What a Password Manager Is, and Why You Need One
You cannot remember a hundred strong, unique passwords, and you should not try. A password manager does it for you, and it is the single biggest security upgrade most people can make.
Photo: Wikimedia Commons, via Wikimedia Commons (CC BY-SA)
Most people reuse the same handful of passwords across dozens of accounts. It is completely understandable, because nobody can memorize a hundred unique passwords. It is also the single most dangerous habit in personal security, and a password manager solves it cleanly. Here is what one is and how it works.
The problem it solves
When you reuse a password, a breach at one site puts all your accounts at risk. Attackers take email-and-password pairs leaked from one company and try them everywhere else, a technique called credential stuffing. Because reuse is so common, it works alarmingly often. The only real defense is a long, unique password for every account, which is impossible to do from memory. That is exactly the gap a password manager fills.
How a password manager works
A password manager is an app that stores all your logins in an encrypted vault. You remember exactly one strong master password, and the manager remembers everything else. When you visit a site, it fills in the right credentials for you.
Two features do the heavy lifting:
- Generating passwords. It creates long, random passwords, the kind no human would invent or remember, and stores them for you.
- Autofilling them. It types them in automatically, so you never have to know or retype them.
Because it fills passwords based on the site's real web address, a good manager also gives you quiet protection against phishing: if you land on a look-alike fake site, the manager will not recognize the address and will not autofill, which is a useful warning sign.
Is it safe to put all your eggs in one basket?
It is a fair question, and the answer lies in how reputable managers are built. The best ones use zero-knowledge, or end-to-end, encryption. Your vault is encrypted and decrypted on your own device using your master password, and the company never sees that password or your unencrypted data. Even if the provider is breached, attackers get only scrambled vaults they cannot read.
Your master password is everything
Because one password unlocks the vault, it needs to be strong and unique, and you must not reuse it anywhere else. A long passphrase of several random words is both strong and memorable. Protect the vault further by turning on two-factor authentication for the manager itself.
A password manager does not just store passwords, it makes it effortless to have a different strong one for every account, which is the thing security experts have asked people to do for decades.
Built-in versus standalone
Your web browser and your phone can already offer to save passwords, and using that is far better than reusing passwords. Dedicated password managers generally add more: they work across every browser and device, store more than just logins, flag passwords that are weak or caught in known breaches, and make sharing access safer. Either way, the important step is to start using one.
Passkeys: where this is heading
The newest evolution is the passkey, a login method designed to replace passwords entirely. Instead of a secret you type, your device holds a cryptographic key and unlocks it with your fingerprint, face, or PIN. Passkeys are phishing-resistant by design, and password managers are increasingly able to store and sync them. Passwords are not disappearing overnight, but passkeys are the clear direction of travel.
The takeaway
If you do one thing to improve your digital security this year, make it this: install a reputable password manager, let it generate a unique password for every account, and protect it with a strong master passphrase and two-factor authentication. It turns the impossible task of remembering a hundred passwords into remembering one.