A password manager · البرمجة مع مارتن

A head is not a USB stick

Almost nobody remembers three strong sentences. That is not a failure. That is why a password manager exists. We call it a vault. You remember one main password (or a fingerprint, or the computer lock). The vault remembers the rest.

Without a vault people do two things. Either the same short password everywhere. Or sticky notes. Both paths are comfortable. Both open more doors than you want.

At home: a manager in the browser that a parent watches, or a family vault (for example Bitwarden, iCloud Keychain, a manager in school Workspace). A parent knows the main password. You get into the phone with a PIN. That is how the vault and the device lock meet, but they do not mix: the PIN unlocks the phone, the vault watches passwords.

A vault is not magic. It is a list you only reach through one lock. That lock is not a sticker.

⚠️

A sticker on the monitor, a note in ملاحظةs named passwords, and a photo of a scrap of paper in photos — that is not a vault. Whoever takes the phone takes the scrap too. The gallery backs up to the cloud. The cloud is not a drawer.

Where passwords do not belong

Go through this with a parent like tidying. You do not have to delete anything blind today. It is enough to know where it lies.

A note on the monitor, under the keyboard, in a pencil case.
A note in the phone with the word password in the title.
A photo of a scrap among holiday pictures.
A message on Discord, WhatsApp, in mail “so you have it”.
A shared class document.
A notebook that lies in the changing room.

Paper in a drawer with parents is fine when you do not have a vault yet. Paper on the desk is not. The difference is who walks to that drawer.

Switch it on with a parent

You do it together. You show where you click. A parent watches the main lock. None of this is a punishment. It is tidying keys.

Open the browser you actually use at home. Not the one you have “just to try” and then never open anyway.
Settings → passwords / keychain. Switch on saving passwords. The main lock = the computer lock or a parent’s account. If the browser wants a main password, a parent invents it. You do not send it in chat.
Save the school password once. When the browser offers it, check that you are on the real school page — not a weird copy. You read the address at the top. If it does not fit, cancel saving and show a parent. (Hunter will practise that.)

When the vault offers a password on a page that rushes and arrived as a link from a message, do not save. First check that you opened the page with a bookmark or by typing the address. The vault is obedient. It is not a detective. You and a parent are the detective.

💡

If school forbids a manager, ask the teacher where the password belongs. They often have their own school tool. Do not go around the ban with a note on the keyboard. “Where should we save it officially?” is a polite question.

What to say when the vault gets in the way

A classmate: “إرسال the password, I have no vault.”

“I do not send a password. Ask a parent or a teacher where to save it at yours.”

A sibling: “Tell me the main password to the vault.”

“Mum or dad watches that. The phone PIN is not the password to the vault.”

A message: “Turn off the password manager, it is blocking sign-in.”

“I will show this to a parent. I do not turn the vault off myself when a message asks for it.”

A teacher forbids an extension at school.

“Fine. At school I will use what school allows. At home a parent watches the vault.”

What you may do and what a parent watches

You can unlock the phone with a PIN and pick a saved password when the vault lets you in. A parent watches the main key, the vault backup, and whether passwords sync to other devices. That is not distrust. It is like the car key. You ride a bike. An adult watches the car.

When the browser pops up with “save password?”, do not uncheck it in a rage. Stop. Are you on a page you know? Did you open it? If yes, a parent may agree to save. If not, cancel and show the message you came from.

Autofill (it fills the box itself) is comfort. Comfort without eyes is a trap. Look at the address at the top. The vault can offer a password even on a page that only looks familiar. You are the eyes. The vault is a cupboard.

If you have two browsers, pick one home vault. Two half-lists are a mess. المدرسة may have a third, official one. That is fine. A mix of “a bit in كروم, a bit in ملاحظةs, a bit in the head” is not.

The main vault password is not tested out loud in front of a sibling “for a laugh”. It is not sent when you are at grandma’s and “just need that one login”. It can wait for a parent. A vault without the main key is a cupboard you do not want to open in a rush in chat. Tomorrow at the table is enough.

Audit: where the keys live

This is a piece of the project 📱 Phone audit. With a parent, open:

ملاحظةs — is there a list of passwords?
Photos — is there a picture of a scrap of paper?
Chat — did you send yourselves a password “for later”?
Browser — is saving switched on, or do you only click it sometimes?

Do not delete anything in a rage. Mark what you will move. A password in chat = change it with a parent, once you are at the vault. A screenshot of a scrap = delete only after the sentence is in the vault. The order matters. First a new home, then tidying. If you delete the scrap before the sentence is in the vault, you are left without a key. Rush does not want that. Calm wants order.

Add to 🏠 family rules: كلمة المرورs live in the vault. Not in chat, not on the monitor, not in photos.

Now you 💪

A parent knows where the vault is. You know that passwords are not photographed. On paper into a drawer with parents — yes. On Discord — no.

Show a parent where passwords are switched on in the browser. Switch it on together, or find out that school has its own tool.
Say out loud where the vault is not: the monitor, ملاحظةs, the gallery, chat.
If you find a password in chat, plan a change. You do not have to change everything today. It is enough to know it does not belong there.

✅

Check: There is one place where passwords live. It is not the monitor and it is not chat. A parent watches the main key.

What to take from this lesson

A vault > memory > a sticky note.
A parent watches the main password.
The browser can save — switch it on on purpose, not by accident.
First a new vault, then tidying old scraps.
The vault offers a password only on a page you opened.