A safe way to keep a password book – a plain-English guide

The short version

A password book is fine if it stays safe at home. The UK's National Cyber Security Centre (NCSC) says it "can be done safely because an attacker would need physical access to where the passwords are stored."
Use a different password for each important account, starting with your email.
Never write down your bank card PIN.
Nobody genuine will ever ask you to read your passwords out, on the phone, by text or by email.

1 Is a book right for you?

A book suits you if you like having things on paper, you mostly go online at home, or a family member helps you with your accounts. There's no shame in it, and no need to feel old-fashioned.

To be fair and complete, here are the other good ways. The NCSC now gives these first, and you can mix them with a book:

Let your own computer or phone remember them. When the browser offers to "save password", the NCSC says it's safe to say yes on your own devices. Never do it on a shared computer, such as at a library.
A password manager. An app that remembers all your passwords behind one main password.
Passkeys. A newer way to sign in, where you just confirm it's you with your fingerprint, face, or your phone's PIN. There's nothing to remember or write down. Since 2026, the NCSC recommends saying yes to a passkey whenever a website offers one. A family member can help you set one up.

Whichever you choose, the most important thing is the same: a different password for each important account.

2 Choose a plain book

Any notebook will do. An address book with A to Z tabs works well, because you can find "Amazon" under A and "Bank" under B.
Some shop-bought password books say "Passwords" in big letters on the cover. Better to choose a plain one, or put it in a plain cover, so it doesn't stand out.
Or print the free pages at the end of this guide and keep them in a folder.
Write clearly in pen, and leave space under each account so you can add a new password later.

3 Keep it somewhere safe at home

Keep it where you keep other important papers. Not right next to the computer, and not with your bank cards or chequebook.
Don't carry it around in a bag or pocket. If the bag is lost, your keys, cards and passwords go together.
Don't take a photo of it, or copy it into your phone, computer or emails. A copy can be seen by anyone who gets into that phone, computer or email account.
Tell one person you trust where it is, in case you're ever unwell and need help.

4 What to write for each account

The name of the website or app (for example "Tesco" or "Gmail").
Its web address (for example tesco.com), so you always go to the real one.
Your username or the email address you sign in with.
The password, written exactly, with capitals where they are.
Whether 2-step verification is switched on (explained in step 6).
The date you wrote it.

Start with your email account. If you forget a password on another website, the reset link goes to your email. So whoever can get into your email can often get into everything else. The NCSC says to give it a strong password that you don't use anywhere else.

When you change a password, update the book straight away. Cross the old one out neatly and write the date next to the new one.

5 What not to write down

Your bank card PIN. Learn it by heart, and shred the letter it came in. Banks ask everyone to do this.
Your online banking details, unless you're careful. Banks' rules usually say never to write them down "in a way they might be recognised" (that's Barclays' wording; other banks say much the same). The safest choice is to learn them by heart. If you can't, write a reminder that only you would understand, rather than the details themselves. It's worth checking your own bank's rules, because not following them can make it harder to get your money back if something goes wrong.

6 Make each password strong

Three random words. The NCSC suggests joining three words that have nothing to do with each other, like CoffeeTrainPuddle. They're long, which makes them hard to guess, but easy to type. Please make up your own: don't use the example.
If a website insists on a number or symbol, add one to the end, like CoffeeTrainPuddle7!
Different for each important account: email, bank, shopping and social media. Why? If one website is ever broken into, criminals try the same password on other websites.
Avoid names of family or pets, birthdays, your football team, or anything like password123. These are the first things people try.
Switch on 2-step verification where you can, especially for your email. After your password, the website texts you a code (or asks your phone) to check it's really you. Then even someone who has your password can't get in.
If a website gives you backup codes when you switch this on, your book is a good place to keep them.

7 Keep it to yourself

Nobody genuine will ever ask for your password: not your bank, the police, HMRC, the council, BT, Microsoft or Pocket Change. If someone asks on the phone, by text or by email, it's a scam. Just hang up or delete it.
Worried a call might really be from your bank? Hang up, then phone 159. It puts you through to your own bank's fraud team, and works for most UK banks.
If a family member helps with your banking, ask your bank about letting them help properly (for example a "third party mandate", or a Lasting Power of Attorney). Banks' rules usually say not to share your banking passwords, even with family.

8 If the book goes missing

Don't panic. It's most likely somewhere at home. But if you think someone else might have it:

Change your email password first, on your own computer or phone.
If any banking details were in it, phone your bank (the number on your card, or 159).
Then change the passwords for your other accounts, starting with shopping and anything that has your card saved.

A family member or friend can help you work through the list. Write the new passwords in a new book.

Free pages to print

Two A4 pages with space for 8 accounts, in large, clear boxes. Print as many copies as you need and keep them in a folder. The top box on the first page is for your email account, because that's the one to do first.

The pages just say "Accounts" at the top, not "Passwords", so they don't stand out.

Tip: in the print window, choose A4 paper. The pages will come out without this guide.

To print them, go to pocketchangetools.com/guides/password-book and press "Print the blank pages".

What the words mean

Password: A secret word or phrase that proves it's you when you sign in to a website.
Username: The name you sign in with. Often it's your email address.
Browser: The program you use to visit websites, such as Chrome, Edge or Safari.
2-step verification (2SV): An extra check after your password, usually a code sent to your phone. Sometimes called "two-factor authentication".
Backup codes: Spare one-time codes a website gives you, for if you lose your phone and can't get the usual code.
Password manager: An app that safely remembers all your passwords for you.
Passkey: A newer way to sign in without a password. You confirm it's you with your fingerprint, face or phone PIN.
PIN: The short number for your bank card (or to unlock your phone).
NCSC: The National Cyber Security Centre, the part of the UK government that gives advice on staying safe online.

Where this advice comes from

NCSC: Top tips for staying secure online (email password, three random words, 2-step verification)
NCSC: Ways to store your passwords (including writing them in a book)
NCSC: "you may write them down as long as you can keep them safe and private"
Barclays: an example of a bank's rules on PINs and passwords

Checked October 2026. Advice changes now and then, so it's worth a look at the NCSC's website every so often.

Stuck?

That's completely normal. A family member or friend can often help in a few minutes, and many local libraries and Age UK or Age Cymru groups offer free help with computers.