Family passwords: which to share, where to keep them and how to stop sending them in chat

A family shares more passwords than you'd think: home Wi-Fi, the streaming service, the school's online register, the electricity and gas accounts, the health portal, the online supermarket. And they're almost always shared in the worst way: a chat message, a note on the fridge, "it's the dog's name and the year we were born".

Organising them well doesn't require becoming a security expert. It requires deciding what to share and where to keep it.

Why chat doesn't work

• it stays forever in history and backups, sometimes on several devices
• it gets forwarded by mistake
• it doesn't update: when a password changes, the old one lingers and confuses
• anyone with access to the phone can find it

1. Separate family and personal

Not every password needs sharing. A simple split:

• family: Wi-Fi, streaming, utilities, school, children's health, insurance, services both use
• personal: email, personal banking, social media, work

In KidBox Passwords each login is saved as family or personal. Family ones are encrypted with the family key and visible to members; personal ones use a key derived from your identity, so not even other family members can read them.

2. One place, encrypted

The principle is the same as for documents: one place, encrypted, accessible to those who need it. For each login: site or service, username, password, and a note if helpful — "account is in Mark's name", "customer code on the bill".

3. No more copy and paste

A password you have to copy by hand is a password that ends up on a sticky note. With AutoFill on, on iPhone and Android KidBox fills the login straight into the site or app, without copying.

4. Strong passwords, at last

Family passwords are weak because two people have to remember them. Once they're saved and fill themselves in, nobody needs to remember them: you can use long, random passwords created with the generator.

5. The security check

It's worth checking periodically which passwords are weak, reused across services or exposed in known data breaches. KidBox's audit does this without ever sending passwords in plain text: for breaches it uses Have I Been Pwned with k-anonymity, sending only a small part of the password's hash.

6. When things change

• password change: update it in the one place, and the other parent has the new one immediately
• babysitter or grandparents: Wi-Fi can be given verbally or on a card; other logins stay in the family
• a cancelled service: delete the login, so the list stays clean

The main account, well protected

All this works if access to the app is well protected: a strong, unique password for the account, and a screen lock on the phone. It's the key to all the others.

In short

Separate family passwords from personal ones, keep them in one encrypted place instead of chat, let them fill in automatically, use strong generated passwords, check periodically for weak or breached ones and update everything in one place. And protect the account that holds them.