Almost everyone has done it: a passwords.txt on the desktop, a note called "logins" on the phone, a spreadsheet with a tab for each site. It works until the day it doesn't.
Why a plain text file is risky
- Anything on your computer can read it. Browser extensions with file access, a malicious download, a synced backup tool, a colleague borrowing the laptop. A text file has no lock.
- It spreads. Cloud sync, backups, old laptops, USB sticks and email attachments make copies you forget about. Each copy is as readable as the first.
- Search finds it. Desktop search, cloud search and attackers' scripts all look for words like "password".
- One leak exposes everything. A single file holds every account you own.
What about notes apps?
Notes apps are better organised, not better protected. Most store notes so the provider can read them (that is how search and sharing work). Some offer a "locked note", but the protection varies and it is easy to forget to lock a note.
What about a password-protected spreadsheet?
Better than nothing, but the protection depends on the app and file type, and you still copy passwords around by hand. It also doesn't help you on your phone.
A safer setup that is just as easy
- Create a vault in a zero-knowledge password manager. Your entries are encrypted on your device before they are saved. (Why that matters.)
- Copy your entries over as name and value pairs: "Supabase password", "GoDaddy login", "Stripe test key". With Potent Cipher the first 100 secrets are free.
- Delete the old file, then empty the trash and check your cloud backups for older copies.
- Change the most important passwords (email, bank, domain registrar), since the old file may already have been seen.
Keep the "it's just me" convenience
The reason text files win is speed. A good vault keeps that: search as you type, copy with one click, and clipboard clearing so the password doesn't sit there after you paste it. Create your vault and move your list over in a few minutes.