You have probably been told never to write a password down. For most people at home, that advice causes more harm than it prevents. This guide is part of our guide to passwords for families and digital legacy.

Think about who you are protecting against

Most password attacks come from far away: bots, credential stuffing and phishing. A burglar is unlikely to care about your notebook. So a paper list of long unique passwords can beat a memorized weak one that you reuse everywhere.

A password manager is still better for most people. It fills in passwords for you, works on every device, and helps block fake sites. But paper is a good option for people who will not use one.

When paper is fine

  • You live alone, or with people you trust.
  • You keep it hidden at home.
  • You use a different password for each account.
  • You are backing up a master password or emergency kit.

When paper is a bad idea

  • At work, on a sticky note or under a keyboard.
  • In a wallet or handbag, along with your ID.
  • In a home with people you do not trust.
  • In a house with frequent visitors, if it is left out.
  • In any photo. Photos sync to the cloud.

How to do it well

  1. Use a small notebook, kept only for this.
  2. Avoid labeling it "passwords".
  3. Write the site and username, and use a strong, unique password for each.
  4. Print clearly. Mistakes between O and 0 matter.
  5. Keep it in a locked drawer or safe.
  6. Note where it is in your digital legacy plan, without writing out the passwords.

A simple trick: leave part of it out

Some people write down all but a short piece that they remember, such as a suffix added to each. This helps if the notebook is stolen. Use it only if you are comfortable with it, and do not depend on it alone.

Paper is different for crypto

For a crypto recovery phrase, paper is the recommended starting point, because it stays offline. The stakes are higher, though, so follow how to write down a seed phrase correctly.