The 'most secure' (ie most risk mitigation) is not always the best security decision. Sure, both options are weaker than pure random passwords for every site with no record linking them anywhere, but they are also far more useable and balancing usability and risk mitigation is a big part of security. If you are using OAuth, then only one place has to be changed to actually change all the login credentials. Using a keystore means that normally only single passwords would have to be changed for a compromised site and if your keystore is compromised, you have documentation of all the accounts that you have that need changing. If I have a different password everywhere and/or use a single set of credentials through the use of something like OAuth, then the surface area of attack is limited to the single OAuth provider or keystore. If I use my same password on every site I visit, if ANY of those sites is compromised, now all sites are compromised. Thus, the surface area to attack is MUCH larger. Yes, one problem is that if one password gets figured out, then it gives much more access as a single point of failure, but the bigger problem is that the same password is stored in many different places. There are two primary problems with sharing passwords for multiple accounts. Password renewal is like protesting against the ambient wetness while on board the Titanic. Also, the possibility of an attacker stealing your master password is already serious enough: if the attacker got to that point, you are already in deep trouble. Changing your master password may 'kick out' attackers would could steal your master password, but this would not change the site-specific passwords stored in the password manager, so the attacker is not totally evicted. Password renewal is a controversial issue. The usual rules for password hygiene still apply: generate your password(s) with randomness, not wit don't type a password on a machine which could be infected with a key logger beware of shoulder surfers.

15 random letters and digits ought to be enough to thwart CPU-based attackers: if your password gets stolen, it will not be through a brute force attack. To live with that, make your master password strong enough to deter attacks. This is unavoidable: I am just stating the obvious, twice, with two slightly distinct points of view. But this means that knowing that one password is sufficient to gain access to all the stored passwords. With a password manager, it suffices to remember one password to gain access to all the others. A password manager is a tool to 'remember' more passwords than what the human mind can cope with. Use a password manager like LastPass to save your passwords, it keeps your information protected from attacks or snooping.This concentration of password power is consubstantial with the concept of a password manager.Update passwords after every three months.Avoid using similar passwords that change only a single word or character.Share your sensitive information with friends and family through LastPass’ secure password sharing. Never share your passwords via email or text message.

When you create a password on your own, use random characters, but don't follow easy-to-recognize patterns – e.g.

Avoid password reuse with the security dashboard, which alerts you to take proactive action when you’ve reused a password or created a weak one.

Don’t use any personally identifiable information in your passwords.

Make sure your passwords are at least 12 characters long and contain letters, numbers, and special characters.

LastPass will generate a unique password for each account you create.

With the LastPass built-in password generator you don’t need to fuss with thinking of new passwords.

Take action and improve your defense against them. Phishing, stolen credentials, and human error challenge your password security.

Lastpass renewal discount