Microsoft Authenticator to Drop Password Storage

Users of Microsoft Authenticator have just a few weeks to move passwords away from the tool. From August, 2025, passwords will be inaccessible and in some cases deleted.

Microsoft Authenticator is an app with a range of security features. A key one is as a two-factor authentication tool for websites. In simple terms, the website asks Microsoft to verify somebody's identity, the users does so in the app (for example with a fingerprint scan), and then Microsoft confirms the user is who they say there are. This means the website doesn't have to store login details for the user.

Authenticator also has some password features such as generating, storing and autofilling passwords, very like a password manager tool. Microsoft is now removing this feature as part of its overall strategy of moving away from passwords. It says that ironically this trend across the tech industry is making passwords riskier as hackers are stepping up password-based attacks while they still have time to do so.

Autofill Removal

The change to Authenticator is coming in three stages. The first has already taken effect and means users can no longer save a new password in the app.

The second takes effect in July and means users will no longer be able to use autofill. That will significantly reduce the usefulness of the tool. Stored payment details such as card numbers will also be deleted.

In August, Microsoft will make saved passwords inaccessible in Authenticator. In some cases the password will simply be hidden but in cases where Authenticator generated the password, it will be completely deleted. (Source: techradar.com)

Edge Transfer Suggested

Microsoft advises users switch to using Edge as their password management tool. That involves installing the Edge app on a mobile device and then setting it as the default app for autofill in the device's settings tool.

Saved passwords created by the user are transferable, though users will first need to add any passwords generated by Authenticator. The passwords should transfer automatically to Edge through Microsoft account syncing.

For other password management tools, users can go to "Settings > Export Passwords" in Authenticator to create a CSV format file that they can transfer to another tool. This file will be unencrypted so users should delete it as soon as the export/import process is complete. (Source: lifehacker.com)

What's Your Opinion?

Do you use Microsoft Authenticator to manage passwords? Is Microsoft right to remove this feature? What's your preferred way to keep track of passwords and other login details?