Password manager vs paper: is it safe to write your passwords down?

Most people have too many passwords to remember, so they either reuse the same few or write them down. Neither feels great. So which is safer: a notebook in a drawer, or an app that stores them all?

The short answer: at home, a password book kept somewhere secure is better than reusing passwords. At work, use a business password manager, and turn on passkeys and multi-factor authentication wherever you can.

At a glance

	Paper (password book)	Password manager
Can be hacked remotely	No	Very hard: vaults are encrypted and protected by MFA
Can be lost or seen	Yes, and anyone who finds it can read it	Lost phone or laptop still needs your master password
Strong, unique passwords	Only if you make them up yourself	Generated automatically
Spots fake websites	No	Yes: it won’t fill in your password on a lookalike site
Shared safely with colleagues	No	Yes, with access you can remove
Backed up	No	Yes
Works when someone leaves	No way to revoke	Remove their vault access in one step, then change the shared passwords they saw

The case for paper

Paper has one real strength: it can’t be hacked over the internet. The UK’s National Cyber Security Centre says writing passwords down can be done safely in some situations, because an attacker would need to get into the room where they are kept. The far bigger danger is reusing the same password everywhere.

So for personal accounts, or for someone who isn’t comfortable with apps, a password book kept somewhere secure at home, away from visitors, is a reasonable choice. A sticky note on a monitor is not.

Why paper fails at work

At work, paper breaks down quickly:

• It can’t be shared safely. Teams need shared logins for suppliers, social media and systems. Passing a notebook around, or photographing a page, isn’t control.
• It can’t be revoked. When someone leaves, every password they wrote down has to be changed, and in practice it rarely is.
• It can’t be backed up. Lose the book and you’re locked out of everything.
• It doesn’t stop phishing. A fake login page looks real to a person. A password manager won’t fill in your details on a site it doesn’t recognise.

What a business password manager gives you

• A unique, strong password for every account. A leak at one supplier doesn’t unlock your other accounts.
• Shared vaults for team logins. Access is granted and removed centrally.
• Quick offboarding. When someone leaves, you remove their vault access in one step, and the manager shows which shared passwords they had access to. Change those: removing access doesn’t make anyone forget a password they’ve already seen.
• Warnings. It flags weak, reused or breached passwords.

What has changed since we first wrote this

• Passkeys are replacing passwords. A passkey lets you sign in with your fingerprint, face or PIN instead of a password, and there’s nothing for an attacker to steal or phish. Microsoft, Google and Apple all support them. Where an account offers a passkey, use it.
• Multi-factor authentication matters more than storage. A second step, like an app prompt, a code or a security key, makes a stolen password far less useful on its own. Turn it on for every business account.
• AI makes phishing more convincing. Fake login emails are now well written and personalised. A password manager that refuses to fill in a lookalike site is one of the few defences that doesn’t rely on someone spotting the fake. See phishing email examples and training.

How Jera can help

We set up multi-factor authentication and passkeys for teams across Edinburgh, Glasgow and Aberdeenshire, as part of our cyber security work. Still sharing logins from a notebook? Book a call and we’ll talk through moving them somewhere you can control.