Password managers and crypto: what to store, and what never to

A password manager is one of the best security tools most people can adopt. It generates strong, unique passwords, fills them only on the right sites, and ends password reuse — the habit behind a huge share of account takeovers.

So it's natural to ask: should your crypto secrets go in there too? Some should. One category almost never should. Here's how to draw the line.

What a password manager is good at

• Unique, strong passwords for every exchange, email and service, so one breach doesn't open the others.
• Phishing resistance. A good manager fills a password only on the exact domain it was saved for. If it doesn't offer to fill, you might be on a lookalike site — a free warning sign.
• Secure notes and sharing for things like account recovery codes, with encryption you don't have to build yourself.

For everything that protects an account — exchange logins, email, the password that unlocks your wallet app — it's usually the right place.

The line: accounts vs keys

There's a fundamental difference between these two kinds of secret:

• An account password protects access to a service. If it leaks, the service has other defences — two-factor authentication, withdrawal confirmations, new-device alerts — and you can reset it.
• A recovery phrase or private key is the money. Anyone who has it controls the funds, from anywhere, with no service in between, no second factor and no reset.

A password manager concentrates many secrets behind one master password, usually synced through the cloud and unlocked on everyday devices. That's a sensible trade for account passwords. For a recovery phrase, it turns your highest-value secret into one more entry in a vault that's online, on your general-purpose computer, and one master-password compromise away from exposure.

What to store — and what not to

Reasonable in a password manager:

• Exchange and email passwords.
• Two-factor backup codes for those accounts (ideally in a separate vault from the passwords themselves).
• The password that unlocks your wallet app on a device.
• Notes about your setup: which wallets you use, where your backups are kept — without the secrets themselves.

Keep out of it:

• Recovery phrases (seed words).
• Private keys and extended private keys.
• Photos or scans of recovery phrase backups.

Recovery phrases belong offline, on paper or metal, stored somewhere physically secure. Seed phrase best practices covers the options.

Making the password manager itself strong

If the manager holds your exchange and email passwords, it deserves serious protection:

• A long, unique master password you don't use anywhere else.
• Strong two-factor authentication on the manager account — an authenticator app or security key rather than SMS. Mobile 2FA done right explains the difference.
• Keep the devices that unlock it updated, and be wary of browser extensions you don't need.
• Have an emergency-access plan — many managers support a trusted contact — so your accounts don't die with you.

How this works with SSP

SSP has two kinds of secret, and they map neatly onto this split:

• The passwords that unlock SSP Wallet and SSP Key on your devices. These protect the encrypted keys stored locally on each device. Saving the SSP Wallet password in a password manager is a reasonable choice for many people.
• The two recovery phrases — one for SSP Wallet, one for SSP Key. These are the keys to your vault. Keep them offline, and keep them apart from each other.

The second point matters more with SSP than with a single-key wallet. Your funds need both keys. If both recovery phrases sit in the same password manager, anyone who gets into that manager gets both keys at once, and the 2-of-2 design no longer protects you. Stored separately and offline, a compromise of your computer or your password manager still leaves an attacker one key short.

If your password manager is compromised

1. Change the master password and review the account's sessions and devices.
2. Rotate the passwords for your most valuable accounts first — email and exchanges.
3. If a recovery phrase was ever stored there, treat that wallet as compromised: create a new wallet and move the funds.
4. Check your exchanges for new withdrawal addresses, API keys or settings you didn't make.

The honest summary

Use a password manager — it makes almost every account safer. Put your passwords in it, including the one that unlocks your wallet app. Keep your recovery phrases out of it, offline and, for a multisig like SSP, separated from each other.

The rule is simple: if a secret can be reset, the manager is a good home. If the secret is the money, it doesn't belong anywhere that's online. For the rest of your setup, a crypto opsec checklist is a good next step.