Why You Should Never Keep Passwords in a Plain-Text Note

Plain-text notes are wonderfully convenient, which is exactly why people are tempted to keep passwords in them. It's a habit worth avoiding.

Why it's risky

• Anyone with access to your phone or file can read it. A plain-text file has no protection of its own.
• Backups spread it. Copies of your notes may end up in cloud storage, email or other devices.
• Sharing by accident. It's easy to send the wrong file or paste the wrong text.
• Lost or stolen devices. If your phone is taken, the passwords are exposed.
• Malware. Malicious software can look for files that contain passwords.

Safer alternatives

Option	Notes
A password manager	stores passwords in an encrypted vault protected by one strong master password
Your browser or phone's built-in manager	convenient and encrypted, protected by your device lock
Two-factor authentication	adds a second step, so a stolen password isn't enough
Passkeys	a newer, password-free login method that some services offer

Better password habits

1. Use a different password for every account. If one leaks, others stay safe.
2. Make passwords long. A long passphrase of several unrelated words is strong and easier to remember than random symbols.
3. Turn on two-factor authentication for email, banking and other important accounts.
4. Never share passwords by message.
5. Use a screen lock on your phone.
6. Change passwords if you suspect a leak.

If you must write something down

• Prefer paper, kept in a safe place, over a plain-text file.
• Never store banking passwords or recovery codes in plain text.

What plain text is good for

Plain-text notes are great for recipes, lists, ideas, drafts and code. They are not the right place for secrets.

Recovery codes

Recovery codes for accounts are as sensitive as passwords. Store them in a password manager, or print them and keep them safe.