The problem they try to solve
Most people have dozens of online accounts. Strong passwords are long and unpredictable, and every account should ideally have a different one. Nobody can memorize that many. So people reuse passwords, choose easy ones or keep them in places that are not secure.
Reuse is the biggest weakness. If one service is breached and your password for it is exposed, attackers often try the same email and password combination on other services. A unique password for each account limits the damage to one account.
A password manager is a tool that stores your logins in an encrypted collection, often called a vault, so you only have to remember one strong password or passphrase to open it.
What a password manager does
In general terms, these tools typically offer several functions. Features vary between products, so check what any particular tool actually provides.
- Storing logins. Usernames, passwords and sometimes notes are kept encrypted.
- Generating passwords. The tool can create long random passwords so you do not have to invent them.
- Filling them in. Many can fill credentials automatically in a browser or app.
- Syncing across devices. Some can keep your vault available on a phone and a computer.
- Flagging problems. Some warn about reused or weak passwords, or about accounts affected by known breaches.
- Storing other items. Secure notes, recovery codes or payment details may also be supported.
Browsers and devices often include basic built-in versions of this idea. Separate dedicated tools tend to have more options, though a built-in one can be a reasonable step up from reusing passwords.
How this supports unique passwords
The value is simple. Because the tool remembers the passwords, each one can be long, random and different. You no longer need to choose between security and convenience for every account. Autofill can also help you notice a fake page: if a manager does not offer your saved login on a site, the address may not match the real one, which is worth pausing over. That is a useful clue when dealing with phishing emails.
Trade-offs to weigh
Password managers are widely recommended by security professionals, but they are not risk-free.
Single point of failure. Your vault is protected by one master password. If it is weak, or if someone gets it, the consequences are larger. The usual advice is a long, unique passphrase that you never use elsewhere.
Forgotten master password. Many tools are designed so that the provider cannot recover your vault for you. That protects your privacy but means a lost master password may mean lost access. Find out what recovery options exist before you rely on one.
Trust in a provider. You are placing sensitive data in a product built by someone else. Look at how clearly the service explains its security approach, whether it publishes independent reviews of its software, and how it has handled problems in the past. Do not assume any tool is immune to flaws or attacks.
Convenience risks. Autofill and syncing add convenience but can add exposure if a device is compromised. A device infected with malicious software may defeat many protections.
Switching costs. Moving between tools is usually possible through export and import, but it takes effort, and exported files may be unencrypted, so handle and delete them carefully.
Not everything fits. Some shared accounts, older systems or work logins may not work neatly with a manager, and your workplace may have its own rules.
Making it work in practice
- Choose a strong master passphrase. Several unrelated words strung together are often easier to remember than a short jumble, and length matters. Do not reuse it.
- Turn on two-factor authentication for the manager itself and for your important accounts. Options typically include codes from an app, text messages or physical keys, and they differ in strength.
- Migrate gradually. Start with the accounts that matter most: email, banking and anything used for password resets. Replace weak or reused passwords as you log in.
- Keep recovery details safe. Some tools provide a recovery key or emergency option. Store it somewhere secure and separate, such as a locked drawer, and consider who could access your accounts if something happened to you.
- Lock it. Use automatic locking, a device passcode and updated software. Keeping software updated closes known security holes.
- Back up thoughtfully. Consider whether the tool offers an encrypted export, and apply the same file backups habits you use for other important data.
Alternatives and combinations
Some people prefer to write passwords in a notebook kept at home. This is not ideal for everyone, but a notebook is safe from remote attackers, and may suit someone who is not comfortable with software, provided it is kept secure. What matters most is that each account has its own strong password and that important accounts have extra protection.
No approach is perfect, and a password manager will not protect you if you hand a password to a fraudster. It is one part of a set of habits, and it works best alongside caution about links, updates and sharing personal data.