Skip to content

Password advice and best practices

Prefer passkeys where possible

A passkey is a password-less login method that lets you sign in to websites and apps using your device's biometrics (like a fingerprint or Face ID) or a screen lock PIN instead of a typed password

Passkeys, where supported, offer a level of security which simple passwords can't match. Passkeys are substantially better than time based one-time passwords (TOTP) and are considered multi-factor in of themselves as implementations ensure you have proved ownership of the passkey via some method or are linked to a device you own (for example a Yubikey hardware token that you own and an associated pin that you know).

Ordinarily, the device and service are linked in a way that ensures they cannot be used for other unrelated services or devices.

As well as direct creation of passkeys on the device you are logging in from, you can create the passkey in Microsoft Authenticator on your smart phone and then use it to scan a QR code generated when you begin the login process. This then uses a short-range bluetooth connection to ensure you are in the same room as the device running the web browser before allowing login.

Info

How it works

  1. Service, e.g., web site you are visiting, offers the option to use a passkey.
  2. A public/private key pair is generated by your device/app for this specific account/service combination1 and the public key is registered with the service.
  3. When you sign in a service uses your public key to send you a puzzle. Your device/app solves the puzzle using your private key and sends the solution back. The service checks the solution and authenticates you accordingly.

Ownership of the private key on your biometrically/pin locked device proves this is you.

Warning

Although Passkeys are the best form of authentication currently available, there is a weakness. Services frequently allow weak recovery routes, e.g., ones that use simple passwords and send you a TOTP code via SMS are. Any SMS/email based recovery system should be considered unsafe.

See this video for an explanation and advise on how to shore up the recovery issue.

Passkey Explained - YouTube

Remote desktop sessions vs passkeys

If your remote desktop doesn't support passkeys and as you are, by definition, not next to the computer you are using, Microsoft Authenticator + QR code cannot work. Until the University allows the use of synced passkeys you should ensure you have a fall back of password + Microsoft Authenticator push or TOTP configured on your SSO account.

Passwords

If the service doesn't support passkeys yet...

Info

Don't think passwords, think passphrases.

For almost all circumstances, passphrases composed of multiple (minimum three) randomly selected words (of a mixture of lengths) separated by punctuation are as meaningfully secure as completely random alphanumeric password. The old practice of taking a word and replacing letters with 'similar' numbers is not secure as cracking databases include all these combinations.

Example

  • ✅ Good - lily-france-informed-CRANK-weasle
  • ❎ Bad - March1n9B4nd
  • ❎ Bad - one-bar-dog

If the particular service insists on numbers, then just add some in the passphrase somewhere.

Don't re-use passwords

It just shouldn't be needed - if you have a password manager then let it look after generating and providing them for you. A good password manager will warn you if you store duplicate credentials for more than one service.

Multi-factor Authentication (MFA)

A token such as a 6-digit time-based one time password TOTP, is used alongside your ordinary passphrase. These codes can only be generated by linked devices/password managers, ensuring that your device is present when the passphrase is used

Warning

Due to some implementation issues, we currently don't insist on MFA for your OxCIN accounts. Expect this to change late 2026/early 2027.

Password managers

You will need to keep track of too many passwords. It is impossible to remember all of them, so don't. Using a password manager you can store any number of passwords, MFA tokens, and/or passkeys for recall as needed.2

1Password

This is the password manager being used by your IT team. It's not free but it has a really practical user interface and uses a good security model such that the cloud stored data can't be accessed without multiple factors, an account key (which your device stores) and your master password.

OxCIN have preferential pricing for 1Password, with a centrally managed account (and free 'family' subscriptions included for personal use). Contact computing-help@oxcin.ox.ac.uk for pricing.

Pros

  • Integrates well with desktop and browsers
  • Syncs passwords across multiple devices
  • Multiplatform: iOS, Android, MacOS, Linux and Windows.
  • Support for MFA
  • Support for passkeys
  • Biometrically secured via face-recognition and/or fingerprint
  • Can store SSH private keys
  • Good separation between work and personal passphrases if the family subscription taken up
  • Can alert you to compromised passphrases you may be using

Cons

  • Not free

Apple/Google Passwords

The password managers integrated into iOS/macOS and Android are increasingly useful for managing your passwords and can generate unique passwords and manage passkeys for you. They synchronise your passwords across all devices using the same Apple/Google account, so if using them for University passwords this may not be an appropriate solution as they don't allow for multiple 'accounts'

Free cross-platform password managers

Caution should be taken when considering the use of free password managers as they may not have been as rigorously tested as the ones above. If you are considering this, then open source software is likely to be more trustworthy than an app store password manager from a company you've never heard of.

If 1Password or Apple/Google passwords isn't a possibility for you then you could look at https://keepassxc.org (Windows, macOS and Linux) and https://bitwarden.com (all platforms). We would recommend avoiding anything that offers a cloud service and make sure that they promise zero knowledge, i.e. the service provider (if there is a cloud component) cannot read your data under any circumstances - all decryption should take place on your device. Where using non-cloud software, make sure you backup your passphrase database somewhere (e.g. by placing it in OneDrive if the manager doesn’t use a cloud sync service).

We strongly discourage the use of LastPass due to several significant security breaches in the recent past (as of 2023).

  1. If you are logging in via Microsoft, Google, Apple or similar 'log in with', rather than a site specific login account then the passkey is unique to the login service rather than the site. ↩

  2. Synced passkeys, as offered by 1Password are not currently allowed by the Microsoft authentication system that SSO uses. The security of this is being reviewed as of October 2026 and may well change shortly. ↩