Keep Your Online Accounts Secure Using Safari Passwords

Hi, this is Gary with MacMost.com. Today let's take a look at using the built-in Safari Password Manager.

MacMost is brought to you thanks to a great group of more than 800 supporters. Go to MacMost.com/patreon. There you can read more about the Patreon Campaign. Join us and get exclusive content and course discounts.

So to keep all of your online accounts secure you should be using strong unique passwords for each site. To do this you really need to be using a Password Manager. Now you don't need to get a third party Password Manager as you've got one built into the Safari browser on your Mac and it also talks to the Safari browsers on your other devices. So let's take a look at how it works. Here I have an example registration page. Like you're going to signup for a new website. Usually you're asked for your email as your User ID. Then you're asked to enter a password and verify it. Now, in Safari if you click here to enter in a password you may be prompted right away asking if you want to generate a random password. But even if you're not you'll look on the right here and see this little key button. Click that and you can request a password. So let's suggest a new password and you could see how Safari generates a random password and it enters it in here. Both in the password and in the confirmation field. It's so important that you use a computer generated random password like this. Anything you come up with in your head is going to be far more likely to be guessed than an actual random password. The only downside is it's hard to memorize and enter a password like this. But with a Password Manager you never have to. The Password Manager, in this case the Safari browser itself, is going to enter the password for you. You don't have to memorize it. You never have to type it. 

So we see how Safari gave us a randomly generated password pretty easily. But how do we store it. Well you don't have to do anything additional to store it. All you need to do is finish the form and then Safari will remember this password. So now let's say we go back to the site and we have to login again. I'm going to click here to enter my email. You can see Safari recognizes that this is the place to enter in my ID and my password. It actually shows me a list of passwords associated with this site including the one I just entered in. So I just select this email address and it enters in the email address as my ID and the password right here. Now I click Log In and I can login. I didn't even have to see the password let alone type it. 

So where can you see a list of your passwords? Well, if I go to Safari, Preferences and then I click on Passwords at the top. Then I have to enter in my User Account Password. Now I see a list of passwords that Safari has stored. You can see the User Name here and the password is hidden. Here's that one I just created. By selecting it  it actually shows me the password. I can double click it or click details here to make changes if I want. Also notice I have the ability to add manually a password. I can also remove an entry there. 

Now what would happen if I already have an account at a site but I haven't yet stored it in Safari. When I go to sign in it'll remember that password as well. So I'll enter in a User ID and I'll type the password that I already know. Now I'm going to type a weak password here on purpose to demonstrate. I'll click Log In. Now you get this prompt here asking whether or not you want Safari to save the password. So I'm going to click Save Password. If I click Not Now it would ask me again the next time I logged in. But the other option there is Never bother me about this password ever. Now when I go to Safari, Preferences and Passwords you could see it saved it there. Notice I have this little yellow caution symbol here. Why? Because I entered in a very weak password there and if I click on it you can see this password is easily guessed. It will also give me other security alerts. Like if the password I'm using is insecure because it's currently being used to break into accounts. In other words I didn't create a unique password. I'm reusing one or perhaps my account itself has been compromised. Whenever you see one of these caution symbols you should change the password on the website.

To do that just go to the website and go through whatever the process is for that site to change your password. When you do that Safari is going to prompt you to save the new password. Just like I showed you before when you used the password at a site for the first time. By the way, if you clicked the option not to save the password this is what you get. It saves the site with no user name and a password set to Never Saved. If you want to reset that, so you can save the password later on, all you need to do is select it and then Remove and now you'll be able to save that password the next time you log into that site. 

So saving a password in Safari protects you in a few different ways. First it allows you to have a random unique password for each site which is the most secure way to do passwords. They can be these long random strings of characters because you're saving them in this Password Manager. You don't have to type them manually. Because let's face it if we had to type all of our passwords manually we would probably all use shorter passwords that look like the words, or dates, or names and you would probably reuse the same passwords over and over again. Using a Password Manager means everyone can be long, random, and unique. This also protects you from fishing attacks. The way a fishing attack works is say you get an email that seems to be from a website and it tells you there's a problem you need to log in right away. You click on a link in that email and it takes you to something that looks just like that website. You can't tell it's not! If you look at the URL maybe it's even close to the actual URL. Maybe instead of say in my example here macmost.net it is macmost.xyz123.net. You think you're at the right place. But it's somebody else's website entirely. Then you enter your email address and your password. Now they have captured your ID and password. They've stored it and they're going to go back and try to log into the actual site. How using a Password Manager like we are here in Safari protects you from that is when you go to a site like macmost.xyz123.net it will look up the actual site. You can't fool it. So it's looking for xyz123.net and it can't find a password for that site. So it doesn't give you anything here to be able to log in. 

Now another great thing about storing your passwords in Safari is it syncs across all of your Apple devices using iCloud. To sync your passwords to the other Apple devices go into System Preferences and then to your Apple ID and make sure Keychain is turned on. The passwords are stored in something called the Keychain. You actually have an app on your Mac called Keychain Access that allows you to look at the Keychain. But for most users you never have to use that. Just access the passwords in the Safari Preferences. As long as this Keychain functionality in iCloud is turned on you should sync the passwords to iCloud and then to your other Apple devices like your iPhone or iPad. So when you store a website password, say on your Mac, you also have access to it on your iPhone. So here, for instance, you see me going to the same site on the iPhone and it prompts me to use the password that I've stored. Also if you go and sign up for a website on your iPhone it will suggest a password and save it so then it's available on your Mac. Also on your iPhone you could go into Settings and there you can go to the Password section and find those entries. So if you need to be able to see the password and perhaps copy and paste it into an app or maybe into a different browser you can.

So I'm often asked which Password Manager you should use on your Mac. There are a lot of good ones out there. 1Password and LastPass are really good password managers and there are others as well. But for most users, if you're not using a Password Manager now, start off by just using Safari. Let Safari save your passwords. You get the primary functionality available in all password managers built into your Mac, synced automatically without having to pay for and learn a new app. But if you want you could still use a third party Password Manager and Safari at the same time. That's what I do. When I create a new password at a site I save it in both  1Password and in the Safari Password Manager. It's easy to do so. It's just two clicks instead of one. Then most of the time I find it easiest just to let Safari enter the password in when I go to log into that site again. But I also know I've got it saved in my other Password Manager as well. But for most Mac users, if you're not using a Password Manager now, just start using Safari to save your passwords and let that allow you to have good strong unique random passwords for every website and service you use.