Key Takeaways
Password Manager
A password manager is an app or service that securely stores all your login credentials — usernames, passwords, and sometimes payment details — in one encrypted place. Instead of remembering dozens of different passwords, you remember one strong master password and the app handles the rest. Most password managers also generate strong, unique passwords for you whenever you create a new account.
Password managers typically use AES-256 encryption and a zero-knowledge architecture, meaning the provider cannot see your stored data — only you can decrypt it with your master password.
Why Passwords Are Such a Problem
The average internet user has somewhere between 70 and 100 online accounts. That number keeps growing — email, banking, streaming, shopping, healthcare portals, loyalty programs. Each one asks for a unique login.
The predictable result: people reuse passwords. A survey by the security firm NordPass found that millions of accounts still rely on passwords like "123456" or "password." Even careful users often cycle through a handful of familiar passwords across many sites. That habit is exactly what attackers exploit — gain access to one account, and they can try the same credentials across dozens more. This is called credential stuffing, and it's responsible for a large share of account compromises. See why accounts get hacked even with careful habits for a fuller picture of what goes wrong.
The core problem is human memory. Strong, unique passwords are hard to remember. So most people don't use them. Password managers exist to remove that burden entirely.
How a Password Manager Actually Works
When you set up a password manager, you create one master password — ideally a long, memorable phrase. That master password encrypts your entire vault. The manager stores everything else: every username, password, and associated website, locked behind that encryption.
When you visit a login page, the manager recognises the site and automatically fills in your credentials. When you sign up somewhere new, it offers to generate a long, random, unique password — something like K7#mPqL9!wXr — and saves it for you instantly. You never have to think about it again.
80%
Of breaches involve weak or reused passwords
According to Verizon's Data Breach Investigations Report, the vast majority of hacking-related breaches exploit compromised credentials.
70–100
Average online accounts per internet user
Research from NordPass suggests most people have far more accounts than they actively track, making manual password management impractical.
AES-256
Encryption standard used by leading password managers
AES-256 is the same encryption standard used by governments and financial institutions to protect sensitive data.
Most password managers sync across your devices through an encrypted cloud connection, so the password you save on your laptop is available on your phone within seconds. Some offer a local-only option that stores everything on your device without cloud sync — useful if you prefer to keep data entirely off third-party servers.
The manager itself never has access to your unencrypted data. This zero-knowledge model means that even if the company's servers were compromised, attackers would get only scrambled, unreadable data.
Getting Started: What to Expect
Setting up a password manager is more straightforward than most people expect. The general process looks like this:
- Choose a reputable service and create an account.
- Create your master password. Make it long — a short phrase or sequence of random words is ideal. Write it down and store it somewhere physically secure, like a locked drawer. Do not save it digitally anywhere obvious.
- Install the browser extension and phone app. These are what enable autofill.
- Start adding passwords. Most managers import saved passwords from your browser automatically. From that point, any new login you create gets saved by the manager.
- Gradually replace weak or reused passwords. The manager will flag duplicates and prompt you to generate stronger replacements at your own pace.
Protect Your Master Password Above All Else
Your master password is the single point of failure for a password manager. Make it a long phrase — at least four unrelated words — that only you would know. Write it on paper and store it somewhere secure, such as a fireproof home safe or a sealed envelope in a trusted location. Never store it in a note on your phone or in an email draft.
Pair your password manager with two-factor authentication on your most sensitive accounts for significantly stronger protection. The two work together — a password manager ensures your credentials are strong and unique, while two-factor authentication means a stolen password alone isn't enough to break in.
Common Concerns, Addressed Plainly
People often hesitate for understandable reasons. Here are the most common concerns and what the evidence actually shows.
"What if the company gets hacked?"
Because of zero-knowledge encryption, a breach of the provider's servers exposes only encrypted data. Without your master password, attackers cannot read it. This is meaningfully different from a database of plaintext passwords being leaked.
"What if I forget my master password?"
This is a real risk. Most services offer a recovery key — a long code generated when you sign up. Store it safely offline. Some services allow a trusted emergency contact. Understand your chosen service's recovery policy before you need it.
"It sounds complicated to switch."
The initial setup takes an hour or less for most people. After that, the experience is largely invisible — the manager fills things in automatically. You don't need to migrate every password at once; even getting your most important accounts (email, banking, healthcare) into the manager immediately makes a significant difference.
For more on bringing order to your digital accounts and files more broadly, see Organising Your Digital Life. And if you're weighing different approaches to creating passwords, Passwords vs. Passphrases walks through the trade-offs. Password management is also a foundational part of end-to-end personal data protection.
Browser Password Managers vs. Dedicated Apps
Most modern browsers (Chrome, Safari, Firefox, Edge) include a built-in password manager. These are convenient and better than reusing passwords, but they are typically locked to that browser and offer fewer security controls than standalone apps. If you regularly switch browsers or devices, or want features like security audits and emergency access, a dedicated password manager gives you more flexibility and oversight.