By clicking a retailer link you consent to third-party cookies that track your onward journey. This enables W? to receive an affiliate commission if you make a purchase, which supports our mission to be the UK's consumer champion.
With over a decade of experience at Which?, Tom covers everything from tech advice to money-saving tips, and highlights the best deals during major sales events.
Securing your online accounts with strong, unique passwords is one of the best ways to protect your personal data. But those passwords will only be effective if you keep them somewhere safe.
You might be tempted to save login details in spots that are quick and convenient, such as your phone's notes app, an email or a document on your computer. But if your device is lost, stolen or hacked, those shortcuts could make it much easier for someone else to access your accounts.
Below, backed by advice from the experts at Which? Tech Support, we explain which password storage habits to avoid and how to keep your login details safe.
Pay £49 for a year of our very human tech support and we’ll give you a £10 Amazon.co.uk gift card to thank you for choosing our friendly experts to help you solve your tech issues.
Join Which? Tech SupportOffer ends 16 July 2026, T&Cs apply.
Already a Tech Support member? For more help and 1-2-1 technical advice, including advice on malware and scams, go to our Tech Support online booking tool.
'I have hundreds of passwords for websites, apps and online accounts – and the list is growing.
'At the moment, I save them all in a Notepad (.txt) file on my computer because it's easy to update. But I'm conscious it probably isn't the safest way to keep them. What would you recommend instead?'
Which? Tech Support member
Keeping a list of passwords on a USB drive might seem safer than writing them on paper, but if the drive is lost or stolen, there's a risk that someone else could access your passwords.
Anyone who plugs an unencrypted USB drive into a computer may be able to view the files stored on it. If those files include passwords for your email, banking or shopping accounts, that person could gain access to them.
If you need to store sensitive information on a USB drive, it's worth encrypting it first. That means only someone with the password will be able to open the files.
To encrypt your USB drive, plug it into your PC and follow these steps:
For more step-by-step guidance, including the free software we recommend if you have a home edition of Windows, see our walkthrough on how to password protect a USB stick.
Many people keep passwords in the Notes app on their smartphone. While apps such as Apple Notes let you lock individual notes using your device passcode, Face ID or Touch ID, they aren't designed specifically for managing passwords.
Dedicated password managers can generate strong passwords, autofill them securely and alert you if your credentials are exposed in a data breach. Keep scrolling to find out more about password managers.
If someone gains access to your unlocked phone, they could open any notes that aren't protected. Many notes apps also sync across multiple devices. That's useful if you want to access your notes from your phone, tablet or computer, but it also means the same passwords could be available on every signed-in device if one of your accounts is compromised.
If you keep passwords in Apple Notes, make sure you lock the note by following these steps:
Our guide on what to do if your phone gets stolen explains how to track and protect your phone.
Cloud storage services such as Google Drive, OneDrive, Dropbox and iCloud Drive make it easy to access your files from anywhere. They're great for sharing documents with family, friends or colleagues, but it's easy to forget who can still see a file months or even years later.
A document containing passwords could be shared with the wrong person by mistake, or left accessible through an old sharing link you've forgotten about. Even if you only meant to share one file, the wrong sharing settings could leave it visible to more people than you intended.
If you keep passwords in cloud storage, it's worth checking who can access the file. Remove any people or sharing links you no longer need and, where possible, move your passwords into a dedicated password manager instead.
To review your sharing settings, follow these steps:
Our guide on how to keep your cloud storage files private has more details.
Saving your passwords in a Word document or plain text (.txt) file might seem like an easy way to keep track of them, but if the file isn't protected, anyone who opens it can read everything inside.
They're also easier to find than you might think. If someone gains access to your computer, either because it's been stolen or infected by malware, they could use Windows Search or Finder on a Mac to look for files with names such as 'Passwords', 'Logins' or 'Accounts'. They could also search your files for terms such as 'password', 'username' or 'Pin'.
It's common for people to keep other sensitive information in the same file. Alongside passwords, a criminal might find memorable questions and answers for banking accounts, Pin reminders or recovery codes. This means they may have enough information to access multiple accounts or even impersonate you online.
Leaving your laptop unlocked, even for a couple of minutes, can be enough for someone to access your passwords or copy sensitive information.
Whether you're working in a shared office, a café or at home, it only takes a moment for someone to glance through an unattended laptop. Getting into the habit of locking your screen whenever you step away is one of the simplest ways to protect your accounts and personal information.
To make sure your laptop locks itself automatically, follow these steps:
It's also worth learning the keyboard shortcut to lock your computer instantly. Get in the habit of pressing Windows + L on a Windows PC or Control + Command + Q on a Mac whenever you step away from your desk.
You might save passwords in an email to yourself or an email draft as a quick reminder, but your email account is one of the most valuable targets for cybercriminals. If someone gains access to it, they may find passwords or other login details. They could also use it to reset passwords for your other online accounts.
Instead of storing passwords in your inbox, delete any emails containing login details once you've finished using them and save the information in a trusted password manager instead.
If you think you've emailed yourself passwords in the past, spend a few minutes searching your inbox for terms such as 'password', 'login' or 'username', as well as the names of your most important online accounts. Delete any messages you no longer need.
A compromised inbox puts your personal data at risk, so find out what to do if your email has been hacked.
'Trying to remember dozens of strong, unique passwords isn't realistic for most people, which is why a password manager is one of the safest and simplest options.
'Instead of keeping passwords in notes, emails or documents, a password manager stores them in an encrypted vault that's protected by a single master password. Most password managers can also generate strong, unique passwords for every account and fill them in automatically when you sign in.
'If you're already using antivirus software, it's worth checking whether your subscription includes a password manager. Some packages include one as part of the service, although the features can vary. Just bear in mind that if you later switch antivirus provider or let your subscription expire, you will need to move your saved passwords to another password manager to avoid losing access.
'To see which antivirus packages we recommend, including those that come with a built-in password manager, see our guide to the best antivirus software.'
Callum Pears, Which? antivirus software expert
Find out which password managers our Tech Support team recommends – see how to create a secure password.
Pay £49 for a year of our very human tech support and we’ll give you a £10 Amazon.co.uk gift card to thank you for choosing our friendly experts to help you solve your tech issues.
Join Which? Tech SupportOffer ends 16 July 2026, T&Cs apply.
Which? Tech Support can help you keep on top of your home tech. Our experts explain things clearly so that you can resolve issues and feel more confident using your devices.
Get unlimited 1-2-1 expert support:
Join Which? Tech Support.
