Cleaning Up a Household's Passwords? Where the Hours Go and What Actually Drives the Bill

The subscription is almost never the expensive part. When someone asks what it costs to put a household's passwords in order, they are usually pricing a manager at so many dollars a year and stopping there, which is like pricing a roof by the shingles. Having run this exercise for families, two-person businesses and a few estates where the account holder had died, I can say the money and the hours land somewhere else entirely: in finding the accounts, in proving you own the ones whose recovery address no longer exists, and in the two or three logins that two people have been sharing for a decade.

Count the accounts before you buy anything

The first hour is diagnostic and it is the hour that sets every number after it. Export the saved logins from each browser on each device, then search the primary inbox for the words that appear in signup and receipt mail, and you will typically surface several times what anyone guesses. A household that estimates twenty accounts tends to find well over a hundred once old retailers, utility portals, school systems, insurance logins and one abandoned side business are counted. That inventory is the cost driver. Everything downstream, the tool tier, the hours, the number of phone calls to a support line, scales off it.

Sort the inventory into three piles rather than working alphabetically. There are accounts that move money or hold identity documents, accounts that hold something you would miss but nobody would monetize, and accounts you will simply close. The first pile is usually small, often under fifteen entries, and it deserves the slow treatment. The last pile is often the largest and costs nothing but the discipline to delete rather than migrate. People who skip the sort pay for it by spending equal care on a bank and a shoe store, which is how a two-evening job becomes a resented three-week one.

The hours go into recovery, not into typing new passwords

Generating and storing a strong password takes seconds now, which is why the old advice about composing memorable strings has quietly fallen away. The National Institute of Standards and Technology is responsible for the federal digital identity guidance that most of the current thinking traces back to, and the direction of travel has been consistent: longer, unique, machine-generated, changed when there is a reason rather than on a calendar. That part is nearly free. What is not free is the account whose recovery email is an address from a former employer, or a defunct provider, or a spouse who no longer has the phone number attached.

Budget those separately, because they behave differently. A clean account takes under a minute. A stranded account takes a support queue, an identity check, sometimes a mailed letter or a notarized form, and a second contact when the first one fails. In my experience a household of a hundred accounts has somewhere between three and a dozen of these, and each one can eat forty minutes of real attention spread across days. Doing them first, while patience is intact, is the single scheduling decision that most reliably keeps a cleanup from stalling half finished.

What the tools cost, and what moves that number

Priced honestly, the software is the small line. Reputable managers sell an individual tier and a family tier, billed annually, and the family tier covering five or six people usually costs less than two individual seats, so the arithmetic favors putting everyone on one plan even if only one person is enthusiastic. Hardware security keys are the other purchase worth making, and they are sold and used in pairs: one on the keyring, one in a drawer or a safe deposit box. Buying a single key is the classic false economy, because the backup key is the thing that prevents a lockout from becoming a recovery project.

Three things move the total. Household size, obviously, since each person adds their own inventory and their own recovery tail. Whether a small business is tangled into the same accounts, which brings shared logins, a payment processor and often a domain registrar that nobody has signed into since setup. And how much of the work you do yourself. Paying a technician means paying by the hour for the recovery calls, which are the slowest and least skilled part of the job, so the usual split that works is hiring help for the setup and the money accounts and handling the long tail at your own kitchen table.

The costs of leaving it, and how they show up

The failure I see most is not a dramatic breach. It is a lockout at a bad moment: a phone replaced without moving the authenticator codes, a login needed on the morning of a closing, an executor who cannot reach the utility account to stop a payment. Each of those is billed in urgency, in a day off work, in a locksmith-grade fee for expedited help. The second failure is one password reused across a retailer and an email account, which turns somebody else's breach into your problem, and which the inventory exercise catches for free.

Set a maintenance rhythm that matches the new advice rather than the old. Nothing needs rotating on a schedule; things need rotating when a service reports a compromise or when a shared password stops being shared with the right people. Once a year, usually when tax records come out anyway, reopen the inventory, check that recovery addresses and phone numbers still exist, confirm the backup key is where you left it, and close whatever has gone unused. That review runs under an hour on a maintained vault, which is the whole return on the first weekend you spent.

Price the job as an inventory plus a recovery tail plus a modest annual subscription, in that order of importance, and the estimate will hold. Price it as a subscription and it will not.