Do this first. You're about to create accounts on GitHub, Vercel, a database, and GoDaddy. If every login lives in a password manager, you can share access with a developer or teammate in seconds, and cut them off just as fast, without ever reading a password out loud or sending it in a text.
- Create your password manager account with a strong master password you have never used anywhere else. Turn on two-factor authentication immediately.
- Install the password manager's own browser extension and phone app.
- Create a shared folder (LastPass), collection (Bitwarden), or vault (1Password) called something like "Website".
- Every account you create in the steps below gets saved straight into that folder.
- When someone needs access, share the folder. When they're done, remove them. Then change the passwords they could see.
Say no to Chrome saving passwords
If you walk away from a computer with the browser open, anyone sitting down has your passwords. Turn off "Offer to save passwords" in Chrome settings (how) and let the password manager handle it, since it locks itself.
Generate, never invent
Use the manager's generator: 16+ characters, letters, numbers, and symbols. A different password for every site, no exceptions.
Add one character only you know
After generating a password, add one character you memorize to the front or back of it, and don't save that character in the manager. Even if your vault were ever exposed, the stored passwords alone wouldn't work.
Put a comma in it
Include a comma in your passwords. When stolen credentials get dumped and converted to a CSV file, a comma splits your line into the wrong columns and corrupts it.
Turn on two-factor everywhere
Use an authenticator app, not text messages, on GitHub, Vercel, your database, and GoDaddy. Save every set of recovery codes in the password manager.
Use a business email
Sign up for everything with a company address you control, not a personal Gmail or an employee's inbox. Accounts follow the email.
- Sharing passwords over text, Slack, or email. Those messages live forever.
- Forgetting to change passwords after removing someone from a shared folder.
- Losing two-factor recovery codes. Without them, getting back into GitHub or GoDaddy can take days.
