On website you can put in your password and it accepts it as PIN.

On the phone the Rep needs the PIN if you are changing the account from which the miles are taken for an award booking.

I did not know COdbaUA can only take miles from the account which you log in to make the award booking versus AA can take miles from any account as long as the account owner is on the PNR. The rep needs the PIN in order to do the change.

+1 for 1password. I wouldn't be able to live without it!

They also need the PIN to pull the upgrade instrument from your account.

Personally, I use an algorithm to come up with a unique password for each site. Here's an example:

Take the first, second, fourth letter of the domain name (e.g, www.chase.com) would be chs.

Capitalize the second letter.

This would be cHs

Add a standard suffix using one of the following website types:

1. regular websites like flyertalk.com, -- audi12
2. commerce websites like amazon.com, -- volvo09
3. financial websites like credit cards -- jeep08
4. personal finance like stock brokers, banks, -- f0rd11 (replace o with 0, a with @, e with 3)

So for www.chase.com, I might use cHsjeep08

The algorithm does have a flaw in that a website URL could change if a company/business is acquired and they change the domain name.

But by using some sort of algorithm, I find it easy to come up with a unique password for each site.

Add Virgin Atlantic to the list. A couple of years ago, I needed to get a reminder of my user name ... after establishing my identity and telling me my user name, the agent decided to be extra helpful and remind me of my password "It starts with a type of animal". Ooookay.

www.lastpass.com rules

In addition to some of the good app/site suggestions others have given, you could also consider a simple do-it-yourself spreadsheet on Google Drive that would be accessible both online and offline from any device, automatically updates/saves each time you make a change, and is protected by the same password used by your Google Account.

LinkedIn. Oops, my bad - only the Russian hackers can see your passwords there.:mad: