We've all been there. You're trying to log into an account you haven't visited in months. You confidently type your password...and it's wrong. No problem. You've got tons of classics to pull from, so you try another. And another.
...Still wrong.
Eventually, you get fed up enough to click "Forgot Password?" and now you're stuck waiting for the reset email to arrive. You wonder how you managed to forget another password and if you'll even remember changing this one, because every app and website demands a unique password, and it's become near-impossible to keep track of them all. Many of us simply have no passwords left to give.
For attorneys, this scenario is especially familiar. Between court filing systems, practice management software, bar association websites, email, banking, Microsoft 365, CLE providers (hello!), and countless other online services, the average lawyer manages dozens (if not hundreds!) of passwords. Remembering them all isn't realistic anymore. Fortunately, it doesn't have to be.
Whether you're looking to save time, reduce frustration, or better protect sensitive client information, a few simple changes can make password management significantly easier.
Stop relying on your memory. If you're still trying to memorize every password, you're making life harder than it needs to be. Passwords have become longer, more complex, and less memorable. Instead of asking your brain to do all the work, let technology handle it for you. Even if you are planning to attend our upcoming webcast "Winning Your Case with a Better Memory," this is one task that can be successfully outsourced so you have one less thing weighing on your mind.
Password managers securely store your login credentials in an encrypted vault. You only need to remember one master password, while the software remembers everything else. Even better, most password managers can automatically fill in your credentials and generate strong, unique passwords whenever you create a new account.
Most password managers follow a similar setup process. First, create an account and choose a strong master password, one that you can remember. Then begin manually adding the websites and services you use most often such as your email, banking, and court filing systems. Many of these password managers also offer browser extensions that recognize login pages and automatically suggest saved credentials or prompt you to save new ones as you create accounts. Over time, your password vault will grow until it becomes your go-to resource for every login. You'll simply need to remember your one master password, and you'll be good to go. Just don't forget to set up account recovery options in case you do happen to forget that password. Most password managers allow you to add a recovery email, mobile phone number, and other verification methods so you can safely and easily regain access if you happen to forget your master password or purchase a new device. Spending a few extra minutes to set up recovery settings will save you from a major headache down the road.
There are many reputable password managers available, each with different features and pricing. Popular options include Keeper, 1Password, Bitwarden, Dashlane, and NordPass. Apple users can also take advantage of iCloud Passwords, while Google Chrome and Microsoft Edge offer built-in password management features too. Pick one the that's most convenient for you, that best fits your needs, and you know you'll use every day.
Every account deserves its own password. It may be tempting to reuse the same password across multiple websites. After all, it's easier to remember, right? Unfortunately, it's also one of the biggest security risks.
If just one website experiences a data breach, cybercriminals often try those same login credentials on dozens of other websites. If you've reused the password, multiple accounts could be compromised before you even realize what's happened. Unique passwords dramatically reduce that risk, and thanks to password managers, you don't have to remember any of them yourself. So be sure to follow this golden rule for the safety of yourself, your firm, and your clients.
Turn on multi-factor authentication whenever possible. Think of multi-factor authentication (MFA) as a second lock on your front door. Even if someone manages to obtain your password, they'll still need a second form of verification before they can access your account. Many websites send a one-time code via email or text message, but an authentication app—such as Microsoft Authenticator, Google Authenticator, or Authy—is generally considered even more secure.
Why is it so effective? Imagine someone steals your password. Without MFA, they could immediately access your account. But with MFA enabled, they would need your phone or authentication app to complete the login. It's a simple extra layer of security that dramatically reduces the chances of unauthorized access, even if your password is compromised. It takes a few extra seconds to log in, but those few seconds can make a tremendous difference in protecting your accounts.
You can usually enable multi-factor authentication in an account's settings or might receive the offer to set it up at login. You'll typically be prompted to choose how you'd like to receive your verification codes. Many websites offer text messages, but the aforementioned authentication apps are often preferred because they generate secure codes directly on your phone that only last for a short period of time (around 30 seconds). Simply scan a QR code or link the accounts and it should be good to go.
Meet the passkey. If you've noticed some websites asking whether you'd like to sign in with your fingerprint, facial recognition, or device PIN instead of a password, you've already encountered a passkey. A traditional password is something you know, a word or phrase you picked out to type each time you sign in. A passkey verifies your identity using something you have rather than something you know. There's no password to steal, guess, or accidentally reuse across multiple websites. Today's technology need only glance at your face through the camera or read your fingerprint to grant you access.
Passkeys are becoming increasingly common because they're both more convenient and more secure than traditional passwords. Passwords aren't disappearing overnight, but passkeys are quickly becoming the future of online authentication. Whenever you have the option, they're worth considering.
Watch out for phishing scams. Sometimes the weakest link isn't the password itself...it's our own lapse in judgment. In other words, it's being tricked into giving it away. So always take a closer look before you click, especially if something seems fishy.
Cybercriminals regularly send emails or text messages that appear to come from trusted organizations or even people you know, urging recipients to reset a password or verify an account. Before clicking a link or opening an attachment, pause for a moment and ask yourself whether the request makes sense or if the email looks legitimate. Take a few seconds to inspect the sender's actual email address, not just the display name. Though the message might appear to have come from "Microsoft Support," "Paypal," or your bank, the underlying email address could reveal obvious warning signs such as misspellings, extra numbers, or unfamiliar domains. This is a major red flag.
When in doubt, trust your instincts and navigate directly to the organization's website to log in there instead of following a link in an email. That extra step can help protect both your personal information and your clients' confidential data.
Avoid these common password mistakes. Good password habits aren't just about what you should do, but also about what you should avoid. Writing passwords on sticky notes attached to your monitor, storing them in an unencrypted spreadsheet, sharing them through email, or choosing easily guessed passwords like birthdays or pet names may seem harmless, but they can create unnecessary risks. A little organization goes much further than a little convenience. Since you'll be letting technology do the remembering for you, don't hesitate to create complicated passwords.
Build your system one login at a time. Looking at years' worth of scattered passwords can feel overwhelming. The good news is that you don't have to fix everything today. Start by choosing a password manager and saving every new password you create. Then, each time you log into an older account, update that password to something strong and unique before saving it in your vault. Within a few months, you'll have replaced many of your old passwords without setting aside an entire weekend to tackle the project.
Passwords are an unavoidable part of modern life, but frustration doesn't have to be! By creating a system that works for you and letting technology handle the brunt of it, you can spend less time resetting passwords and more time focusing on what really matters.
The only thing attorneys should have to memorize is great legal arguments—not their 87 different login credentials.
