@techpence is right:
We kept IT passwords on a paper sticked to wall-board in the IT office of a national bank, visible to the entire IT team.
Who can remember over 100 system passwords that change monthly?
The paper on the wall was our single source of truth for passwords.
As IT guys, we know pen testers randomly appear in the office, sit at a random desk, and search computer file systems for vulnerabilities. I've never seen one looking at the wall next to them.
All passwords were different for each system, formatted like:
MainPassword.YEAR.MONTH.SYSTEMNAME!
Examples:
XavierKara.2026.01.AWS!
XavierKara.2026.01.AZURE!
XavierKara.2026.01.OFFICE365!
XavierKara.2026.01.GMAILADMIN!
XavierKara.2026.01.GMAILAPI!
Many cloud systems force monthly password changes, so you only update the month.
If a cloud system's password policy was extra strict, it might add a character, like:
XavierKara.2026.01.CRM!
We mostly took photos of the passwords on our mobile phones for remote work.
To assign responsibility to the dev team, our manager asked us to take selfies with the password paper, so we were more careful sharing photos online. In case of a leak, the manager could identify the person.
As the IT team, this protected us from many pen-tester assumptions & got higher rates from their tests.