For: anyone keeping their admin-panel and account passwords in a Google Drive doc or spreadsheet, wondering "is this safe?" Here's the honest answer. No attack steps — just how to store them safely.
This site's view: the problem isn't 'using Drive,' it's 'plaintext'
A common misconception is "putting it in the cloud is bad." It isn't. The real problem is having it in plaintext, in a list. Syncing an encrypted password vault (e.g. a KeePass .kdbx) via Drive is a normal, safe practice worldwide — the file is just ciphertext without its master key.
Conversely, no matter how locked-down your Google account is, if the contents are a plaintext table, anyone who gets into that account reads everything. Think in terms of "readable without your key, or not" — not cloud vs not-cloud.
Why a plaintext list is dangerous
It's tempting to think "it's in a Google account with a solid password, so it's fine." But a plaintext list stacks up its own risks.
Concretely, any one of these leaks the entire list.
Google account takeover
Granting a rogue connected app
Phishing via manual copy-paste
Device and share-link sprawl
And Google Drive's own encryption is the kind Google itself can read through, not encryption designed for secrets. Make secrets unreadable without your key before you hand them to any host. That's the rule for handling secrets (same idea as in .env files and secrets).
A scale from dangerous to safe
Even "stored on Drive" varies enormously by what's inside.
✗ plaintext table
typed straight into a doc/spreadsheet
△ encrypted zip
password-protected archive; tedious, so people stop using it
○ encrypted vault
a KeePass .kdbx synced via Drive
◎ password manager
Bitwarden/1Password; autofill + monitoring
For common places people keep passwords, here is whether the contents can be read once someone is inside your Google account (or your computer).
| Where it's kept | Readable once someone is in? | Verdict |
|---|---|---|
| Typed into a Google Doc or Sheet | Yes, as is | Dangerous |
| Excel with worksheet protection only | Yes (it blocks edits; it isn't encryption) | Dangerous |
| Excel with "Encrypt with Password" | Not without the password to open it | Second best (no autofill or warnings) |
| KeePass .kdbx synced via Drive | Not without the master password | Safe |
| Google Password Manager with on-device encryption | Google says only you can read it | Safe |
| Dedicated password manager (Bitwarden / 1Password) | Not without the master password | Safe |
Two things decide it: whether the contents are encrypted, and whether you still copy passwords out by hand. An encrypted Excel file passes the first test, but because you copy from the table every time, the risk of pasting into a fake site remains.
How to store them properly
The best answer is to move to a dedicated password manager. These steps get you off a plaintext list.
Use a dedicated password manager
Make the master password long and unique
Put phishing-resistant MFA on the manager and your Google account
Once migrated, delete the plaintext list for good
Move to passkeys where you can
A plaintext list in Google Docs
- one account taken over and everything leaks
- you can paste into a fake site by hand (no phishing defense)
- no breach detection, autofill, or versioning
- connected-app access can read the contents
A dedicated password manager
- contents stay encrypted when synced (the provider can't read them)
- won't autofill on a fake domain = phishing-resistant
- built-in strong generation, breach monitoring, history
- protected by a master password plus MFA
If you still want to use Drive
There are two minimum conditions.
- Store only an encrypted vault file (.kdbx, etc.); never a plaintext doc/spreadsheet
- Put phishing-resistant MFA on the Google account
With both, Drive becomes just a place that syncs ciphertext, and the risk drops sharply.
Moving a spreadsheet into a password manager
You don't need to retype the list one entry at a time. A CSV file (a plain table format) lets you import it in one go.
Pick where it's going, then download as CSV
In Google Sheets: File > Download > Comma-separated values (.csv). This CSV is the unencrypted list itself, so plan to import and delete it on the same day.
Rename the columns to match the importer
Google Password Manager needs url, username and password as the first-row headers. Bitwarden has its own headers (name, login_uri, login_username, login_password and so on). If the names don't match, the import fails, so follow the sample in your manager's help page.
Import it
In Google Password Manager, go to passwords.google.com > Settings > Import. In Bitwarden's web app, use Tools > Import. Google takes up to 3,000 passwords at a time.
Delete the CSV and the original list
Delete the downloaded CSV and empty your computer's recycle bin. Both Google and Bitwarden tell you to delete this file after importing. Delete the original spreadsheet on Drive too, then delete it forever from the Drive trash (it is removed automatically after 30 days, but it stays until then).
Change the important ones first
Starting with the accounts where a leak would hurt most (email, online banking, site admin panels), switch to new passwords generated by the password manager. For as long as they sat in the list, anyone inside your Google account could read them.
How to check your own setup
Even after "I moved everything," old copies and sharing settings often remain. Check these four things in your own account.
Search Drive for the word password
Drive search looks at the text inside files, not only file names. Search for "password", "pw", "login" and similar, and add type:spreadsheet or type:document to narrow it to sheets and docs. Check shared drives and files others have shared with you as well.
Check the sharing setting of anything you find
Select the file, open Share, and see whether General access is set to "Anyone with the link". With that setting, anyone who has the link can open the file without signing in to a Google account. If you can't delete it yet, switch it to Restricted.
Review apps that can access your account
The linked apps page of your Google Account (myaccount.google.com/linkedapps) lists the apps you have given access to your Google Account. Remove access for anything you no longer use or don't recognize.
Check your Downloads folder and any Excel files
Look for old .csv or .xlsx exports. If you still keep an Excel list, make sure it uses File > Info > Protect Workbook > Encrypt with Password, not just worksheet protection.
While you're there, confirm that your Google account sign-in uses a passkey or 2-Step Verification (→ MFA guide).
Common mistakes and how to fix them
- Deleting the rows but keeping the file: Google Docs and Sheets keep a version history, and earlier versions can be opened and restored. After migrating, delete the whole file, or delete the version history as the owner.
- Relying on worksheet protection: Microsoft says it is not a security feature. To make the contents unreadable you need to encrypt the whole file.
- Leaving the migration CSV in Downloads: anyone who can use the computer can open it. Delete it right after importing.
- Writing the encrypted file's open password in the same Drive: if someone gets into the Google account, they get both. Keep that one password in your head or on paper at home.
- Using a spreadsheet to share passwords with family or a team: use the password manager's sharing feature instead. When someone leaves, you can remove just their access.
A real example: what was readable in one place led to the next set of credentials
In June 2026, the Japanese crowdfunding platform CAMPFIRE published the results of its investigation into unauthorized access. According to the company, a GitHub credential issued by an employee was misused by a third party, and information viewable on GitHub was then used to search for and obtain credentials for a cloud environment used for internal business. The company says personal data in 225,846 unique affected-user records may have been exposed (see our write-up of the CAMPFIRE breach).
That case is about a company's development environment, but the pattern is the same as a personal password list. When someone gets into one account and finds other credentials readable there, the damage doesn't stop at that account. Keeping a plaintext password list inside your Google account means the next set of credentials is already waiting for whoever gets in.
What this site does itself
This site keeps secrets — passwords, keys, connection strings — out of shared docs, out of the code repository, and out of handoff notes, never in plaintext (→ keeping secrets out of git). Everyday logins live in a password manager, and important accounts are doubled up with phishing-resistant MFA. The reason is simple: never build a state where breaching one place exposes everything. A plaintext list is a typical way to create exactly that state, so we avoid it.
Read next
- Check for leaks: How to check if your password was leaked (Have I Been Pwned)
- Data: how do people store passwords? ── what the survey data shows, and the safe way
- How it works: how to store passwords safely (hashing + salt) ── after your own storage, how the service should store them
- Glossary: what hashing is / what a salt is
- Basics: the security baseline checklist (the accounts to protect first, protecting secrets)
- Glossary: .env files and secrets
- Case study: the CAMPFIRE breach (from GitHub to an internal cloud)
- Self-hosting: keeping secrets out of git / self-hosted Git vs GitHub
- Tool: password strength checker
Sources
- Microsoft Support, "Protection and security in Excel" (worksheet protection is not a security feature; file encryption): support.microsoft.com
- Google Drive Help, "Find files in Google Drive": support.google.com / "Share files from Google Drive" (General access): support.google.com / "Delete and restore files" (trash kept for 30 days): support.google.com
- Google Docs Editors Help, "Check activity and file versions" (version history and deleting it): support.google.com
- Google Account Help, "Manage links between your Google Account and third-party apps": support.google.com
- Google Account Help, "Import passwords" (CSV headers, limits, delete after import): support.google.com / "On-device encryption": support.google.com
- Bitwarden Help, "Import Data to Bitwarden" and "Condition a Bitwarden .csv or .json": bitwarden.com / bitwarden.com
- CAMPFIRE, Inc., investigation results on the unauthorized access (June 2, 2026, Japanese): campfire.co.jp