A password manager is an app that creates, stores and fills in your passwords so you only have to remember one strong master password. It lets you use a different, long, random password for every account without memorising any of them, which is the single biggest everyday improvement most people can make to their account security.
Why a password manager beats memory
Human memory is a poor place to keep dozens of passwords. Faced with that load, most of us reuse the same password, tweak it slightly, or choose something personal like a pet’s name. Attackers know this. When one website leaks its user list, criminals try the leaked email and password combinations on other services, a technique often called credential stuffing. If you reused a password, one breach becomes many.
A password manager removes the temptation. Every account gets its own unique password, so a leak at one service stays contained. It also handles the tedious part: typing and remembering. Because the tool does the work, long random passwords stop being a burden.
How a password manager works
Most managers keep your logins in an encrypted vault. The vault is locked with your master password, and well-designed tools never store that master password in a readable form. Without it, the contents of the vault should be unreadable, even to the company that runs the service. This is often described as a zero-knowledge design, though the details differ between products, so it is worth reading how a tool describes its own approach.
Browser-based and standalone options
Your web browser probably offers to save passwords already. That is better than reusing one password everywhere, and it is convenient. Dedicated password managers usually add extras: sharing between family members, support for many browsers and devices, secure notes, and stronger controls around the vault. Neither route is perfect, and the right choice depends on how many devices you use and how comfortable you are with each approach.
Where the vault lives
Some managers sync your encrypted vault through an online service so it is available on your phone and laptop. Others keep a file locally and leave syncing to you. Cloud syncing is easier; local storage gives you more control but more responsibility. Pick the one you will actually keep using.
Choosing a strong master password
Your master password protects everything else, so it deserves real thought. Length matters more than clever substitutions. A passphrase made of several unrelated words is easier to remember and hard to guess. Avoid song lyrics, quotes, names and anything that appears in your public profiles.
- Use a long passphrase, not a short word with symbols swapped in.
- Never use it anywhere else.
- Do not store it in a note on your phone or email it to yourself.
- Write it on paper at first if you must, and keep that paper somewhere safe at home until it feels automatic.
Pair the manager with a second factor wherever the tool allows it. Our explainer on two-factor authentication covers how that extra step blocks most takeover attempts even when a password is exposed.
Getting started step by step
- Pick a tool and install it on the devices you use most.
- Create the master password and set up any recovery option the tool offers. Understand what happens if you forget it, because some managers cannot recover a vault at all.
- Import or save existing logins. Many tools can pull passwords from your browser.
- Start with the accounts that matter most: email, banking, cloud storage and your phone account. Replace those passwords with generated ones first.
- Work through the rest gradually. Each time you log in somewhere, let the manager update that password.
- Delete the old saved passwords from your browser once you have switched, so you do not keep two copies.
Do not try to change everything in one evening. A steady pace over a couple of weeks is more realistic and less error-prone.
Common worries, answered honestly
Is it risky to keep every password in one place? It is a trade-off. A well-built vault with a strong master password and a second factor is generally safer than reuse and memory, which is how most account compromises actually happen. No tool is immune to flaws, which is why you should keep the app updated; see why software updates matter.
What if my device is infected with malware? A manager cannot fully protect you from a compromised device, because software that watches your keyboard or screen can capture what you type. Keep your system updated and be careful about what you install.
Will it fill in a fake site? Good managers match the saved web address before filling a login, so an automatic fill that does nothing is a useful warning sign. If your manager refuses to fill a login on a page that looks right, stop and check the address. Our guide to recognizing fake websites shows what to look for.
Good habits once you are set up
- Let the generator create passwords with plenty of length, and accept that you will not know them.
- Review your vault now and then and delete accounts you no longer use.
- Keep recovery codes for important accounts stored safely, ideally offline.
- Think about an emergency plan so a trusted person could reach critical accounts if something happened to you. Check the options your tool provides.
- Lock the vault on shared or borrowed devices, and avoid logging in on computers you do not trust.
For more on keeping accounts safe, browse everything in our cybersecurity section.
Where to start
Choose one tool this week, set a long master password, and move just your email and your most important accounts over. Turn on a second factor for the manager itself. Once that feels comfortable, keep going at your own pace. You do not need to be perfect; every unique password you add makes you a harder target.
Frequently asked questions
Is a password manager safe to use?
For most people it is safer than reusing passwords or relying on memory. Safety depends on a strong master password, a second factor and keeping the app updated.
What happens if I forget my master password?
It depends on the tool. Some offer recovery options, while others cannot open your vault at all, so check this before you commit and store any recovery details safely.
Is the password saver in my browser good enough?
It is far better than reusing one password, and it is convenient. Dedicated tools often add sharing, wider device support and extra vault controls.
Should I put every account in it at once?
No. Start with email, banking and other key accounts, then move the rest gradually as you log in to each one.
