How Password Managers Work and Why You Should Use One

A password manager stores all your passwords in an encrypted vault, fills them in for you, and creates new strong ones. Instead of remembering dozens of passwords, you remember one. It's the single most effective step most people can take to protect their accounts.

How it works

• The vault: your passwords are encrypted on your device before being stored or synced.
• The main password: opens the vault. Good managers turn it into an encryption key with a slow process designed to make guessing very hard.
• Zero knowledge: with most major managers, the company only stores encrypted data and can't read your passwords.
• Sync: the encrypted vault syncs between your devices.

Why autofill matters

A password manager fills a login only on the site it was saved for. If a fake site looks exactly like your bank but has a different address, the manager won't offer your password, a useful warning sign. See spotting fake websites.

Why it matters

Reusing passwords means one breach can open many accounts. See credential stuffing. A manager makes a unique password for every site practical.

The main options

• Built into your browser or phone: Google Password Manager and Apple's Passwords app are free and easy.
• Bitwarden: open source, with a free plan.
• 1Password: paid, polished, good for families and teams.
• Proton Pass: from the company behind Proton Mail.
• KeePassXC: stores the vault as a file you control, without a cloud service.

What about breaches?

In 2022, attackers stole encrypted customer vaults from LastPass. Vaults protected by strong main passwords remained very hard to crack; weak main passwords were the risk. The lesson is to choose a strong main password and a manager with a good security record, not to avoid password managers.

Setting one up well

1. Choose a long main passphrase, such as four or more random words. Don't use it anywhere else.
2. Turn on two-step verification for the manager.
3. Save the recovery kit or recovery code somewhere safe offline.
4. Import saved browser passwords, then change reused ones, starting with email and banking.
5. Use passkeys where sites offer them; most managers store them.

Copying passwords safely

Autofill is safer than copying and pasting. If you do copy a password, it sits on your clipboard. Clipboard Guard blocks websites from reading your clipboard. See copying passwords safely and auditing saved passwords.