Practical guide · verified against the real thing
Why you should never store passwords in a plain text file or notes app
In one line: It feels safer than trusting a password manager. It's actually the same single-point-of-failure risk with none of the engineering — and one sync away from every device you own.
The reasoning is always sympathetic: password managers feel like a black box, and "at least a text file is mine" feels like control. Some people graduate to a note in the default notes app, which feels like a step up — it syncs, it's searchable, it's got a lock icon maybe. This piece is the honest case for why that file is the worst of both worlds: all of the single-point-of-failure risk of a password manager, none of the engineering that manages it away.
The failure mode, stated precisely
A passwords-in-a-notes-file setup has one property that matters: everything, readable, in one place, replicated. The note syncs to a cloud account — so it exists on every device signed into that account, on the provider's servers, and in that provider's own backups. Anyone with access to any one of those — a borrowed phone, a shared family plan, a phished account, a compromised device — holds every credential you own, with no second factor between them and the file. The lock icon on a note, where present, is a speed bump, not a safe: it protects against a casual glance, not against account access.
Compare the threat model of the file against the threat model of not storing anything: a person with no list must remember, and memory pushes people toward reusing the same password everywhere — the single most exploited habit in account takeover. The file usually begins as a cure for reuse and ends as its own catastrophe. Both failure modes live at the same address: convenience without engineering.
"But a manager is also one basket"
The standard objection deserves a straight answer, because it's half right: yes, a password manager is also a single point of failure. The difference is what surrounds the failure. A reputable manager is built for exactly this job — strong encryption where the data is unreadable without your master password, no plaintext copies on servers, and your master password as the only key. The people who built it anticipated the attacks; the notes app wasn't built for this job at all. And the security establishment treats the two as opposites: NIST's digital-identity guidance (SP 800-63B) — the same standard that killed security questions — is built around password managers being the recommended way to hold credentials, not a risk to avoid. The basket isn't the problem; an unbasketed basket is.
The migration, in one sitting
Move today, in under an hour. Choose a reputable manager — the free tiers are genuinely sufficient for most people, as the Bitwarden free-plan review and the manager-versus-browser comparison cover in detail. Install it, set a master password you'll actually remember (long, memorable, unique — this one password is the only one you'll ever type). Import the list: every manager accepts imported entries, so the text file's contents paste straight in. Then delete the file everywhere it synced — every device, the trash, the version history if the app keeps one — and change the two or three most important passwords first (email, banking, primary social) so the list that ever existed in plaintext is retired fastest where it hurts most.
The text file felt safe because it was simple. Simple and safe are different properties — and for secrets, safety comes from engineering you don't have to do yourself. One hour of migration retires the most dangerous file on your devices.
Sources
Next