Getting started with Inlockly
From creating your account to your first automatic sign-in. Eight steps, about fifteen minutes, and your vault is ready for everyday use - on your computer, your phone, and in your browser.
Resources · Guide
Password management: how to protect your accounts at home and at work
Passwords are still the most common way into other people's accounts. This guide shows how criminals get them, what a truly good password looks like, where to keep it, and how to set sensible rules - at home and at work.
Contents
- Why passwords are still a problem
- How criminals get passwords
- What a truly strong password looks like
- One account, one password
- Where to keep your passwords - a comparison
- How a password manager works (and why you can trust it)
- Two-step verification: your second line of defense
- What to do when a password leaks
- Passwords in the family
- Passwords at work: rules that actually work
- Checklist: 10 steps to get your passwords in order
Why passwords are still a problem
Plenty of new security measures have appeared in recent years, yet passwords remain attackers’ main target. According to Verizon’s Data Breach Investigations Report 2025, 22% of analyzed breaches started with the use of stolen credentials. In its Digital Defense Report 2025, Microsoft says more than 97% of identity attacks are password attacks - mostly large-scale attempts to guess them.
The reason is simple: the average person has dozens of accounts, and a company has hundreds. Nobody can remember a hundred unique, random passwords. So most of us take shortcuts: one password with variations, a sticky note, a spreadsheet, a message to a coworker. Every one of those shortcuts is exactly what criminals are counting on.
The single most important idea in this guide: you don't need to remember lots of passwords. You need one really good password and a tool that remembers the rest.
How criminals get passwords
Understanding how attacks work makes it easier to choose your protection. The most common ones:
- Breaches and credential stuffing. When one service’s database leaks, email addresses and passwords end up on lists that bots try on hundreds of other sites. If you use the same password for an online store and your email, a breach at the store opens your email.
- Phishing. A fake page for your bank, a delivery company, or “the IT department” asks you to sign in. It looks convincing, but the address is off by one letter.
- Guessing and brute-force attacks. Programs try common passwords, dictionary words, and their variations (“Summer2025!”). Short, predictable passwords fall in minutes.
- Malware. Keyloggers record your keystrokes, and infostealers copy passwords saved in browsers.
- Information about you. Your kid’s name, your dog’s name, or your favorite team - many passwords can be guessed from social media.
We cover attacks on businesses in more detail in Data breaches at work: causes, consequences, and how to protect your company.
What a truly strong password looks like
For years, we were taught that a strong password is a short string with a capital letter, a number, and an exclamation point. Today we know that length and randomness matter more than “special characters.” The current guidelines from the U.S. National Institute of Standards and Technology (NIST SP 800-63B) recommend long passwords, checking them against lists of breached passwords, and moving away from forcing complicated rules.
| Password | Rating | Why |
|---|---|---|
Jessica1985! |
Very weak | A name and a year - a typical pattern, easy to guess |
P@ssw0rd2025 |
Weak | A common word with “substitutions” every program knows |
trolley-tomato-evening-lantern |
Good | A long phrase of random words, easy to remember |
r7#Vq2!mLx9$Tz4@pW |
Very good | Long and random - ideal when a password manager remembers it |
In practice, two rules are enough:
- Your master password (the one you remember) - a long phrase made of several random words.
- Everything else - random, long, and generated by a tool. You don’t need to know them.
A password generator on every plan, including Free. Inlockly creates random passwords from 5 to 64 characters and saves them straight to your encrypted vault.
One account, one password
If you remember only one rule from this guide, make it this one: every account gets its own password. Uniqueness protects you from the most common scenario - a breach at a service you have no control over. When the password for an online store opens nothing but that store, a breach is a nuisance, not a disaster.
Be especially careful to keep these passwords unique:
- your email - it’s how you reset the passwords to everything else,
- banking and payments,
- accounts you use to sign in elsewhere (Google, Apple, Microsoft, Facebook),
- work accounts and admin dashboards.
Where to keep your passwords - a comparison
| Method | Convenience | Security | Main risk |
|---|---|---|---|
| Memory | Low with many accounts | Depends on you | Leads to reusing passwords |
| Sticky note or notebook | Medium | Low | Getting lost, a photo of your desk, no backup |
| Spreadsheet or phone note | Medium | Very low | An unencrypted file, copied and shared |
| Browser | High within one browser | Medium | One ecosystem, a target for data-stealing malware |
| Password manager | High everywhere | High | A weak master password - which is why 2FA matters |
Browsers are a sensible start, but a password manager works in every browser and app, has a separate vault lock, 2FA codes, and secure sharing. We go through the comparison in detail in Browser passwords or a password manager?
How a password manager works (and why you can trust it)
A good password manager uses a zero-knowledge model: it encrypts your data on your device before anything reaches the cloud, and the key is derived from a master password the provider never knows. In Inlockly, it works like this:
- Argon2id derives a key from your master password - the password itself never leaves your device,
- AES-256-GCM encrypts every item with a random vault key,
- RSA-OAEP protects the keys to shared family or company vaults as they’re passed between people,
- the server only stores encrypted content and syncs it between your devices.
The result: even if someone stole data from the server, they’d get encrypted noise. The details are in our security model and Security Whitepaper.
Day to day, a password manager is simply convenient: it saves your password when you sign up, suggests it when you sign in, and won’t fill it in on a fake site, because it matches your data to the site’s address.
Try Inlockly with your own passwords. Importing from your browser or another password manager takes a few minutes and is available on every plan.
Two-step verification: your second line of defense
Even the best password can leak. Two-step verification (2FA) means a password alone isn’t enough to sign in. The most popular methods, from weakest to strongest:
- SMS - better than nothing, but vulnerable to number hijacking (SIM swapping),
- email code - good, as long as your inbox is well protected,
- authenticator app (TOTP) - a code that changes every 30 seconds, generated locally,
- hardware key (such as a YubiKey) - a physical device that’s highly resistant to phishing.
Turn on 2FA at least for your email, your banking, your Google/Apple/Microsoft accounts, and your password manager. More and more services also offer passkeys - passwordless sign-in based on cryptography and your device’s biometrics. Where available, they’re worth considering.
In Inlockly, you can keep 2FA codes with your logins (Personal plan and up): the code fills in after the password, and a shared company account with 2FA isn’t tied to one person’s phone. More in 2FA codes: why they matter and how to store them.
What to do when a password leaks
Got a breach alert, or seeing a sign-in you don’t recognize? Act in this order:
- Change the password for the affected account - to a new, random, unique one.
- Change it everywhere you used the same or a similar password. A password manager saves you hours here.
- Sign out other sessions in your account settings and check the device list.
- Turn on 2FA if it wasn’t on already.
- Check your email: forwarding rules, filters, and recovery addresses - attackers often change them.
- Watch out for phishing impersonating the service that was breached.
SafetyMeter™ in Inlockly (Personal plan and up) flags passwords that are weak, reused, or have appeared in known breaches - before anyone can use them.
Passwords in the family
Families share lots of accounts: Wi-Fi, streaming services, bills, kids’ school accounts. A few rules that work at home:
- Shared accounts go in a shared vault, not on the fridge or in the family group chat.
- Everyone at home has their own account and private passwords. Shared doesn’t mean visible to everyone.
- Kids learn from a good example. Instead of “make up a password” - a generator and a password manager.
- Set up 2FA for older parents and help them with the first setup - they’re the group most often targeted by phishing.
The Inlockly Family plan gives you up to 5 accounts with all features, a shared vault with permissions (for example, view-only for kids), and an admin dashboard that can restore a family member’s access to family data if they forget their master password. See Inlockly for families →
Passwords at work: rules that actually work
At work, passwords stop being a private matter - one compromised account can open access to email, invoices, customer data, and systems. A good password policy is short and doable:
1. A password manager instead of a spreadsheet
Keep company logins in shared folders with permissions, not in a file on the shared drive or in a chat. Everyone sees only what they need for their job.
2. Long, unique passwords and 2FA on critical accounts
Following NIST: instead of fancy rules and monthly changes - long passwords, checks against breach lists, and changes when there’s a reason. On email, banking, your domain registrar, and admin accounts, 2FA is mandatory.
3. The least privilege needed
An intern doesn’t need the online banking password. Grant access by role or department, and where possible, let people sign in without seeing the password.
4. Onboarding and offboarding as a process
New hires get their department’s access on day one, and people who leave lose it the moment they go. After someone leaves, change the passwords to the accounts they used - the activity log shows which ones.
5. An audit trail
Who changed the ad account password? Who shared a login with a contractor? Change history and an activity log answer those questions in seconds.
6. Working with people outside the company
Share passwords with your accountant, a repair technician, or a freelancer with a link that expires, not by email. A longer-term contractor gets access to a single folder, revoked when the project ends.
Inlockly for business. Shared folders with 13 permissions, departments, an activity log, admin-assisted access recovery, and zero-knowledge encryption. Data stored in the EU.
Checklist: 10 steps to get your passwords in order
- Choose a password manager and set a long master password in the form of a phrase.
- Save your recovery key somewhere safe, outside the vault.
- Import your passwords from your browser and other places, then delete the old copies.
- Turn on 2FA for your password manager and your email.
- Change your email password to a random, unique one.
- Check for weak, reused, and breached passwords, starting with your most important accounts.
- Use the generator for every new account.
- Move your family’s or team’s shared passwords into a shared vault.
- Share passwords with outsiders using a link with an expiration date.
- Once a quarter, look at your password security report and fix whatever needs attention.
Done with the first steps? Our Getting started with Inlockly guide walks you through setup in about fifteen minutes.
The Inlockly team
We write about password and data security the same way we build our app: practical, no scare tactics, no jargon.
Guides
Masz pytania?
Zacznijmy tutaj.
How often should I change my passwords?
When there's a reason: a breach, a suspected account takeover, or someone who knew the password leaving. Routinely changing passwords every few months for no reason does more harm than good, according to NIST guidelines, because it leads to predictable variations.
Isn't a password manager putting all my eggs in one basket?
It's a basket locked with a key that nobody but you has. Your vault is encrypted on your device, and access is protected by your master password and a second factor. The alternative - reused passwords or a spreadsheet - is lots of baskets with no lock at all.
Are passwords saved in my browser safe?
They're better than one password for everything. Their limits are being tied to one ecosystem, having no separate vault lock, and being a popular target for data-stealing malware.
Where should a company start?
With an inventory of shared accounts, a password manager with folders and permissions, and 2FA on critical accounts: email, banking, your domain, and admin accounts.