The Web's Most Useful Sites

Password Managers

New Web services have inevitably led to an overflow of log-ins and passwords, which many people cope with by foolishly reusing passwords or creating an unencrypted password file. A better solution is an online Web service that can help you organize your passwords and let you access them at a moment's notice.

Winner: Just1Key ($2.49 per month) is the only online password service with real security. To prevent hackers from grabbing your passwords, Just1Key uses a Java applet in a browser window, into which you enter your central password; the applet encrypts the password before sending it to the server. Once that's authenticated, Just1Key sends your passwords list back to you in encrypted form; the applet then decrypts the list so you can read it.

You can cut and paste passwords as needed, but the software is bare-bones. Passwords reside in a single list, which can be unwieldy. You get no search, import, or export functionality, but you can access your passwords on a mobile device, as long as its Web browser is capable of an SSL-based log-in.

Runner-up: A free service founded in 1998, PasswordSafe relies solely on SSL for password transmission; there's no indication about what kind of encryption it uses on the server side. The interface--wisely free of JavaScript--is uncluttered, has a search function and a password generator, and lets you create categories.

While the last feature makes this site a great way to store registrations for nonsensitive sites such as bookmark managers, it isn't really secure enough to store sensitive information like bank account passwords.

Also-ran: Agatra, whose site was still in beta at this writing, says it encrypts passwords using the industry-standard Blowfish algorithm, but it expects you to log in on an unsecured home page. Once you sign in, Agatra sends your passwords via an SSL connection to your browser. For the most popular sites, Agatra will automatically log you in.

While this setup is handy, the convenience may not make up for the security weaknesses raised by the site's reliance on inherently vulnerable JavaScript.