What a password manager does
A password manager is an application that creates, stores and fills in your sign-in details. Instead of remembering dozens of logins, you remember one strong secret, usually called the master password, and the manager handles the rest. Because it can generate long random passwords for every account, it removes the habit that causes the most trouble: reusing one password in many places.
Most managers also fill in credentials only on the site they were saved for, which gives a small protection against fake login pages, since a manager that does not offer to fill in a password on an unfamiliar address is a hint that something is wrong. Many also store other sensitive items such as secure notes, recovery codes and card details, and can warn about weak or repeated passwords. This article is about the manager itself. Choosing the individual passwords it generates is a separate topic, covered in our guide to strong passwords.
How a secure one is designed
You do not need to build one yourself, and writing your own security software is generally a poor idea. But understanding the design helps you judge the options.
The vault is encrypted
Your saved items are kept in an encrypted container, often called a vault. Data encryption means the contents are unreadable without the right key. In a well-designed manager, that key is derived from your master password using a deliberately slow process, which makes guessing attempts expensive for an attacker.
Encryption happens on your device
In many designs, the vault is encrypted on your device before anything is synced to a server. The provider then stores only scrambled data and, in principle, cannot read it. This is sometimes described as a zero-knowledge design. It is worth checking whether a provider describes its approach clearly, but descriptions are claims, and you are still extending a degree of trust.
The master password is never stored in readable form
A secure manager does not keep your master password in plain text, and the provider typically cannot recover it for you. That is good for security and has a consequence: if you forget it, you may lose access to the vault unless you set up a recovery method in advance.
A second layer protects the account
Good managers support multi-factor authentication, so a stolen master password alone does not open the vault. Because the vault holds so much, this is one of the most valuable places to turn it on.
What to look for when evaluating one
Without naming any particular product, these are reasonable questions to ask:
- Is the security design explained? Look for plain documentation about encryption, how keys are handled and what the provider can and cannot see.
- Has it been independently reviewed? Many reputable providers publish the results of outside security reviews. Check that the information is recent and comes from a source you can verify.
- Is it actively maintained? Regular updates and a clear way to report security problems are good signs. An abandoned tool can collect unfixed flaws.
- How is a breach handled? Providers occasionally have incidents. A good sign is a clear, honest public account of what happened and what users should do.
- Does it work where you need it? Consider your phone, computers and browsers, and whether family members or colleagues can share items safely.
- What happens if you stop using it? You should be able to export your data in a standard format, and you should treat any exported file as highly sensitive.
- Is it built into your system, or separate? Browser and operating system managers are convenient and may be adequate for some people, while dedicated managers often offer more features. Either is generally better than reusing passwords.
A free tool can be perfectly reasonable, and a paid one is not automatically safer. The ownership, transparency and track record matter more than the price.
Setting one up safely
- Choose a strong master password. Make it long, unique and not used anywhere else. A passphrase of several unrelated words is easier to remember than random symbols. Do not store it in a file on your computer.
- Turn on a second sign-in step for the manager account, using an authenticator app or a physical security key if supported.
- Save the recovery information somewhere safe. Many managers provide a recovery key or emergency kit. Print it or store it offline in a secure place, separate from your devices.
- Lock it automatically. Set the app to lock after a period of inactivity and when the device sleeps.
- Move over gradually. Start with your email, banking and work accounts, replacing each old password with a newly generated one. You do not have to finish in one day.
- Remove old copies. Delete passwords saved in spreadsheets, notes or browsers you no longer use for this purpose.
Habits that keep the vault safe
- Keep your devices updated. A manager cannot protect passwords on a device that already has malware running on it, and the different malware types, such as keyloggers, are designed to capture what you type.
- Be careful with fill prompts. If a manager does not recognize a site, take a second look at the address, since this is a common sign of social engineering.
- Share carefully. Use the manager’s sharing feature rather than sending passwords by chat or email, and remove access when people leave.
- Treat sign-in alerts seriously. If you see activity you do not recognize, follow the steps for compromised accounts: change passwords, sign out other sessions and review recovery settings.
- Review the vault now and then. Update weak or duplicated entries and delete accounts you no longer use.
Where a password manager fits in the bigger picture
Single sign-on can reduce the number of passwords people need inside a workplace, but a manager is still useful for the many accounts that sit outside it. In a team, shared logins are often a weak point, and a manager with controlled sharing is generally safer than a shared document, though service accounts and similar shared credentials still need an owner and a plan for rotation.
A password manager is not a cure-all. It will not stop you approving a fake prompt, installing a malicious file or giving a code to someone on the phone. It also concentrates your logins in one place, so a very strong master password and a second sign-in step are essential. For most people, though, the trade-off is favorable: a single well-protected vault is typically a smaller risk than dozens of weak or repeated passwords. Security outcomes are never guaranteed, so pair it with updates, caution with messages and good backups.