Password Managers and Passkeys for Crypto Accounts: Closing a Common Loss Path

Why is account takeover a loss path to worry about?

Think about how people actually hold crypto. Many people keep their coins on an exchange, which means the exchange login is the key. Anyone who can sign in as you, whether through a stolen password, a reused credential from an unrelated breach, a phished code, or a hijacked phone number, can usually withdraw. No one needs to attack a blockchain. They only need to attack the person, and the person is protected by a password and a second factor.

That is why account hygiene deserves as much attention as wallet hygiene. The FBI has warned about scammers impersonating cryptocurrency exchanges to get account access, and the FBI's SIM-swap advisory describes criminals redirecting victims' phone numbers to their own devices so they receive text-message codes. Both attacks end the same way, with someone else logged into an account that holds your money. The good news is that the defenses are cheap, familiar, and mostly free: unique passwords, a password manager, and a stronger second factor than SMS.

Why unique passwords, and why a manager?

CISA's guidance is direct: use a different strong password for each account, so that a breach at one service does not unlock your others. It recommends passwords of at least 16 characters, or a passphrase of four to seven unrelated words, and it recommends a password manager, noting that you then only need to remember one strong password, the one for the manager itself. CISA also notes these tools can flag weak or reused passwords and generate strong ones for you.

For crypto, the point is concrete. If your exchange password is the same one you used on a forum that later leaked credentials, an attacker can simply try it. A manager makes a unique random password for every account painless, so nothing you type for the exchange exists anywhere else. Choose a long, memorable passphrase for the manager, protect the manager account with the strongest second factor you have, and keep an offline record of how to recover it. A manager is a convenience that also happens to be a security upgrade, and it is why we list password managers like NordPass and Proton Pass as options (affiliate disclosure below).

SMS codes, authenticator apps, passkeys, security keys: which is stronger?

Second factors differ a great deal. CISA lists text or email codes, authenticator apps that generate a new code every 30 seconds, biometrics, and a stronger class it calls phishing-resistant MFA built on FIDO standards. NIST's digital identity guidance is blunter about SMS: out-of-band authentication is not phishing-resistant, and using the public telephone network for it is a restricted authenticator. NIST also says out-of-band codes entered by hand are not phishing-resistant, and a SIM swap, as the FBI describes, is one way a text can end up with an attacker. An authenticator app is a step up because the code is generated on your device rather than sent over the phone network, but you can still be tricked into typing the code into a fake page.

Passkeys and hardware security keys use public-key cryptography. The FIDO Alliance describes a passkey as a credential based on FIDO standards that can be stored on a phone, a computer, or a hardware security key, and says it is phishing-resistant by design and tied to a user's account on a specific website or app. Because the credential is bound to the real site, it is designed not to work on a lookalike domain, which addresses the whole category of 'type your code into this fake page' attacks. A hardware key such as a YubiKey is one way to carry that credential. Exact exchange support varies, so check what each of your providers offers rather than assuming.

What belongs in a password manager, and what never does?

Put in it everything that is an account login: exchange passwords, email passwords, and the notes field with the account's recovery options. Keep two-factor backup codes on paper rather than in the same manager, because storing them next to the password defeats the point of a second factor. The manager is excellent at the job of making unique logins practical.

Never put a recovery phrase or a private key in it. A seed phrase is not a login. It is the wallet. Ledger's guidance is that you should never store a recovery phrase on cloud-based services and that recording it on something physical, such as paper or a hardware wallet, is better; a cloud-synced password manager is that kind of service, and it would place the master key behind an account that can itself be phished or breached. Our seed phrase safety checklist at /guides/seed-phrase-safety-checklist covers the offline options. Also resist keeping the only copy of the manager's recovery information inside the manager. Keep a printed emergency sheet somewhere physical and safe, because the day you need it is the day you cannot log in.

How should I migrate without locking myself out?

Order matters more than speed. First, choose and set up the manager, protecting it with a long passphrase and the strongest second factor available. Second, secure the email account that receives password resets, because whoever controls the email controls every reset link. Third, change the exchange password to a generated one and save it, then enable the strongest second factor the exchange supports, registering a passkey or hardware key if available, and saving backup codes offline. Fourth, review the account's other fallbacks: remove SMS as a recovery method where the provider allows it, and check which devices and sessions are signed in.

Do one account at a time, and confirm you can log in from a fresh session before you move to the next. If you buy hardware keys, Yubico's own guidance is to register a spare key, keeping it in a separate safe place, so losing one does not lock you out. Do not close an old method until the new one works. A rushed migration that leaves you locked out of an exchange is its own kind of loss, and avoiding it is simply a matter of patience and a written plan.

Which tools, and how do I handle the affiliate links?

Several password managers are reputable, and you should pick on features and trust, not on us. NordPass and Proton Pass are two options we link, and we may earn a commission if you sign up through those links, at no extra cost to you. The affiliate relationship has not changed anything above. Compare independent security audits where published, how recovery works, whether the product supports passkeys and authenticator codes you want, and the vendor's current price, which you should always check on the vendor's own page.

Remember what these tools do and do not do. A password manager secures logins. It does not protect a seed phrase, it does not stop you approving a malicious signature, and it will not save you from a fake support agent who persuades you to read out a code. Pair it with the direction-of-contact rule in our fake support guide, and the account-security baseline in our hardening checklist at /guides/crypto-account-security-baseline-checklist. A manager and a passkey close the most common door; you still have to refuse to open the others.

FAQ