? This is where a password manager becomes invaluable. A password manager offers several advantageous features. These tools do more than just store and autofill your passwords; they can generate strong passwords and safeguard other sensitive digital data. By keeping your passwords in a secure, encrypted vault, password managers significantly reduce the burden of memorization associated with maintaining good password hygiene.

Password managers present an optimal solution to address the flaws of traditional passwords and the insecure methods commonly employed in their usage. However, it's important to note that not all password managers are alike in terms of effectiveness. The crucial factor lies in choosing a reliable provider that offers the ideal mix of features to suit your needs. Below you will find essential features we believe you should be looking for when choosing your password manager solution.

1. Look for encryption

Any reputable password manager will make optimal use of the latest encryption technology. Take some time to read through the details of any password manager packages you’re interested in and lookout for information on which encryption algorithms they use. You’ll want to ensure that any sensitive data fields you enter are going to be stored and protected as securely as possible.

2. Secured credentials

While a password manager needs to be able to secure your credentials, it’s also possible that you could one day forget the master password. If this happens, you will not be able to log in and this could cause a lot of headaches and mean you cannot access your accounts. So, it’s worth checking that you can get a decryption key in a worst case scenario, while also ensuring that this isn’t able to be gained by someone other than yourself.

3. Multi-factor authentication

Having the added benefit of multi-factor authentication offers another level of security, which is especially useful on any cloud-sync password managers. It means that you’ll need to have both a master password and a second factor, such as a smartphone notification, in order to gain access to your passwords. It may add to the cost of some packages, but it’s worth having.

4. Regular updates

Password managers, like any other chunk of software, need to be kept up to date, so be sure to check that your preferred options stay on top of things. Hackers and other cybercriminals are modifying their behavior and techniques all the time, so you’ll want to invest in a password manager that is updated on a regular basis in order to match the ever-changing security landscape.

5. Password generation

Coming up with a good password in the first place is a common challenge we all face. By spending money on a quality password manager, you should get the added benefit of the software being able to generate a new log-in whenever you need it. This will invariably be much better than anything you produce yourself too, which means it should be both safe and secure.

6. Managing passwords

If you’ve been using log-ins for any amount of time then once you start using a password manager there’s an additional benefit to be had. Many password manager apps can check over your existing password collection and advise if any are weak, or might have already been compromised. They can frequently match them against databases of breached log-in details and advise of how best to change details to fend off any potential attacks.

7. Platform compatibility

It’s well worth checking that any password manager you might be investigating is able to function on a variety of platforms. This will make like much easier, especially if you tend to move between different operating systems, like switching from an Apple computer to an Android smartphone, or vice versa. It should be able to work in harmony with your other software too, including popular web browsers such as Chrome, Edge, Firefox and Safari.

8. Convenience features

One of the best things about a decent password manager is that it can make your life much easier. If you’re looking for convenience, then having an auto-fill feature as part of the package can streamline your online activities. This will often allow you to access websites using a browser extension, thereby removing the need to do any additional typing in of password details. However, you’ll want to check that this aspect is as secure as possible and not able to be used by anyone else who might jump on your computer or device.

9. Added value

While there are free password managers that exist, it’s always a good idea to spend some money and invest in an app that offers value as well as plenty of security. If you’re signed up to a package you’ll get better maintained software, that’s able to stay on top of any of the latest security alerts as well as providing you with plenty of features. Having a password manager that is always bang up to date offers much more peace of kind than a free or adware-based design.

10. Ease of use

Most of the decent password manager packages out there are very easy to use, which makes everyday log-in life that much more bearable. Alongside being easy to use, your chosen password manager should have plenty of features and functionality, all of which can be operated on multiple devices and without the need for a manual. As with any type of computer security system, the ones that come with a subscription-based payment system should mean that you’re only ever using the latest and best incarnation. It’s often money well spent.

We've also listed the best business networking apps.

Passwords present us with a very real headache, in that we all need them but coming up with one, or many, that’ll keep us safe and secure really isn’t all that easy. In fact, unless you’re happy to use the same one over and over again, which is definitely a bad idea, coming up with rock-solid passwords for all those log-ins requires some help.

The best way around the issue of handling multiple passwords is, without doubt, calling on the services of the best password managers out there. These are standalone apps that can not only generate dependable passwords, but also keep them all secure in a vault-like setup. You’ll generally need to pay for the privilege if you want something that’s really good, but that’s a small price for convenience and security, right?

A great example of this is pCloud Pass, which allows you to keep all of your passwords for accessing every one of your devices within a secure environment. There’s the added benefit of military-grade encryption too, which is rather more robust than some of the plain text formats used by some lesser password managers. Better still, it offers single-click logging in and works across all devices, browsers and operating systems too.

Complex secure passwords

So, if you’re looking for an easy way to take control of your passwords, and most of us have lots of them to wrangle, a password manager is the way to go. However, many password managers work by having one main password that keeps all your other ones safe. While a dependable password manager can therefore do a lot of the hard work for you, it’s still vital to come up with a complicated yet memorable password for when that issue arises.

Creating a bulletproof password, which can subsequently be used as your master, needs some careful thought and consideration to implement. There are random password generators that can be called upon if you want to have a decent password, but the only problem with many of these is that you end up with something very cryptic and not at all memorable.

If you’ve got something that is lost from your memory right away, then you’re going to have lots of problems getting into your password manager in the first place.

Smart thinking passwords

One of the best ways to approach the construction of your impregnable yet memorable password is to ensure you’re thinking long. Eight characters is often seen as a good ballpark figure for the average password, but if you’re looking for security then average isn’t the way to go.

You want something longer, so a figure of around fifteen characters is a good amount of characters to head for. Each time you add in a character you’re going to make the task of cracking it that little bit harder, especially when it comes to fending off brute-force attacks.

Of course, the downside to this is ensuring that by creating a longer password you’re not immediately going to make it harder to remember for your own requirements. One of the most common methods for making the task of creating a complicated yet memorable password is to make one up based around a song or a famous quote.

In fact, you can work with anything that’s familiar, like a poem maybe. The key from there is to blend that with lots of hard to crack padding.

Create password perfection

Once you have a song, poem or phrase in your head, one that you’re super familiar with, you’ve got the foundations for creating a potent password. Let’s use For Those About To Rock as a random song title as a loose example, which can be quickly converted into f t a t r , which if you then add We Salute You, you get f t a t r w s y.

Mix in some upper and lower case characters, making it F t A t R w S y with some special characters added for good measure. You could end up with something like F t A t R@w S y keeping the spaces too, or filling those in with characters you can remember.

Whichever combination you use, just be sure to keep the way you’ve thought of it in your head as this is much easier than trying to remember the password itself. It’s also a good idea to put the password into a reputable checker, somewhere like Kaspersky.com as a random example, which will immediately tell you if it’s a good one.

This method also indicates if it already appears in a list of leaked passwords. As long as you can keep the way you’ve created the password in your head you shouldn’t have any problems using it as a master. You can also use the same thought process to update it from time to time, using another song or poem for good measure.

Remaining vigilant

Creating one master password can be a daunting, but if you make use of fairly simplistic thought processes to come up with what inspires it, the process can be simpler than expected. You may find that your particular password manager might not support spaces, in which case you can just substitute those with something else, like a hyphen, or the = character and, ideally, remember to avoid using the shift key.

If none if that appeals, you can always head in the direction of a passphrase, which is effectively a bundle of unrelated words, that can often be quite easy to memorize. In fact, if you’d prefer to have it done for you there are numerous passphrase generators that can be found online. If your memory isn’t very good, this might be the route to take as a passphrase can be easier to recall, but is also hard to crack.

We've also listed the best business networking apps.

Coming up with the best password to keep yourself and your online activities safe and secure is something we all need to do. There’s no escaping it, especially if you’ve got cloud storage to keep secure, a laptop to protect or a smartphone that needs to remain untouched. However, deciding on the best password to use isn’t always easy. It’s even harder if you’re in need of multiple secure log-ins.

Which is something that tends to affect pretty much everybody in the connected world. Multiple online accounts, lots of devices and the need to use cloud services means that most of us now have a requirement for passwords, and lots of them to boot. Much has been written about how to come up with a strong password and, while it’s an issue that most of us are familiar with, it’s always worth taking some time to go back and revisit our secure log-in information.

Unlike a good wine, many passwords don’t mature with age either. In fact, a password you might have used say one, two or three years ago might now have reached its sell-by date. Passwords need to be constantly updated, mainly because cybercriminals are endlessly evolving their methods for compromising computer security. Here then, are some strong password ideas for greater safety online.

Ditch a weak password

If you think any, or indeed all of your passwords are duds then don’t waste any time in changing them. One of the quickest and simplest ways of doing this is to get yourself armed with one of the best password managers. This is a software application that streamlines the logging-in process, which makes even more sense if of you have multiple accounts and a small mountain of passwords to handle.

The other bonus with a password manager is that it’ll soon let you know which of your passwords isn’t great. However, many of us already know which of our log-in details are less than impressive. Using pet names and other just as obvious characters to formulate a password is a bad habit that many of us tend to have. So, if you’ve got a bad feeling about some, or all of your passwords it’s definitely time to ditch them in favour of something rather better.

What is a weak password?

When it comes to identifying a weak password there are plenty of examples that will soon let you know if you’ve been using a poor choice of characters. Sequential letters or numbers for example, are an obvious faux pas, as is using less than eight characters.

Similarly, choosing something that might be easily guessed is another needless oversight. Hackers are well versed in picking through their arsenal of the most obvious password connotations, such as ‘123456’ and ‘password’ itself, before they move on to the less-easy-to-guess passwords.

Even if you think you’re being smart by picking something that’s not related to your own identity, such as a movie star’s name, or comic book hero, the hackers could still figure it out. They do this using a variety of methods, including brute-force attacks, which is a method that does just that.

Hackers call on their software to pick through a variable combination of letters and characters until they crack the password, with success rates that are worryingly high. If that fails, they’ll often utilize other methods to crack passwords such as keylogging, phishing, dictionary attacks and credential stuffing to get what they’re after.

Build a better password

So, with all of those cruddy passwords noted and ready to be ditched, the next thing is to make sure you’re going to replace them with something much more robust. While you’ll often see a minimum of eight characters as the suggested length for a password, it’s actually worth going for something longer if you can. In fact, doubling that number is a good idea while avoiding all of your usual inspirations is another core aspect of creating a better password. 

What that means is to ditch anything that pertains to yourself, such as your first name, last name and date of birth. Remember to mix up the character style too, so a combination of upper and lower case, along with numbers and symbols creates a much harder-to-crack and less organic blend for a password. Don’t use anything in sequence either, as in ‘123’ or similar. Jumbling up the order might make the password harder to remember, but it’s also going to make the thing harder to crack.

A perfect password?

While there’s not any one combination that might be seen as the perfect password, you can certainly get close if you choose yours carefully. If you do it right, you should also be able to produce a password combination that’ll be a little easier for you to remember. For example, if you think of a word, then condense it by removing specific letters in the order, replacing those with a combination of letters and special characters, you’re off to a good start.

Another tack that you can make your own is to produce a formula, which is unique to your own way of thinking. For example, a phrase can be customized so that you mix and match one letter from the alphabet with the one either before or after it. Similarly, replace the vowels in your phrase with others, which once you have it in your head is actually quite easy to memorize, but equally hard to crack. Throw in the odd space or two and you’ve got yourself a fairly impregnable password.

Managing passwords

Naturally, the more passwords you possess, the more work you’ll have to do in order to refresh your collection and ensure that you’re as secure as possible. That brings us back to the humble password manager, which is a chunk of software that can prove to earn its keep very quickly indeed. A password manager app allows you to generate strong passwords quickly and easily, and all of your log-ins are kept in a secure ‘vault’ within the app.

You might need to pay for the privilege of owning a reputable password manager, but it is money well spent. The software will even tell you if your proposed password is any good or not, which is mighty handy. With so many of us now using cloud storage, which often contains many or all of our files, having the perfect password is not so much a dream as a necessity.

We've also listed the best business networking apps.

There’s no escaping the need for passwords and, thanks to an ever-growing requirement for new ones, we’ve all got more than we know what to do with. That can be a big problem, because making sure they’re all good whilst being easy to remember, is tricky to say the least. This scenario can tend to get worse the more password and log-in details you have. Eventually, many folks just give up, get lazy and start to fall back on their original and easily hackable passwords. Often, people will use the same easy-to-crack password in multiple locations.

Clearly, going down this route is not a good idea. In fact, if you’ve got any desire to keep your online activities safe and secure, it’s downright madness. Thankfully, many up-to-date web browsers can assist you with your password problems. The likes of Google Chrome, Microsoft Edge and Mozilla Firefox can usefully store passwords for you. It’s an extra touch of functionality that delivers added convenience within an experience that’s free to begin with. However, just because something is free doesn’t always make it the best bet.

If you’re aiming to stay safe and secure online, or if you make use of the best cloud storage options so have lots of files stored remotely, ensuring your passwords are optimised is vital. So, does the browser-based password manager option have merit? Or should you make use of one of the best password managers out there, which are app-based and generally need to be paid for if you want a good one.

Password manager benefits

While there’s no doubt that any kind of password manager can be beneficial, especially if you’ve got multiple log-ins to handle, there are pros and cons for the browser-based route. If you’ve got a browser with an integrated password manager, it can certainly offer up a simple-but-effective way to control log-in procedures. One of the neat aspects about them is the way they invariably feature a password generator, which does a lot of the heavy lifting when it comes to arming yourself with a new log-in whenever it’s needed.

Another really useful aspect of the browser-based password manager is the way that it will allow you much easier log-ins across multiple devices. If you regularly use a variety of computers and devices, such as a desktop or laptop along with a tablet or smartphone, a browser-based password manager makes life much easier. This is because passwords are stored in the cloud and can be updated in one go should you need to change them. If you’ve got something like a Chromebook, password management becomes a doddle.

Simplifying passwords

Password management should never be taken lightly, but a browser-based setup is also undeniably easy to use. If you tend to visit multiple sites over a period of time, or have many different accounts to manage, then remembering all those passwords can be a chore. At worst, it can result in getting locked out of seldom used accounts if you’ve mislaid the information. A browser-based password manager, on the other hand, can retain every log-in you need, even those occasional dip-in-and-out accounts that are only visited occasionally.

An additional bonus in all this is that, generally speaking, browser-based password managers are completely free to use, so there’s no annual subscription or one-off charge that is often called for with password manager apps. Another feature of the browser-based approach is that there’s rarely any additional software that needs to be installed. If you’ve selected a browser with this tool as part of the feature set it can be used right away, and often with little in the way of configuration needing to be done.

Browser-based downsides

There’s no doubt that browser-based password managers are therefore worth it, mainly because they probably won’t cost you anything to use in the first place. However, there are some downsides by sidestepping password manager software apps. For starters, a standalone password manager doesn’t require you to stick with one web browser, which might be the case if you want to have the convenience of multiple log-ins via one application.

Many people enjoy having more than one browser, which is where having multiple log-in credentials can get problematical and a little bit messy into the bargain. A standalone password manager, from a reputable supplier, should also be better able to fend of evolving security issues due to the way that they are updated more dynamically than browser-based solutions. In fact, if you have a paid-for password manager app, it should be constantly up to date, whereby many browsers don’t get updated nearly as frequently and sometimes security updates can come as part of a general overview update.

Security issues

Crucially, the standalone password manager that comes in app form will probably provide you with a more rounded security solution too. With web-based password managers, that sit within the framework of an everyday browser, your password information could be more at risk. While the best examples, such as Google Chrome, will come with plenty of security features, including AES 256-bit SSL/TLS encryption for looking after your prized passwords, there could still be holes in the arrangement somewhere.

There are, simply, everyday use situations whereby your password could be comprised or used without your knowledge too. Just supposing someone manages to get onto your laptop or desktop machine, without you knowing about it? Plenty of people leave their computing kit lying about, and it’s often easy enough for others to jump on and snoop around. It might sound lazy, but it does happen and if your log-in access is automatically granted within a web browser environment, instead of sitting behind the secure wall of a password manager package, you could be at risk.

Granted, both routes require users to be diligent with their devices and there’s always the risk of compromise, no matter what your password security solution happens to be. While browser-based password managers certainly have their uses, it’s hard to see how they can produce the best solution, particularly when there are so many standalone password manager packages out there that function just as conveniently. Crucially though, they also keep your log-in data locked up much more securely.

We've also listed the best business networking apps.

It’s pretty clear that cybercriminals are willing to go to some extreme lengths in order to hack accounts and gain access to sensitive data, but you might not have heard of a dictionary attack.

You should be aware of this method, though, especially if you want to keep your accounts secure – and especially if you’re worried about the password security that your family and friends use.

In essence, a dictionary attack is a type of brute force attack, but it uses recognizable words rather than strings of random letters, numbers and symbols. And when many inexperienced tech users create passwords that use proper words, that can cause big problems.

We’ve explained dictionary attacks here, highlighted how they differ from other hacking techniques, and delved into the best methods for preventing these nefarious attacks. And if you’d like even more security advice, head to our explainer on endpoint protection and antivirus – or explore the best plagiarism-checking tools.

What’s a dictionary attack?

It might sound like the kind of thing that happens during an argument at a library, but a dictionary attack is actually a sophisticated method used by cybercriminals who want to gain access to your email accounts, bank details and social networks.

To understand a dictionary attack, though, you’ve got to get to grips with another kind of hacking method – the brute force attack.

A brute force attack attempts to guess someone’s password by systematically trying to every possible combination of numbers, letters and symbols. But while brute force methods can hack into accounts by finding passwords, the nature of the approach means it can take ages. Imagine how long even the best computers will take to motor through every possible combination of digits in a 20-character password.

A dictionary attack refines this method. Instead of trying every combination of letters, numbers and characters, a dictionary attack uses recognizable words and phrases instead.

This approach reduces the number of potential passwords a hacker has to try to get inside someone’s account. That cuts back on the amount of time and resources a hacker must deploy to get the job done.

It’s a worthwhile approach. While using words and phrases rather than every potential password combination does reduce the chances of a successful guess, it’s a quicker process. And when so many people use recognizable words in their passwords, it’s still worth trying to any hacker.

Hackers also refine the process. They’ll develop lists of words that are relevant to the account or person they’re trying to hack – based on location-specific phrases, the local sports teams, or any other information they’ve got about the person behind the account. Criminals will use terms that are specific to organizations if they’re trying to hack into company servers, or build lists based on the most common password terms.

In other situations, hackers will develop dictionary attack lists based on passwords that were already exposed in security breaches. They’ll also include sequential number sequences and other common characters in their list of attack words, so you may not necessarily be safe if you’ve added “123” to end of your password in order to try and make things more secure.

Dictionary attacks may not be the most effective way to hack an account, but they use fewer resources than brute-force methods. And when too many people reuse passwords, develop passwords based around common words and don’t practice good password security, it’s no wonder that hackers get results.

How can I avoid a dictionary attack?

As time goes on, hacking methods get more sophisticated – which means users have to fight back with increasing ferocity if they want to keep their accounts, details and financial information safe.

Thankfully, there are some simple rules to follow if you want to avoid becoming the victim of a dictionary attack.

The first thing you should do? Eliminate real words and phrases from your passwords, and make sure you don’t have strings of often-used numbers and letters like “123” and “QWERTY”. Dictionary attacks rely on people lazily using these tropes, and avoiding them is the best way to stay protected.

Instead of going down that route, use long passwords with randomized collections of letters, numbers and special characters, and make sure you’ve got a unique password for every account.

That might sound daunting – especially the prospect of remembering all those passwords – so we always recommend that people use a password manager, too. We’ve rounded up the best password managers here. The top options won’t just save all your passwords – they also generate secure passwords, use encryption to protect your existing codes, and highlight any weak passwords you should change.

When an account offers it, you should also deploy multi-factor authentication. This method uses biometric methods like fingerprint recognition alongside third-party apps and text codes to add an extra layer of security to any account or service. Essentially, it means that a hacker can’t reach your account even if they’ve got your password – because they don’t have the extra bit of information required.

Elsewhere, you should investigate the settings section on each app and account. Lots of services enable you to lock people out if they make a certain number of unsuccessful login attempts, and they’ll often demand that the original owner resets their password. If you want to prevent hackers from having free reign to try and guess your password an unlimited number of times, that’s a smart move.

Our final piece of advice? Make sure you change your passwords frequently. A good password manager can help you in this department by saving passwords, generating new codes and providing reminders.

You certainly can’t stop every hacker, especially given how many password lists are leaked on the dark web, but if you change your passwords then you can stop someone getting into your account – even if they’ve got possession of a password that used to work.

Many security experts recommend changing your password every three months, and some services demand that you do this as an extra layer of security.

There’s no denying that dictionary attacks are worrying, especially when hackers are trying to access sensitive information, bank details, medical records or your email and social media accounts. But if you’re smart about your security and avoid common words, phrases and character sequences, you’ll stay safe – and the hackers won’t get far.

We've listed the best password recovery software.

You’ve probably heard of malware, and you’ve definitely heard of advertising, but a new threat has emerged after those two worlds have collided. It’s called “malvertising”, and it’s worth avoiding.

Malvertising can hack, infiltrate, and exploit your PC, laptop or smartphone without you even knowing it’s there. That’s because it reaches your devices through adverts you might click rather than more conventional methods like phishing emails, brute force attacks or viruses.

It’s a dangerous and murky business, especially because media outlets, advertising networks and users simply aren’t yet familiar with malvertising. But if you’d like to learn more about this new threat – and find out how to avoid getting caught– just read our guide.

The internet is crammed with security threats, so we’ve got more guidance elsewhere, too. We’ve gone in-depth on choosing the right antivirus for your business and unveiled the top breaches and cyber attacks of 2022 – so you know what to avoid in 2023.

What is malvertising?

You won’t necessarily know that you’ve been hit by a malvertising attack – at least initially – because this method disguises malware in the kinds of adverts we all see all over the internet.

Malvertising – a portmanteau of “malicious advertising” – hides dodgy code inside normal-looking adverts. Hackers buy advertising space using legitimate networks, upload adverts with malware, and then hope those adverts run on respected websites.

If the attack works, you’ll end up with malware, spyware, viruses or ransomware installed on your device, leaving yourself open to identity theft, fraud and financial problems.

These dodgy adverts can appear anywhere on the web. You don’t necessarily have to even click on an advert to get hit by malvertising – some of them start to attack your device when you browse a site that hosts an infected ad.

Plenty of huge companies have fallen victim to this kind of attack, so don’t feel bad if you do become a victim. In the past, malvertising has hit the London Stock Exchange, the Los Angeles Times and eBay.

There are lots of different types of malvertising. Some simply download dodgy files to your PC as soon as the advert and its host website have loaded. Others hide malicious code inside individual pixels inside images – and no one can notice the malware until it’s too late because you’ve already clicked.

Other adverts trick users into thinking they’ve got computer issues by using realistic-looking error messages. Others tout false updates, surveys and prizes that can easily dupe an unsuspecting user. You’ll even find schemes that take control of your browser window, directing it to dodgy sites that deploy more sophisticated hacking methods.

Whether it’s a scam, a fake error message, hidden code or malware that automatically launches from an advert, it’s a surefire way for hackers to crack your PC open – and, therefore, get access to your financial information, email accounts and sensitive data.

You may have heard of adware, which is another advert-based infiltration method, but malvertising is different. While adware works by infecting your device and then displaying adverts and messages, malvertising goes the other way and displays adverts first to get inside your system.

How to avoid malvertising

There are loads of different malvertising methods around, but they all concentrate on getting access to your devices, data, bank accounts and personal information – and that’s something that we all want to avoid.

Happily, some easy and effective methods can drastically reduce your chances of being hit by a malvertising attack.

Your first line of defense should be a top-notch antivirus package. If you install a great security suite and ensure it’s always updated and active, you’ll benefit from a huge database that spots and eliminates malvertising and other security vulnerabilities before you’re hit with issues. If you’re not sure which antivirus is right for you, head over to our round-up of the best antivirus software.

You can do other things once you’ve installed a top-tier security package, too. Make sure that you’ve turned off the auto-play options in your browser – deactivate those, and you’ll have to give permission for your browser to play videos, open windows and activate plugins. That’s an easy way to avoid anything you don’t trust.

When those auto-playing items are often the source for malvertising attacks, turning them off is a no-brainer if you want to stay secure.

Get an ad-blocker installed, too. These browser plugins prevent adverts from loading and running on sites across the web. They don’t stop absolutely everything, but they stand in the way of most ads – so it’s a great way to reduce your chances of getting hit by malvertising.

Elsewhere, be careful about what plugins you install on your browser and what apps you install on your PC – make sure you only get them from trusted sources. Install software from sites you don’t recognize and you’re only going to open yourself up to malware issues.

Once you’ve got trusted apps and plugins installed, make sure you keep them up to date so that any security holes are plugged before they can be exploited. Similarly, ensure that you download the latest updates for your operating system for the same reason.

Do all of this and you’ll reduce the number of adverts you see and the chances of getting hit by malvertising, but it’s impossible to eliminate every threat. Because of that, we also advise anyone browsing the web to be suspicious and skeptical about what you see online – if an advert is too good to be true, then it probably is.

Don’t stop there, either. If you’ve got friends or family members who aren’t particularly tech-savvy, then set them up with security software and an ad-blocking tool. Warn them about the dangers of malvertising, and tell them to avoid clicking on pop-ups and adverts when possible.

Instead, if you see an advert with a tempting product or service, use a search engine to navigate to its website directly. Head down that route and you’ll find out if it’s legitimate – and you’ll avoid clicking on the advert and opening yourself up to exploitation.

We've listed the best internet security suites.

There have never been so many different cyber-attack methods – and, arguably, criminals have never been so successful, either. Credential stuffing is one of the latest methods being used by savvy crooks, but if you're on top of the topic you can avoid becoming a victim.

Credential stuffing has become popular as more password databases have been hacked. As billions of usernames and passwords become available on the dark web, criminals take those credentials and try them on different websites – because too many people reuse names and passwords across multiple accounts.

If you or your friends and family members reuse logins and passwords – and we've all done, let's be honest – then you're at a higher risk of falling victim to a credential stuffing attack.

Read on if you want to discover the details behind credential stuffing – and figure out how to avoid becoming a victim. Don't sweat if you need more computing help, either, because we've got you covered with our guides to the best photo recovery apps and a deep dive into the differences between Microsoft 365's business products.

What is credential stuffing?

There are plenty of methods that hackers and criminals use to try and get access to your vital accounts, and many rely on the fact that lists of usernames and passwords are routinely stolen from companies and leaked on the normal internet and the dark web.

Those huge lists of usernames and passwords are the key to credential stuffing. It works because a hacker will take this information and use bots and other automation techniques to try every combination of username and password across different websites, services and social networks.

These bots will often attempt to use different sets of credentials on multiple sites simultaneously to speed up the process, and they're trained to grab sensitive personal data automatically if one of the login attempts works.

It can often be extremely productive, because a hacker already has a list of passwords that have been proven to work at some point in time – and because too many people never change their passwords and reuse their passwords across multiple services.

So, if a hacker is particularly lucky, they'll find a username and password combination that still works across loads of different websites. And if you're the unlucky person who's fallen foul of this approach, that could mean that they've got access to your email accounts, social media pages, bank details and more.

It's a popular approach because credential hacks and leaks have rarely been more popular, with tens of billions of different usernames available online – and because the entire process can be automated.

It's a quicker and more effective process than a traditional brute force attack, which can take a long time because a hacker's equipment needs to power through every possible combination of letters, numbers and symbols. Because credential stuffing attacks use proven passwords, they're often more successful than a dictionary attack, too – just because that method uses common words, it doesn't mean it's going to work.

The combination of huge password leaks, sophisticated bot farms and people's lax password security means that credential stuffing is here to stay – unfortunately.

How to avoid credential stuffing attacks

It's almost inevitable that your usernames and passwords will find their way onto the dark web at some point, but there are sensible steps that anyone can take to avoid falling foul of credential stuffing attacks and other kinds of hacking attempts.

Your first step should be ensuring that you have strong passwords for all your accounts. You should use unique passwords for every service to ensure that a hacker can't use the same details to access different sites.

Alongside creating unique passwords for every service, you should develop longer passwords that use a combination of letters, numbers and special characters in upper and lower case. Avoid words, common phrases, proper nouns and sequential numbers, too, and you'll have a robust password.

That's a lot to remember, so we'd also recommend using a password manager. Deploy one of these tools and you won't have to remember each username and password combination – it'll do it for you, and secure the data behind strong encryption. Don't worry if you're not sure where to start, either – we've already rounded up the best password managers.

A top-notch password manager will also generate secure passwords. The best password managers and security tools also include dark web monitoring that will alert you if your credentials have been exposed in a breach. While that's undoubtedly annoying, alerts mean you'll be able to change your passwords before hackers can exploit the leak.

You might not be able to avoid leaks and hacks forever, but there are steps you can take to ensure your security if the worst happens. If websites, apps and services support it, deploy multi-factor authentication. This security feature demands that you provide extra proof of your identity if you try to log in – sometimes it's fingerprint or facial recognition, on other occasions it comes from external apps and other services text a unique code to your phone.

It's a crucial addition to your security arsenal. If you've got multi-factor authentication turned on, a hacker won't be able to get into your account even if they've used credential stuffing to find the right password – because they won't have the other bit of information or identification that grants access.

We'd also recommend examining the settings on your apps and accounts, because you can often specify that an app demands a password change if you get it wrong a few times in a row. That's a neat way to stop bots from trying to guess your password repeatedly.

Beyond these worthwhile security tips, we also recommend changing your passwords every three or six months. Because while leaks and hacking attempts are inevitable, a credential stuffing bot won't get very far if they're using a password that you've already changed. Many password managers will generate new passwords for you and provide reminders to change them, and lots of tools will also alert users if they've got weak passwords in their database.

Credential stuffing is a nefarious and sophisticated hacking method, and it's not likely to go away any time soon – like brute force and dictionary attacks, they work too often for cybercriminals to leave them behind. But if you're aware of the dangers and you follow these tips, you'll keep your data safe and stop any hacks before they've begun.

We've listed the best internet security suites.