Layer 6 of 7 — you are here
Day Six · Companion to Chapter 9
The Keys
Five days of walls, and every wall has a key: the DNS login, the router admin, the Screen Time passcode, the streaming PINs. If those keys live on a sticky note, in a kid-readable notes app, or in your head under the name of your first dog — the fortress is a stage set. Day Six builds the keyring.
What I run: Apple Passwords
We're an Apple household, so I run the built-in Apple Passwords app. It's free, already on every device, and — the part that matters for this chapter — supports shared groups, so both parents hold the same keys without texting passwords to each other.
- Open the Passwords app — it requires iOS 18 / iPadOS 18 / macOS Sequoia or later. On older systems the same passwords live in Settings → Passwords, but shared groups need everyone on 18/Sequoia or newer.
- Create a shared group: New Shared Group → name it (something boring — "Household") → add the other parent. Only the two parents. Kids get their own group later.
- As you complete the wall-keys checklist below, move each credential into the shared group.
- Make sure the vault itself is protected: both parents' devices need strong unlock codes, because the device unlock is now the key to the keyring.
Cross-platform alternatives
| Vault | What distinguishes it |
|---|---|
| 1Password | The family-plan gold standard: shared vaults with per-person access, works everywhere. Paid. |
| Bitwarden | Open source, generous free tier, family plan with shared collections. The value pick. |
| Proton Pass | Privacy-focused. Pass Family: six users with shared vaults plus private ones, ~$4/month annual. |
| Google Password Manager | Free and everywhere Chrome/Android is — but sharing is a one-time copy to a family-group member, not a synced shared vault. Fine for one parent's keys, weak as a household keyring. |
Mixed Apple/Android household? Pick a cross-platform vault. The convention below works in any of them.
The two-tier tagging convention
Every credential in the household gets one of two tags, right in its name:
KID-OK = daily keys a kid may hold for themselves.
Naming pattern: TIER · Person/Device — What
VAULT · House — DNS dashboardVAULT · House — Router adminVAULT · Kid's iPhone — Screen Time passcodeKID-OK · [Child] — School portalKID-OK · [Child] — Minecraft
The tier is in the name so it survives any export, any migration, any vault switch. The test for which tier: if a kid holding this key could weaken a wall, it's VAULT. Streaming account passwords are VAULT (the account password can change the profile PINs); the kid's own game login is KID-OK.
The wall-keys first move
Before anything else goes in the vault, capture the ~15 credentials that hold up the fortress. Tonight's checklist:
- DNS dashboard login (NextDNS or equivalent)
- Router admin password (changed from the sticker default — today, if you haven't)
- Mesh-system app account (Google Home / eero / etc.), if that's your router
- Screen Time passcode — each Apple device
- Family Link parent-account password
- Streaming account passwords — each service (the account, not the profile PINs)
- Streaming adult-profile PINs — each service
- Console family passcodes — Switch parental PIN, PlayStation restriction passcode, Xbox pass-key
- Both parents' primary email passwords — the master keys; everything resets through email
- Shared computer admin password
- Voice-assistant purchase PINs
Every one: unique, generated by the vault, never reused. The email accounts additionally get two-factor authentication turned on today if it isn't already.
Security-warning triage: the installment plan
The moment your vault sees your accounts, it will alarm you: dozens (maybe hundreds) of reused, weak, or breached passwords. Do not attempt to fix them all in one night — that's how people abandon vaults entirely.
- Open the warnings list (Apple Passwords: Security section; every vault has an equivalent).
- Fix the wall keys and both email accounts first — done above.
- Then: a few per week. It's item four of the Monthly Five's weekly-adjacent habits — triage five warnings, starting with anything marked "breached," then "reused," then "weak."
- Delete or update dead accounts as you meet them (remember the dead email rule — re-point before you close).
Passkeys: adopt wherever offered
A passkey replaces a password with a cryptographic handshake tied to your device — nothing to steal in a breach, nothing to phish, nothing for a kid to shoulder-surf. When any site offers "create a passkey," say yes; your vault stores and syncs them just like passwords. Keep the old password as fallback where the site allows both. Over time, your most important accounts stop having guessable keys at all.
Done when
- Both parents share one vault group with all ~15 wall keys, tagged
VAULT. - Router default password changed; email accounts on 2FA.
- The triage habit is scheduled — five warnings a week, not five hundred tonight.
- The convention is in place so every future credential lands in a tier on arrival.