Security Veterans Make the Case for the $4 Paper Password Book

Stacks of AU$4.90 (about US$3.51) password books found for sale at an Australian post office went viral this week, and the reaction from security professionals was not the reflexive cringe you might expect. Instead, thousands of replies converged on a more nuanced take: writing passwords in a physical notebook is not the security sin it was made out to be, provided you understand exactly what it protects against and what it does not.

For a large chunk of the last two decades, writing a password on paper was shorthand for bad opsec, the kind of habit auditors flagged and IT departments lectured people about. Password managers, autofill, breach monitoring, and now passkeys pushed the industry toward software-only credential storage. A pen-and-paper vault looked like a relic next to a tool that can generate a unique string for every site and warn you the moment one leaks.

Why Paper Fell Out of Favor

The case against paper is straightforward, and none of the security professionals now warming up to it are disputing it. A password book cannot autofill a login form, cannot generate a random string on demand, and cannot flag reused or breached credentials. It also cannot store a passkey at all, a real gap now that major platforms are pushing users toward the passwordless authentication standard built on FIDO2 and WebAuthn. Lose the book, and every account inside it needs a fresh recovery process, all at once.

The Threat Model Argument

What has changed is the argument for why paper can still be the right tool for a specific job. Threat modeling, the practice of asking who is actually likely to attack you and how before deciding what to defend against, is the core of the case. A password manager mainly defends against remote, internet-scale attackers: credential-stuffing bots, phishing kits, and infostealer malware that scrapes a browser’s saved logins from thousands of infected machines at once. A password book defends against a very different attacker, one who has to be physically present in your home.

The UK’s National Cyber Security Centre draws exactly this distinction in its official guidance on managing passwords. Under the heading “Choosing to write passwords down,” the NCSC states that “some people prefer to write passwords down in a journal or dedicated password book,” adding that this “can suit certain scenarios, for example where people need regular support, say from family members, to manage their online affairs.” Its reasoning is blunt: “This can be done safely because an attacker would need physical access to where the passwords are stored.”

That framing lines up with how The Register described the reaction to the Australian post office find: with infostealer malware and reused, unchanged passwords doing far more damage at internet scale than anyone breaking into a house to read a notebook, a password book kept at home can be a reasonable upgrade over the weak, recycled password habits it would be replacing.

Where the Paper Method Falls Apart

The NCSC’s endorsement comes with conditions that are easy to miss in a viral social media thread. “Consider where you’ll keep the written down passwords and who will have access,” the guidance warns. Anyone who does get access, it adds, “will be able to remember them or make a copy, possibly without your knowledge.” The agency also flags a legal wrinkle: “Make sure you are not breaking the terms and conditions of the service you are creating a password for, such as some online banking services, which forbid users to write down their passwords.”

The office is where the argument collapses entirely. A password book on a desk does not benefit from the physical-access barrier the NCSC describes, because a corporate office is already full of people who are not supposed to be trusted with anyone’s credentials, including hired ones. Security consultant Alethe Denis has described to The Register how her pentest team once dumpster-dived a client’s trash to recover Wi-Fi credentials, walked straight into a conference room, and planted a data-stealing implant that quietly pulled data over the company’s own network for more than a week, the whole operation kicked off by physically stolen secrets. A password book left in an unlocked desk drawer is exactly the kind of artifact that scenario is built to find. IT teams that insist on password managers at work are not being paranoid, they are defending against a threat model where physical access to the building is the attacker’s entire plan.

The One Place Paper Still Wins: After You’re Gone

There is a scenario where a password book stops being a compromise and becomes the better tool outright: after someone dies. The Register calls this the poignant case for keeping one, noting that having a password record, or at least a plan to share credentials, spares grieving family members the ordeal of fighting platforms for account access while they are trying to grieve.

Independent estate planning guidance backs this up. Legal resource FindLaw recommends creating a written list of “each service and its access information,” covering computers, email, financial accounts, and other online services, and storing that document in “a waterproof, fire-proof home safe,” updated regularly as accounts change. FindLaw also advises that a will should formally point to that record, since “your will should refer to your digital estate plan and appoint a personal representative to manage your digital accounts and assets after your death.” A password manager’s cloud vault does not help an executor who does not have your master password and cannot pass your biometric checks. A locked box with a notebook inside it does.

How to Use a Password Book Without Undermining the Point

None of this is an argument for abandoning password managers. It is an argument for matching the tool to the threat, and being deliberate about a few details if a paper backup is going to be part of the setup:

• Keep it at home, not at work or in a bag carried around daily. The NCSC’s physical-access reasoning only holds if physical access is actually hard to get.
• Write unique, strong passwords, not the same recycled one for every site. A password book full of reused weak passwords still fails the moment it is read even once.
• Store it away from the devices it unlocks, ideally in a fire-resistant, lockable container rather than a desk drawer or a kitchen counter.
• Check the service’s terms first. Some banks and financial platforms explicitly prohibit writing passwords down at all.
• Use a password manager or passkeys wherever they are supported, and reserve the paper book for the accounts, or the people, that genuinely need the low-tech fallback.
• Treat it as part of a digital estate plan, not just a login cheat sheet, and tell a trusted person exactly where it is kept.

The AU$4.90 notebooks quietly restocked at an Australian post office are not a security breakthrough. They are a reminder that “secure” was never an absolute property of a tool. It is a property of a tool matched to a specific threat, and for the right person, in the right room, a pen and a notebook still clears that bar.