Everyone is aware that selecting passwords wisely and safeguarding them should be an important priority, yet most people need to remember so many passwords that it's nearly impossible to do so. Because of the need to recall dozens of passwords and keep up with their rotation many people are forced to use insecure shortcuts such as storing passwords in an unencrypted file or overusing the same password on many systems. PasswordSafe is one solution to the problem.

PasswordSafe is intended to be a secure solution for maintaining a list of passwords. It uses a secure, encrypted database to store each password and can only be accessed by providing the master password. Originally developed by Bruce Schneier's Counterpane Labs it is now developed and administered by Jim Russell and Rony Shapiro as a SourceForge project. PasswordSafe can be downloaded here.

How is PasswordSafe more secure than storing passwords in a text file or database? All passwords within the database (called a safe) are encrypted using the Blowfish algorithm, also developed by Bruce Schneier, which has so far proven to be unbreakable. Provided a secure master password, referred to as the combination, has been chosen for the safe, no one should be able to decrypt the passwords stored within the safe, even if they obtain a copy of the file. For this reason, it is imperative to choose a strong master password. For guidance in selecting the master password, refer to Eric Wolfram's "How to Pick a Safe Password". Take caution to never lose or forget the combination (master password) for any safe. PasswordSafe intentionally has no way to recover a lost combination, because doing so would compromise its security.

Getting started with PasswordSafe

First, download and install the latest version of PasswordSafe which is available for all Windows platforms, including WinCE. For Linux users, there is a forked version (from the old 1.x series) called MyPasswordSafe available here, but its use is beyond the scope of this article.

The first time PasswordSafe is started, the following dialog appears:





Select "Create new database" and a prompt for the master password appears.



Weak passwords are discouraged with the following prompt.