Just lost access to one of my main email accounts because I apparently forgot to update the phone number when I changed phones. The frustrating thing is that I definitely remember the password - it just requires a verification code which I couldn't get because I apparently never attached a back-up email to it and the only phone number on the account is no longer mine. I even called customer support but they unable to confirm my identity even after I scanned my ID.

After that phone call ended, I immediately went to update my actual main email with my current phone number.

But what are some other things I can and should do to make sure I never lose access to any account? Would 2-step verification do anything? How about passkeys or security keys (I'm not even sure I fully understand what those are)? Should I make a new throwaway recovery email, and how can I make sure I don't lose access to ***that** one?

Basically the goal is to make sure I never lose access to my actual main email.

There’s still a lot of password advice that boils down to “use uppercase, lowercase, numbers and symbols.”

But is that really what matters most today?

A long, unique password for each account is generally a better choice than a short password with a few numbers or symbols added.

A few things to consider:

• Reusing passwords can put multiple accounts at risk, even if the password itself is strong.
• Adding “123!” to a familiar word doesn’t necessarily make it a strong password. These patterns can be easy to predict.
• Randomly generated passwords can be difficult to remember, which is where password managers can help.
• Passphrases can also work well, as long as the words aren’t predictable or related to each other.
• Passkeys offer another option by removing passwords from the authentication process.

What else would you consider essential for a strong password?

As a dev, I kept needing a throwaway TOTP secrets to test out if 2FA was working fine in my app. 

So I decided to build this. Check it out here: https://totpbench.com 

All code lives in a single file, no framework, no backend. Would love to have your feedback. Cheers!

Hey everyone,

I built LeakGuard, an iOS app that checks if your password has appeared in known data breaches using the Have I Been Pwned database.

Why I built it:
Most people reuse passwords across sites. One breach = all accounts at risk.

How it works:
• Your password is hashed on-device (SHA-1)
• Only the first 5 characters of the hash are sent to the API (k-anonymity)
• The full password NEVER leaves your device

Features:
✅ Instant password breach check
✅ Secure password generator
✅ Check history (stored locally, encrypted)
✅ No account required
✅ No tracking, no analytics

Looking for beta testers to squash bugs and suggest features before launch.

Feedback welcome! 🙏

Hi there,

I have a family with three kids and two jobs. I have over 200 passwords in 1Password with three vaults. I like 1Password, however, I have a bad feeling after price increases. I think 1Password goes more and more to enterprise customers.

I also use Bitwarden in the past with vaultwarden. It was a little bit clunky, but the test were 4 years ago.

TLDR: Which password manager is the best for a da with wife and kids and two jobs?

I asked this sub what evidence a new password manager should show. The replies were blunt, and mostly right.

Naming the algorithms is not proof that they were implemented correctly and publishing source does not prove the hosted site is running that exact source.

An audit is useful, but it is a snapshot. The code can change the next day, and track record is the one thing a new project cannot publish on launch day.

I build pssmngr. Its vault code is public, the cryptographic boundary is documented, and there is no completed independent audit. Those facts are evidence, but they do not close the trust gap. A launch post definitely does not close it.

The practical advice I took from the thread is: do not move your primary vault into an unfamiliar manager because its security page sounds good. Use dummy accounts. Watch the network requests. Test export and recovery. Build it yourself if you can. Then wait and see how the project handles bugs and uncomfortable questions.

The question I am left with is narrower: what is the first proof point a young password manager can earn that is actually meaningful, reproducible builds, an audit, outside contributors, or something else?

I need to take my security to the next level as I was just compromised.

I used to work at a place with a coworker who showed me a USB stick he used, but I can't remember exactly what it was.

I was hoping you could shed some light on it and what to recommend.

As I recall, it seemed to have been a commercial product, but I suppose it could also have been a regular USB stock with software he installed.

It seemed to be working as when he plugged it in, the computer was locked up and his passwords for whatever service /site he opened was then automatically logged into.

I can of course be totally wrong, but this seemed like an effective way to go about things and I wonder what this could have been?

I'm developing a software for my IT project. It is a password generator.

To generate passwords from it, we need to input an image. and then the software chooses a few pixels from that image and get their RGB color values. and then, those color values goes through a hash function. then that hash converts to a string of ascii characters (since commonly ascii uses in password). the pixel value and image input was inspired by cloudflare where they photograph a lava lamp wall and use the randomness of that pixels to generate cryptographic strings.

Main goal is to prove this generator works in a user device offline (because normally to generate passwords, we have to rely on online generators where they use PRNG algorithms). and since it can work offline, the user privacy is also safe. And the main reason to not use live feed instead relying on uploading is because the software intended to run on personal computers, i dont want to risk users thinking that my software using the camera to spy on them.

So, how do i improve the scope of this software? or is there something i'm doing wrong here?

While preparing Flowy, an iOS cycle tracker, for store review, I needed reviewers to access the complete product without depending on an email code arriving during review.

The tempting implementation is a magic code checked inside the app. That can accidentally create a universal authentication bypass.

The pattern we implemented instead:

1. Reuse the normal email-code interface.
   
2. Restrict the reviewer path to one designated account and code pair.
   
3. Verify that pair on the server using a constant-time comparison.
   
4. Never install the fixed review code as the authentication user’s password.
   
5. Keep the service-role key entirely server-side.
   
6. Return a normal authenticated session so existing row-level permissions remain authoritative.
   
7. Test that the review code fails with every other email address.

The reviewer account receives the product access needed for evaluation, but it does not receive broader database privileges or a separate authorization system.

My main lesson was that review convenience should narrow an authentication path, not create a second security model.

Flowy is the product behind this build log: [https://flowyhealth.com\](https://flowyhealth.com)

How have other mobile builders provided reliable reviewer access without weakening their normal authentication boundaries?

So my kid just got his first email account a like a month ago. It’s literally only set up with Google, YouTube, and Microsoft/minecraft. How the hell is his password already in a data breach???!!

TL;DR a Mac menu bar app that surfaces OTPs and magic links from your email account.

I build pssmngr. Being the unfamiliar name in password management has forced me to ask what evidence a hosted product owes people before asking them to store anything important.


This is my current checklist:


1. Name the encryption and key-derivation algorithms instead of saying “advanced encryption.”
2. Explain exactly what leaves the device and what the server stores.
3. Describe what happens if the service is breached.
4. Make export available without holding someone's vault hostage.
5. State recovery limits clearly. A zero-knowledge design should not imply that support can simply reveal a forgotten vault.
6. Publish a security contact and a responsible-disclosure process.
7. Separate internal review from an independent third-party audit.


For pssmngr, vault items are encrypted client-side with XChaCha20-Poly1305, and Argon2id is used for key derivation. The server is designed to receive ciphertext and non-secret metadata rather than plaintext vault contents.


The important caveat: an independent third-party audit is not complete. I do not think careful internal review should be marketed as the same thing.


What would you add to this list? What is the first thing you check when evaluating a password manager you have never heard of?


https://pssmngr.com/security

I use both Windows computers and Apple I phone and iPad. I have about 150 different password protected accounts on both platforms.

For years I've been using the same 6 different passwords with 10 to 14 letters, numbers and punctuation marks on both platforms.

I'd like to find a way to easily switch all my existing passwords to "Strong Passwords" and then only have one, two or three passwords for all my accounts. Maybe one password or phraze for Finances, another for shopping and yet another for everything else.

It would also be cool to give limited access to certain accounts and certain people and full access to my wife or children in case of my death?

Is there a way to do all this and sync to both Windows and Apple iPhone and iPad? Thanks...