Two-part passwords: protecting important accounts even if your password manager is compromised

Password managers are one of the strongest ways to protect your online accounts. They can create long, random, unique passwords so you don't have to remember dozens of them. But what if you want an additional layer of protection for your most important accounts? One option is a two-part password.

The idea is simple. Your password manager remembers most of the password. You remember a small extra secret that is never stored with it. If someone got the passwords stored in your password manager, they still would not have the full passwords for your most sensitive accounts.

How a two-part password works

Suppose your password manager generates a random password. Instead of using it as the complete password for an important account, you add a private suffix that only you know.

The password manager stores only the first portion. When you sign in, it fills in the stored password and you manually add your private portion before submitting the login. The important idea is that the complete password is never stored in the password manager.

Why do this?

A password manager already gives strong protection, most of all when it has a strong master password and multifactor authentication. But no security system is impossible to break. A two-part password adds another layer.

Say an attacker got the contents of your password vault. They might get xR7!pQ2#vL9$kM. But the website needs xR7!pQ2#vL9$kMYourPrivateSuffix. The stolen entry alone is not enough to log in. This is called defense in depth. You do not rely on one safeguard. You add a second, separate obstacle.

You probably don't need this for every account

Not every account represents the same level of risk. A practical approach is to divide your accounts into two groups.

High-security accounts are the ones where a break-in could cause serious money, privacy, identity, or account-recovery problems. Examples include:

• Primary email
• Banking and investment accounts
• Government and tax accounts
• Social Security-related accounts
• Healthcare portals
• Cloud storage containing sensitive documents
• Important business accounts
• Any account that can reset passwords for other services

These are good choices for extra protection.

Standard accounts carry less risk. Examples are forums, newsletters, and hobby websites that hold nothing very sensitive. You should still use a different, random password for every account. The only difference is that you may decide you do not need the extra part you remember. Never use a weak password just because an account seems unimportant.

Don't use your ATM PIN as the secret portion

You may be tempted to use something you already know, such as your ATM PIN. Don't. Your ATM PIN protects something completely different and should remain separate. Instead, create a dedicated secret used only for your two-part-password strategy. It should not be:

• Your ATM PIN
• Your phone passcode
• Your Social Security number
• Your birthday
• Your street address
• Your regular password
• An easily guessed family name
• Something publicly available about you

The goal is a second secret that is not stored next to the password-manager part.

What if someone hacks the website?

A two-part password protects against one case: someone getting the part stored in your password manager. It does not solve every password problem.

A well-built website stores password hashes, not readable passwords. If a site's login database is stolen, what happens next depends a lot on how that site protected its passwords. That is another reason every website needs its own password. If one site's password leaks, it should not open another site.

Two-part passwords are not a replacement for MFA

A two-part password and multifactor authentication guard against different risks. When an important service offers multifactor authentication (MFA), turn it on. Depending on the service, that could be:

• Authenticator apps
• Hardware security keys
• Passkeys
• Device-based authentication
• SMS codes when stronger alternatives aren't available

For important accounts, using several protections together is much stronger than a password alone.

What about passkeys?

Passkeys are replacing passwords in more and more places. They can protect well against phishing and password theft. When a trusted service offers passkeys that work well, a passkey may be better than building a more complicated password system. You do not need to force the two-part method onto accounts that a passkey already protects better.

Think of a two-part password as an optional extra for accounts that use passwords. It does not replace newer sign-in methods.

There are tradeoffs

Two-part passwords aren't perfect. Because your password manager doesn't contain the complete password, some conveniences may not work normally. For example:

• One-click login may require an extra step.
• Automatic password verification may not know the complete password.
• Password-change tools may require manual intervention.
• You must remember your private portion accurately.
• Losing or forgetting that private portion could lock you out of your accounts.

Before you use this method, make sure your important accounts have good recovery options.

Never create a different secret you have to remember for every website

That throws away one of the biggest benefits of a password manager. The manager should keep doing the hard work of making and remembering unique random passwords. The extra secret is just one more layer that you keep outside the vault on purpose.

Also avoid complicated rules, such as changing the suffix to match the website name. Personal formulas are easy to forget and are not always safer. Keep the system simple.

A practical security strategy

For many people, a reasonable approach is:

This protects the accounts where a break-in would do the most harm, and it does not make every website hard to use.

The bottom line

Password managers are still an excellent security tool. A two-part password starts with one more question. What if someone someday gets the passwords stored in my password manager?

For very important accounts that use passwords, keeping a small part of the secret outside the vault adds a layer of protection. It is not needed by everyone. It does not replace MFA, passkeys, unique passwords, or good account-recovery steps. But if you want extra protection for high-value accounts, the idea is simple:

Security Notice: This article provides general educational information about account security. No password technique can guarantee that an account will never be compromised. Use the security features recommended by your password manager, financial institution, healthcare provider, government agency, or other service, and enable strong multifactor authentication or passkeys when available.