Writing down passwords can be acceptable security practice if done correctly, though using a password manager is superior for most users. The critical factor is how and where you write them down - physical security matters enormously.
The traditional advice 'never write passwords down' assumes digital attackers are the only threat. In reality, most people aren't targeted by sophisticated hackers - they're vulnerable to password reuse, phishing, and service breaches. For non-technical users who would otherwise use weak or reused passwords, writing strong unique passwords on paper and storing it securely is often better than the alternative.
When writing passwords is acceptable: you store the paper in a physically secure location (locked safe, safety deposit box), you use strong randomly generated passwords (not weak ones you invented), you're protecting against remote attackers (not people with physical access), you have good physical security (locked home, office with access controls), and you cannot or will not use a password manager.
Security Considerations
if your primary risk is remote hackers (credential stuffing, phishing, service breaches), physical password storage is orthogonal to that risk. Attackers in Russia can't steal paper from your locked desk drawer.
How to safely write passwords: use a notebook or paper kept in a locked drawer, safe, or other secure location; never leave it in plain sight or in easily accessible areas; consider additional obfuscation (write partial passwords, use a personal cipher, or store different account components separately); physically destroy old passwords when changed (shred thoroughly); and never photograph or scan the written passwords (which converts them back to digital form).
Where NOT to write passwords: sticky notes on monitors, desks or keyboards (extremely insecure), unlocked desk drawers (minimal security), shared or public spaces, unencrypted digital documents labeled 'passwords', photos or screenshots (defeats the purpose of physical security), and cloud-synced notes apps like Evernote without encryption.
Password managers are still superior for most users because they: enable much longer passwords (32+ characters, impractical to manually type), provide encrypted digital storage (physical and digital security), offer automatic form filling (reducing typos and keylogger risk), support secure password sharing, integrate breach monitoring, and work across all devices seamlessly.
For critical master passwords (protecting password managers, encryption keys, Bitcoin wallets), writing them down and storing in a safe or safety deposit box is recommended backup strategy. If the master password is forgotten, all stored passwords become inaccessible. Physical backup prevents total loss while maintaining security.
Some experts recommend security keys over passwords entirely. Hardware tokens like YubiKey eliminate password memorization and typing. For supported services, this is more secure than any password scheme. However, compatibility is limited compared to passwords.
Best Practices
use a password manager for most accounts, write down the master password and store it in a safe, keep emergency access codes physically secure, use security keys for critical accounts where supported, and maintain an encrypted backup of your password vault.
Risk tradeoffs: writing passwords is vulnerable to physical theft, fire, loss - but resistant to remote hacking. Digital password managers are vulnerable to malware, keyloggers, service breaches - but resistant to physical theft. Using both provides defense in depth.
For average users: password managers are better. For high-value targets (executives, activists, journalists): consider physical storage of critical passwords in very secure locations, combined with password managers for daily use. For elderly or non-technical users: written passwords in secure physical locations may be more realistic than password managers they won't use correctly.