Blog

<p>Most people install a VPN, tap connect, and never open the settings menu again. For a long time that was me too, until a dropped connection on a train left my laptop briefly exposed on the open network without me noticing for a good ten minutes. Nothing came of it that time, but it was enough to make me actually go through every setting my VPN app offers rather than trusting whatever ships as default. Here's what I actually changed, and why each one mattered enough to bother with. For a side-by-side way of weighing providers up, see my guide on <a href="https://kellssecurity.com/blog/how-id-choose-a-vpn-service-if-i-were-starting-today" data-mce-href="https://kellssecurity.com/blog/how-id-choose-a-vpn-service-if-i-were-starting-today">choosing the right VPN service</a>.</p><h2>Why I Stopped Trusting Default Settings Out of the Box</h2><p><br></p><p>VPN apps are built to get you connected in one tap, which means the defaults are tuned for ease of use rather than maximum protection. That's a reasonable trade-off for the company to make, since most users would abandon an app that demanded a settings review before it worked at all. But it means the responsible thing is to assume the out-of-the-box configuration is the minimum viable setup, not the best one, and to go through the menu once properly rather than assuming someone already optimised it on your behalf. It took me about twenty minutes the first time, working through every tab in the settings menu and reading what each toggle actually did rather than guessing from the label alone. Most of them turned out not to matter much either way, but the handful that did were worth that twenty minutes many times over.</p><p><br></p><h2>The Kill Switch Setting I Turn On Before Anything Else</h2><p><br></p><p>A kill switch cuts your internet entirely the moment your VPN connection drops, rather than quietly falling back to your normal, unprotected connection while you carry on browsing none the wiser. On the app I use it isn't switched on by default, it's a toggle buried under an "advanced" section, which is exactly backwards given how much it matters. That train journey I mentioned is precisely the scenario a kill switch exists for: a connection that drops without warning while you're on a network you don't control. It's the first thing I check on any new install now, before I even log in properly.</p><p><br></p><h2>Split Tunneling: The One Feature I Actually Use Daily</h2><p><br></p><p>Split tunneling lets you choose which apps route through the VPN and which use your normal connection directly, and it's the setting I actually interact with most often day to day. I route my browser and email client through the VPN always, but I let my banking app and a couple of UK-only streaming services bypass it, since routing through a VPN server abroad breaks them or triggers extra security checks. Without split tunneling I'd be constantly switching the whole VPN on and off depending on what I'm doing, which is exactly the kind of friction that makes people give up on using one consistently at all.</p><p><br></p><h2>Why I Switched My Protocol From OpenVPN to WireGuard</h2><p><br></p><p>Most VPN apps let you choose which underlying protocol handles the actual encrypted tunnel, and the default is often an older one for compatibility reasons rather than performance. I switched mine from OpenVPN to WireGuard once I understood the difference: WireGuard uses a smaller, more modern codebase that's easier to audit for vulnerabilities, and it's noticeably faster on both mobile data and Wi-Fi. It's not a setting most people know exists, let alone that it's worth changing, but it took me under a minute to switch once I found it in the menu. The difference showed up almost immediately on video calls, which used to occasionally stutter over the VPN and now don't, and that alone would have been worth the change even without the security argument for a newer protocol.</p><p><br></p><h2>The Auto-Connect Rule I Set for Untrusted Networks</h2><p><br></p><p>I've written before about <a href="https://kellssecurity.com/blog/the-public-wifi-habit-i-finally-broke" data-mce-href="https://kellssecurity.com/blog/the-public-wifi-habit-i-finally-broke">the public Wi-Fi habit that took me too long to break</a>, and the setting that actually fixed the underlying problem was auto-connect rules based on network trust. My VPN app lets me mark home and work Wi-Fi as trusted, and automatically fires up the VPN the instant I join anything else, including mobile hotspots I don't recognise. That removes the human error entirely: I no longer have to remember to switch it on in a coffee shop or hotel lobby, because the decision is already made before I've even opened a browser tab.</p><p><br></p><h2>The One Setting I Deliberately Leave Turned Off</h2><p><br></p><p>Not every extra toggle is worth switching on. My app offers a setting that automatically connects to the "fastest available" server rather than a specific location I choose, and I leave that off deliberately, because I'd rather pick a server myself based on what I'm actually trying to do, whether that's reaching a specific country's content or just staying on a server I've already confirmed performs well for me. I've also left the ad and tracker blocking feature switched off, not because it doesn't work, but because I already handle that through my browser and didn't want two separate systems quietly fighting over the same job and occasionally breaking a site in the process. More settings enabled isn't automatically better protection, and it's worth working out which ones genuinely change your risk and which just add complexity for no real benefit. I use <a href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902" target="_blank" rel="noopener" data-mce-href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902">NordVPN </a>for the settings described here, which is part of <a href="https://kellssecurity.com/blog/what-a-vpn-actually-protects-you-from" data-mce-href="https://kellssecurity.com/blog/what-a-vpn-actually-protects-you-from">why I run a VPN on every device I own</a> rather than just my main laptop. If you want a second opinion on VPN security more broadly, <a href="https://www.ncsc.gov.uk/cyberaware/home" target="_blank" rel="noopener" data-mce-href="https://www.ncsc.gov.uk/cyberaware/home">NCSC </a>has clear, current guidance on this, and my <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">free Safety Toolkit</a> walks through the basics I'd want anyone starting from zero to get right first.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

The VPN Settings I Actually Bother Changing From Default

<p>A few months ago I got a message that stopped me mid-scroll, not because it looked suspicious but because it looked too good. No typos, no clumsy phrasing, no "Dear Valued Customer" giveaway. It read like it had been written by someone who genuinely cared about getting the tone right. That's exactly the problem. The old advice about spotting a scam by its bad grammar has quietly stopped working, and I think most people haven't caught up to that yet, myself included until that message made me sit up and actually think about why it felt so convincing.</p><h2>Why "Bad Grammar Means Scam" Stopped Being Useful Advice</h2><p><br></p><p>For years the safest tell was a clumsy sentence, a missing article, a word that didn't quite fit British English. That advice made sense when scam messages were being translated badly or copied from a template nobody had proofread. It doesn't hold anymore. A generative AI tool can produce fluent, grammatically correct, context-appropriate text in seconds, in whatever tone you ask for, and scammers have noticed exactly as quickly as everyone else has. Treating polished writing as a sign of legitimacy now works against you rather than for you, which is an uncomfortable habit to unlearn after years of being told the opposite.</p><p><br></p><h2>The Over-Polished Tone That Actually Gives It Away</h2><p><br></p><p>What I've started noticing instead is almost the opposite problem: messages that are too smooth. A real colleague, a real delivery company, a real bank, they all have a slightly inconsistent house voice, because different humans wrote different bits of it at different times, updated it in different years, and left in small quirks nobody bothered fixing. An AI-generated message tends to read as one continuous, evenly-paced voice from greeting to sign-off, with none of the small verbal tics a real person or a real long-standing company template usually carries. It's a subtle thing to describe but once you start looking for it, it's oddly noticeable, like a photo that's been smoothed just slightly too much, technically clean but missing the texture a genuine version would have.</p><p><br></p><h2>Personalisation That's Detailed but Slightly Wrong</h2><p><br></p><p>The other pattern I watch for is personalisation that's specific without being accurate. Scammers now have access to enough scraped or leaked data to drop your name, your rough location, or even a company you've actually used into a message convincingly. What gives it away is that the detail is often adjacent to the truth rather than exactly right, a delivery company you used two years ago rather than the one you're actually expecting a parcel from, or a job title that's close but not quite yours. A message that knows something about you but gets one specific fact slightly off is worth far more suspicion than one that's generic, because it tells you the detail was pulled from a dataset rather than known first-hand, and a real company checking its own records wouldn't make that particular kind of mistake.</p><p><br></p><h2>Messages That Never Ask a Real Question Back</h2><p><br></p><p>I've also noticed that AI-written scam messages tend to be strangely one-directional. They tell you something urgent and give you an instruction, but they rarely ask a genuine clarifying question the way a real exchange would. A real courier query, a real colleague chasing an invoice, a real customer service reply usually has some back-and-forth quality to it, referencing something specific you said or did earlier in an actual thread. A scripted message, however well-written, is built to deliver a payload and move you toward a link or a reply, not to actually have a conversation, and that structural giveaway survives even when the wording itself is completely flawless.</p><p><br></p><h2>How I Actually Check Before I Reply to Anything Like This</h2><p><br></p><p>None of this replaces basic verification, it just tells me when to slow down and go looking for it. If a message claims to be from a company, I go to that company through a channel I already trust rather than anything in the message itself, typing the website address in myself or calling a number from a previous genuine bill rather than anything supplied in the message. Keeping decent security software running in the background helps too, since something like <a href="https://www.bitdefender.com/en-us/consumer/?irclickid=WxSzmdWRXxyZWsOzKNx6sWZFUkrxGHQpm0ekVY0&amp;im_rewards=&amp;irgwc=1&amp;afsrc=1&amp;MPid=6273270&amp;cid=aff|c|IR|Cyber%20Jay" target="_blank" rel="noopener" data-mce-href="https://www.bitdefender.com/en-us/consumer/?irclickid=WxSzmdWRXxyZWsOzKNx6sWZFUkrxGHQpm0ekVY0&amp;im_rewards=&amp;irgwc=1&amp;afsrc=1&amp;MPid=6273270&amp;cid=aff|c|IR|Cyber%20Jay">Bitdefender </a>will often flag a malicious link before I even get to the point of deciding whether the wording felt off in the first place. These are close to <a href="https://kellssecurity.com/blog/the-simple-checks-i-use-to-stop-ai-scams" data-mce-href="https://kellssecurity.com/blog/the-simple-checks-i-use-to-stop-ai-scams">the simple checks I already run</a> whenever something feels engineered rather than organic, just applied specifically to how a message is worded rather than what it's actually asking me to do.</p><p><br></p><h2>Why I Still Don't Rely on Spotting the Wording Alone</h2><p><br></p><p>I want to be honest that this is a moving target. The tells I've described here are true today and may not be reliable in a year, because <a href="https://kellssecurity.com/blog/the-simple-checks-i-use-to-stop-ai-scams" data-mce-href="https://kellssecurity.com/blog/the-simple-checks-i-use-to-stop-ai-scams">the techniques scammers use keep evolving</a> roughly as fast as the tools that generate them do. Wording analysis is a useful early filter, not a verdict, and I never let a message pass just because it happened to feel a bit clumsy or fail one of these checks. The habit that actually protects me is verifying through a channel I chose myself, every single time something asks me to act quickly, regardless of how convincing or how polished the writing turns out to be.</p><p><br></p><p>If you want a second opinion on what to watch for more broadly, <a href="https://www.ncsc.gov.uk/cyberaware/home" target="_blank" rel="noopener" data-mce-href="https://www.ncsc.gov.uk/cyberaware/home">NCSC </a>keeps genuinely current guidance on this, and my <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">free Safety Toolkit</a> walks through the verification habits I rely on day to day.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

Wording Patterns That Give Away an AI-Written Scam

<p>A colleague asked me last month which free VPN she should download for a trip abroad, and I realised I didn't have a good answer, because I don't actually recommend any of them anymore. I used to think a free VPN was better than no VPN at all, a reasonable middle ground for someone who just wanted basic protection without paying for it. Then I actually looked into how most of them stay in business, and that assumption fell apart pretty quickly. It's not that every free option is malicious, it's that I couldn't reliably tell which ones were fine and which ones weren't, and a security tool I can't trust isn't really doing its job. If you're still deciding which one to go with, my guide on <a href="https://kellssecurity.com/blog/how-id-choose-a-vpn-service-if-i-were-starting-today" data-mce-href="https://kellssecurity.com/blog/how-id-choose-a-vpn-service-if-i-were-starting-today">how to choose a VPN service</a> covers what actually matters.</p><h2>The Free VPN Business Model I Didn't Understand at First</h2><p><br></p><p>A VPN costs real money to run. Servers in dozens of countries, bandwidth, engineering staff, none of that is free, so when a product costs nothing to use, something else is covering the bill. For a worrying number of free VPN apps, that something else is your data. Several free VPNs have been caught logging browsing activity and selling it to advertising and analytics firms, which is precisely the thing a VPN is supposed to stop happening. Some have also turned out to be owned by companies with no clear track record and registered in places with little obligation to disclose who's actually behind the app, which makes it even harder to know who's holding your browsing history. I'm not saying every free VPN does this, but I stopped being able to tell the trustworthy ones from the rest just by reading a privacy policy, and that uncertainty alone was enough to change my mind.</p><p><br></p><h2>What a Free VPN Can See That a Paid One Can't Sell</h2><p><br></p><p>The entire point of a VPN is that your traffic passes through the provider's servers before it reaches the wider internet, which means the provider is technically in a position to see everything you're doing unless they've committed to a genuine no-logs policy and had it independently audited. A reputable paid provider stakes its whole reputation on that audit, because getting caught logging data would be commercially fatal. A free provider with no real revenue model beyond your data has a much weaker incentive to resist the temptation, and audits of no-name free apps are far rarer than they should be. I'd rather pay a few pounds a month to a company whose business model doesn't depend on watching what I do.</p><p><br></p><h2>The Speed and Server Limits That Come With Free</h2><p><br></p><p>Even the free VPNs that are reasonably honest about privacy tend to make the experience painful enough that people give up on using it consistently. Bandwidth caps, a handful of overloaded server locations, and connection speeds that make video calls unusable are all common trade-offs. I've tested a few out of curiosity, and the pattern is consistent: whatever server you connect to is shared by far more free users than a paid server would be, so everything crawls at peak times. Daily data caps are common too, often just enough for browsing but nowhere near enough for a day of streaming or video calls, so people end up switching it off the moment it becomes inconvenient. A VPN you stop using because it's too slow isn't protecting you at all, it's just an app taking up space on your phone.</p><p><br></p><h2>The One Free VPN Feature That's Sometimes Worth Using</h2><p><br></p><p>I'll give credit where it's due: a handful of the well-known paid providers, <a href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902" target="_blank" rel="noopener" data-mce-href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902">NordVPN </a>among them, offer limited free trials or a capped free tier as a way to let you test the service before committing. That's a genuinely different situation to a permanently free, ad-supported app, because the company's actual business model is still the paid subscription, and the free tier exists to build trust rather than to harvest data. If you want to try before you buy, that's the version of "free" worth using, not a standalone free VPN app with no obvious revenue source behind it.</p><p><br></p><h2>The Browser Extension That Isn't Really a VPN at All</h2><p><br></p><p>There's a related trap I didn't spot for a while: several "free VPN" browser extensions aren't a VPN in the proper sense at all, they're a proxy that only reroutes traffic from that one browser tab, leaving every other app on the device, email, messaging, background sync, completely unprotected. That's <a href="https://kellssecurity.com/blog/the-vpn-myths-i-keep-having-to-correct" data-mce-href="https://kellssecurity.com/blog/the-vpn-myths-i-keep-having-to-correct">one of the mix-ups I keep having to correct</a> when people ask me about VPNs generally, and it's a meaningfully weaker product than a genuine device-level VPN, with the naming making it easy to assume you're covered when you're not. If you're only after a quick way to appear as though you're browsing from a different country, that might be all you need, but it's worth knowing that's what you're actually getting rather than assuming it's protecting everything you do.</p><p><br></p><h2>What I'd Actually Pay For Instead</h2><p><br></p><p>When I'm actually comparing services rather than just checking a box, I look at the same handful of things every time: an independently audited no-logs policy, where the company is legally based (jurisdiction affects what it can be compelled to hand over), how many devices one subscription covers, and whether it includes a kill switch as standard. I've written before about <a href="https://kellssecurity.com/blog/how-id-choose-a-vpn-service-if-i-were-starting-today" data-mce-href="https://kellssecurity.com/blog/how-id-choose-a-vpn-service-if-i-were-starting-today">the fuller checklist I use when choosing a VPN</a>, and it holds up regardless of price point. <a href="https://www.ncsc.gov.uk/cyberaware/home" target="_blank" rel="noopener" data-mce-href="https://www.ncsc.gov.uk/cyberaware/home">NCSC </a>has general guidance on evaluating tools like this too, worth a look if you want a second opinion beyond mine. What I've stopped doing is treating "free" as a legitimate category alongside paid options at all. A few pounds a month buys a company whose incentives are actually aligned with keeping your data private, and once I understood what free VPNs are usually funded by, that felt like an easy trade. I use <a href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902" data-mce-href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902">NordVPN </a>myself, and my <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">free Safety Toolkit</a> covers the rest of what I'd want anyone to check before they trust any provider with their traffic.</p><p>Affiliate disclosure: the NordVPN link in this post is an affiliate link. If you sign up through it, I may earn a small commission, at no extra cost to you. I only recommend tools I use myself.</p><p>If you want a simple way to spot scams before they catch you out, grab my <a href="https://79516839.sibforms.com/serve/MUIFAAzCSl0YuEwRMq4a4xv696PrjPtci8pqRdpNUvPRnH9fF-gauC1E_eGFVnwYYGIz2Wdg8bfKiwSjYjxoukXt_Dz7JlzqD5-mpQiIXVKfIA0-0B2cjR54xgODntiOjGBJ2K4Pq2-T3AQqxmQ5ER1uv0WQSEUzNeTje1QXmDkFm_sADqNAYtxABtGZXkJfeM24GY5zcWVw8UV1" data-mce-href="https://79516839.sibforms.com/serve/MUIFAAzCSl0YuEwRMq4a4xv696PrjPtci8pqRdpNUvPRnH9fF-gauC1E_eGFVnwYYGIz2Wdg8bfKiwSjYjxoukXt_Dz7JlzqD5-mpQiIXVKfIA0-0B2cjR54xgODntiOjGBJ2K4Pq2-T3AQqxmQ5ER1uv0WQSEUzNeTje1QXmDkFm_sADqNAYtxABtGZXkJfeM24GY5zcWVw8UV1">free Safety Checklist</a>, or read my book, <a href="https://www.amazon.co.uk/dp/B0HJMF41G2" data-mce-href="https://www.amazon.co.uk/dp/B0HJMF41G2">Spot the Scam</a>, on Amazon.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

Why I Stopped Recommending Free VPNs to Anyone

<p>My mum called me the week she got her new phone, excited to show it off, and completely unaware that half the settings that actually protect her hadn't been touched since it left the box. That's not unusual. A new phone arrives set up for convenience, not security, and most people start using it straight away without changing a thing, transferring their whole digital life onto a device that's still running its factory defaults. I've got a fixed routine I run through on any new device before it goes into daily use, whether it's mine or a family member's, and it takes about fifteen minutes, done in a specific order because some of these settings are far harder to fix retroactively once the phone's already full of accounts and habits built around it.</p><h2>Setting a Proper Lock Screen Before Anything Else</h2><p>The very first thing I do, before signing into a single account, is set a proper lock method. A six-digit passcode is the minimum I'll accept, never four digits and never a pattern swipe, which is far easier for someone to spot over your shoulder. I turn biometric unlock on too, fingerprint or face, because it means the phone gets locked more often in practice rather than left open out of sheer inconvenience. This step matters more than people think, since almost everything else on the phone, banking apps, email, photos, is only as protected as whatever's stopping someone from picking it up and unlocking it.</p><h2>Turning On Find My Device Immediately</h2><p>Before I add a single app or account, I make sure Find My Device or Find My iPhone is switched on, tied to the account that'll actually be used going forward. It sounds like an afterthought, but it's dramatically harder to enable retroactively once the phone's already lost or stolen, and it's the difference between a phone that can be tracked, locked, and wiped remotely and one that simply vanishes along with everything on it. I also confirm the SIM has its own PIN set, separate from the lock screen, since a SIM swapped into another device without one is still usable by whoever has it.</p><h2>Checking Every Automatic Backup Is Actually Running</h2><p>Once the lock screen and Find My Device are sorted, I go into the backup settings and confirm photos, contacts, and app data are actually being backed up automatically, not just available as an option someone meant to turn on eventually. I've seen too many people lose years of family photos because a new phone's backup toggle sat switched off from day one. This is also the point where I check the account behind that backup has its own strong, unique password and two-factor authentication switched on, since a backup is only as safe as the account holding it.</p><h2>Going Through App Permissions One by One</h2><p>New phones ask for a lot of permissions during setup, and most people tap through them without reading what they're agreeing to. I go into the permissions menu directly and check what has access to location, the microphone, contacts, and photos, revoking anything that doesn't have an obvious reason to need it. A flashlight app doesn't need your contacts. A game doesn't need your microphone running in the background. This step alone usually cuts the list of apps with location access in half, and it takes less time than most people expect.</p><h2>Triggering a Manual Software Update Before Anything Else Loads</h2><p>New phones often ship with an operating system version that's already a few weeks or months out of date by the time it reaches a shop shelf, sitting there waiting for the buyer to eventually notice an update is available. I go into settings and force a manual check straight away rather than waiting for it to prompt me, because security patches are usually the biggest part of any update, and a phone running its out-of-the-box software is running with known gaps that have likely already been fixed upstream. This is also the point where I turn automatic updates on going forward, so this isn't a one-off fix but something the phone keeps doing on its own without anyone having to remember.</p><h2>Installing a Password Manager Before Anything Else Gets Signed Into</h2><p>Rather than signing into each account with whatever password comes to mind, I install <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">NordPass </a>on a new phone before touching email, banking, or social apps, and let it generate a unique password for every account from that point forward. Doing this before signing into anything means every single account on that device starts out with a strong, unique password rather than a reused one carried over out of habit. It's a much easier habit to start clean than to retrofit six months later once dozens of accounts are already set up with the same weak password.</p><h2>The One Setting I Check Last, Not First</h2><p>The very last thing I do, once everything else is in place, is check what's actually visible on the lock screen itself: message previews, notification content, and whether the phone stays unlocked longer than it needs to before locking itself again. I set the auto-lock timer to thirty seconds rather than the two or five minutes most phones default to, since a phone that stays unlocked on a table for several minutes after last use is functionally the same as no lock screen at all for that stretch of time. I've written before about the everyday habits that quietly put people at risk, and a lock screen showing full text previews of banking codes or private messages is exactly that kind of quiet risk nobody thinks to check, right up until the wrong person glances at the wrong moment. NCSC has straightforward guidance on securing a new device that's worth a look if you want a second source beyond mine. Fifteen minutes with a new phone, done in this order, closes off most of the obvious ways it could go wrong later, and my free Safety Toolkit has a version of this checklist you can run through on your own device today.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

The Security Setup I Walk Through on Every New Phone

<p>For years, whenever a website asked if I wanted to save a password, I just clicked yes without thinking about it. My browser was already open, the prompt took one click to dismiss, and the passwords were there again the next time I needed them. It felt like a password manager without the extra step of installing anything. I didn't stop to ask what that convenience was actually costing me until I had a genuinely uncomfortable moment sat in a coffee shop, realising my laptop was unlocked and logged into my browser, and that anyone glancing at the right menu could have seen every password I'd ever saved to it in plain text.</p><h2>The Convenience That Kept Me Using It Longer Than I Should Have</h2><p><br></p><p>I want to be fair to the built-in option, because I understand exactly why it's so widely used. It's already there, it costs nothing extra, and it works the moment you say yes to the first save prompt. For someone who's never used a dedicated password manager, that low barrier to entry genuinely does more good than a stronger tool nobody actually sets up. My problem wasn't that it did nothing, it's that I'd let "better than nothing" become "good enough," and those aren't the same standard once you actually rely on a browser for anything beyond casual browsing.</p><p><br></p><h2>What Happens If Someone Gets Into My Device Itself</h2><p><br></p><p>The moment that changed my thinking wasn't a hack, it was just sitting in that coffee shop and realising how little stood between my saved passwords and anyone with physical access to my unlocked laptop. Most browsers will show saved passwords in plain text once you're inside the settings menu, sometimes without even asking to re-confirm who you are first. A dedicated password manager locks behind its own separate master password or biometric check, so unlocking my laptop doesn't automatically unlock my vault too. That extra layer sounds small until you picture the exact scenario where it's the only thing standing between someone and my accounts.</p><p><br></p><h2>Why It Doesn't Follow Me Between Browsers or Devices the Same Way</h2><p><br></p><p>I also hadn't noticed how much friction the built-in approach was quietly building into my own routine. Passwords saved in one browser mostly stay there, so switching between my laptop's browser and my phone's browser meant either retyping things from memory or digging out my phone to read a saved password off a tiny screen. A dedicated manager sits above all of that as its own app, with a browser extension on every device pointed at the same vault, so the same login works the same way whichever screen I'm sat in front of. I didn't realise how much low-grade friction I'd been tolerating until it disappeared.</p><p><br></p><h2>The Security Features a Dedicated Manager Has That My Browser Doesn't</h2><p><br></p><p>Beyond just storing passwords, a dedicated manager actively works for me in ways my browser never did. Mine checks the domain of the page I'm on before offering to fill anything in, so a convincing fake login page simply doesn't get autofilled, which is one of the more reliable ways to catch a phishing attempt before I fall for it. It also flags weak or reused passwords across my whole vault at once, tells me if any of my saved logins have shown up in a known data breach, and generates a proper random password whenever I need a new one instead of me typing another variation on something I'll half-remember. My browser's built-in saving never did any of that, it just stored what I typed.</p><p><br></p><h2>What Finally Made Me Switch</h2><p><br></p><p>I'd known all of this in the abstract for a while before I actually did anything about it, which is probably familiar if you're reading this and still using your browser's built-in saving right now. What tipped me over was totting up how many accounts I'd built up over the years, more than I could count without checking, and realising I genuinely didn't know how many of them still shared a password with something else. A dedicated password manager, I switched to using <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">NordPass</a>, turned that unknown into a list I could actually work through, and generating a fresh unique password for each one took an evening rather than the weeks I'd been putting it off for. If you're weighing up which one to get, I've written separately about <a href="https://kellssecurity.com/blog/how-id-choose-a-password-manager-if-i-were-starting-today" data-mce-href="https://kellssecurity.com/blog/how-id-choose-a-password-manager-if-i-were-starting-today">how I'd choose a password manager if I were starting today</a>.</p><p><br></p><h2>What I Did With the Passwords Already Saved There</h2><p><br></p><p>Moving away from browser-saved passwords isn't as simple as just starting to use something new, because the old ones don't disappear on their own. Most browsers let you export what's saved as a file, which I imported into my new manager rather than typing everything out again by hand, and I've written separately about <a href="https://kellssecurity.com/blog/the-password-manager-migration-i-actually-went-through" data-mce-href="https://kellssecurity.com/blog/the-password-manager-migration-i-actually-went-through">the migration process itself</a> if you want the practical steps. The part people skip is clearing the browser's own saved copies afterwards, since leaving both in place just means you've got two separate places someone could find your passwords instead of one. Once I'd confirmed everything had moved across safely, deleting the browser's own list was one of the more satisfying five minutes I've spent on this.</p><p><br></p><p>If you want a second opinion on password security generally, <a href="https://www.ncsc.gov.uk/cyberaware/home" target="_blank" rel="noopener" data-mce-href="https://www.ncsc.gov.uk/cyberaware/home">NCSC </a>has straightforward guidance that doesn't assume you're already a technical person, and my <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">free Safety Toolkit</a> walks through this switch alongside the rest of what I actually rely on day to day.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

Why I Stopped Using Browser Password Saving

<p>A friend told me recently that she'd never use a password manager because, in her words, "if that thing ever gets hacked, I lose everything in one go." She's far from the only person I've heard say something like that. Nearly every hesitation I come across about password managers turns out to be a version of the same handful of myths, ones that sound reasonable on the surface but fall apart once you look at how these tools actually work underneath. I believed a couple of them myself before I looked into it properly, so I'm not writing this from a place of judgement. I just think the myths are worth taking apart one at a time, because they're quietly keeping a lot of people stuck with weak, reused passwords out of caution that isn't actually warranted.</p><h2>The Myth That a Data Breach Means Losing Every Password at Once</h2><p><br></p><p>This is the one I hear most often, and it misunderstands what a breach of a password manager's servers would actually expose. Reputable managers use zero-knowledge encryption, meaning your vault is encrypted and decrypted entirely on your own device using a key derived from your master password. The company itself never has access to that key or to your unencrypted data, so even if their servers were breached, an attacker would be looking at scrambled, useless data rather than a neat list of your logins. That's a fundamentally different risk profile to, say, a retailer storing your card details in plain text. It doesn't mean breaches never matter, but the "one hack and it's all gone" fear misrepresents how the encryption actually protects you.</p><p><br></p><h2>The Myth That Free Password Managers Aren't Secure Enough to Trust</h2><p><br></p><p>I used to assume a free tool must be cutting corners somewhere, probably on the security itself. In practice, the encryption standard is usually identical across free and paid tiers from a reputable provider, because that's the core promise the whole product is built on. What you actually lose by staying on a free plan tends to be convenience features: syncing across more than one device, more storage for extra fields, priority support, that sort of thing. Those are real trade-offs worth knowing about, but they're not the same as the vault itself being weaker. If cost has been the thing holding you back, it's worth checking what you'd actually be trading away before assuming it's the encryption.</p><p><br></p><h2>The Myth That Storing Everything in One Place Makes Me an Easier Target</h2><p><br></p><p>This one has a certain logic to it, which is probably why it's so persistent. But the comparison it's implicitly making is wrong. The realistic alternative to a password manager isn't forty individually fortified passwords, it's the same three or four passwords reused everywhere with small variations, because that's what most people's memory can actually hold onto. A single breach at one of those forty sites then compromises accounts across all the others that share a password. One strong, encrypted vault protected by a unique master password and two-factor authentication is a considerably smaller and better-defended target than forty weak doors sharing the same key.</p><p><br></p><h2>The Myth That Only Tech-Savvy People Actually Need One</h2><p><br></p><p>I think this myth survives because early password managers genuinely were a bit fiddly to set up. The current generation mostly isn't. Autofill handles the day-to-day use without you thinking about it, browser extensions and phone apps stay in sync automatically, and the setup process for most tools now walks you through everything in a few minutes. If anything, I'd argue people who find security software intimidating are exactly who benefits most from a tool that removes the need to invent and remember unique passwords manually, since that's the part most people already struggle with.</p><p><br></p><h2>The Myth That My Master Password Is a Single Point of Failure</h2><p><br></p><p>This is the myth with the most truth buried in it, which is probably why it worries people. Your master password does matter enormously, and it should be long, unique, and not reused anywhere else. But a well-set-up password manager like <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">NordPass </a>isn't relying on that single string alone. Two-factor authentication on the vault itself, biometric unlock on your devices, and secure recovery options all add layers so that one guessed or leaked password isn't automatically game over. I'd rather protect one carefully chosen master password with those extra layers than rely on remembering forty separate weaker ones with no extra protection on any of them. If you want a fuller walkthrough, I've written separately about <a href="https://kellssecurity.com/blog/how-id-choose-a-password-manager-if-i-were-starting-today" data-mce-href="https://kellssecurity.com/blog/how-id-choose-a-password-manager-if-i-were-starting-today">how I'd actually choose a password manager if I were starting from scratch today</a>.</p><p><br></p><h2>What Finally Convinced Me These Myths Weren't Holding Up</h2><p><br></p><p>None of this means password managers are flawless or that you should stop paying attention once you've installed one. But most of the specific fears I hear repeated aren't really about the tools themselves, they're about a rough mental model of how encryption and breaches work that doesn't match reality. Once I actually read into it properly, the case for using one became a lot harder to argue against, and it's part of why I eventually moved away from relying on <a href="https://kellssecurity.com/blog/why-i-stopped-relying-on-my-browser-s-built-in-password-saving" data-mce-href="https://kellssecurity.com/blog/why-i-stopped-relying-on-my-browser-s-built-in-password-saving">my browser's built-in saving</a> instead. If you want a second opinion on password security more broadly, <a href="https://www.ncsc.gov.uk/cyberaware/home" target="_blank" rel="noopener" data-mce-href="https://www.ncsc.gov.uk/cyberaware/home">NCSC </a>has clear, current guidance on this, and my <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">free Safety Toolkit</a> walks through the basics I'd want anyone starting from zero to get right first.</p><p>I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.</p>

The Password Manager Myths I Had to Stop Believing

Kells Security Solutions

I teach people around the world how to spot online scams and stay safe on the internet, explained in plain English with no jargon. I cover phishing emails, two-factor authentication, password managers, VPNs and antivirus software, written for people who are not tech experts and want to protect themselves and their families.