The problem they address
Most people have dozens or even hundreds of online accounts. Good practice calls for a long, unique password for each, because when a password is reused, a leak from one website can let attackers try the same combination elsewhere. Remembering that many unrelated strong passwords is unrealistic, so people tend to reuse, simplify or write them down in insecure places.
A password manager is software that takes over the memorizing. It stores your credentials in an encrypted container, often called a vault, and fills them in when you sign in.
What a password manager does
Most password managers provide a similar set of functions.
- Stores credentials. Usernames, passwords and often notes, secure documents, payment details or recovery codes.
- Generates passwords. It can create long random passwords that you never need to read or type.
- Fills logins automatically. Through a browser extension or app, it enters credentials on the appropriate site.
- Syncs across devices. Many keep your vault available on a phone, laptop and tablet.
- Flags problems. Some warn about reused or weak passwords, or about sites known to have had a breach.
- Shares selectively. Some allow sharing a credential with family members or colleagues without sending it in plain text.
Some people rely on the password storage built into a browser or phone operating system, which offers a subset of these features. Dedicated tools often add sharing, stronger organization, and support for more types of data.
How the vault is protected
The central security idea is that your vault is encrypted with a key derived from your master password (and in some designs an additional secret). Without that key, the stored contents should be unreadable. The concept of scrambling data so only the right key can restore it is explained further in encryption basics.
In many designs, encryption and decryption happen on your own device, so the company running the service cannot read your passwords, only an encrypted blob. Not every product works this way, and the exact design is worth checking in the provider’s documentation.
Autofill can offer an incidental protection against fake sites. A manager matches credentials to the exact web address, so it will usually not offer your login on a lookalike page. If it does not offer to fill on a page you expected it to, that is a hint to stop and check, which is a useful defense against phishing scams.
What to weigh
Password managers are widely recommended by security professionals, but they involve real trade-offs.
A single point of failure. If your vault is compromised, many accounts are exposed at once. The risk is lower if the master password is strong and unique and a second factor protects the account. Compare this to the alternative: reusing a handful of passwords is also a form of putting your eggs in one basket, with weaker protection.
The master password matters enormously. It should be long, memorable to you, and used nowhere else. Some people use a passphrase of several unrelated words. If you forget it, many services cannot recover your vault, by design, because they never held the key. That protects you from the company but means you need a recovery plan, such as a stored emergency kit kept somewhere safe.
Trusting the provider. You are relying on a vendor’s software quality, security practices and continued existence. Software can have bugs, and providers can suffer breaches. Well-designed products aim to ensure that even a breach of their servers does not expose readable passwords, but no vendor can offer a guarantee. Reading independent security reviews and the company’s published explanation of its design is sensible, though you should look at them with some caution.
Device security still counts. A password manager cannot protect a device that has malware. If an attacker can record what you type or see your screen, the vault’s encryption does not help while it is unlocked.
Convenience and habit. Autofill reduces friction, but some people turn it off or stop using the tool if it is awkward. A secure tool that is not used protects nothing.
Cost and lock-in. Some features are free and others are paid. Moving between providers usually involves exporting and importing, which is possible but worth planning, since an export file may contain passwords in readable form and should be deleted securely afterward. The general idea of becoming dependent on one provider is described under vendor lock-in.
Pairing with a second factor
A password manager works well alongside multi-factor authentication. The manager handles the unique password, and the second factor guards against that password being stolen. Turn on a second factor for the manager account itself, as it protects everything else. Passkey sign-in may eventually reduce the number of passwords that need storing, and many managers already store passkeys as well.
Keep in mind that a code stored in the same vault as the password weakens the idea of separate factors. Some people deliberately keep these apart for the most important accounts, such as email and banking.
In workplaces
Organizations sometimes adopt a business-oriented manager so that staff can share credentials without messaging them, and so administrators can see which shared accounts exist and remove access when someone leaves. This supports wider identity and access management but also adds a system that must be managed well. Policy questions include what happens to a vault when an employee departs and whether personal and work credentials should be kept apart.
Getting started sensibly
- Choose a well-documented product from a provider you can evaluate.
- Create a long, unique master password and store a recovery option safely.
- Enable a second factor on the manager.
- Move your most important accounts first, such as email, finance and work.
- Replace reused passwords gradually; there is no need to do everything in one sitting.
This article is general information, not security advice for a specific situation. Individuals with particular concerns, and organizations with compliance requirements, should consult qualified professionals.