A password manager helps people create, store and use unique passwords for their online accounts. Instead of remembering dozens of passwords, you protect a vault with a strong master password or another supported authentication method.
Why use a password manager?
Reusing passwords makes multiple accounts vulnerable when one website suffers a data breach. A password manager can generate a different long password for every account and fill it in when you visit the legitimate website or app.
How password managers work
Many password managers encrypt the passwords in a vault before storing or synchronizing them. The details vary by provider, including how encryption keys are managed, what account recovery is possible and whether vaults can be used offline. Check a provider’s documentation rather than assuming all services work identically.
What to check before choosing a manager
Look for a clear security and privacy policy, support for your devices and browsers, dependable export options, and a recovery process you understand. Check whether the service offers multifactor authentication, independent security assessments, and timely security updates. A free built-in option may be enough for one person; families or teams may need secure sharing and account-management features.
How to set one up safely
- Choose a reputable provider with a clear security model and support for your devices.
- Create a long, unique master password or passphrase if the service uses one.
- Enable multifactor authentication on the password-manager account when available.
- Import existing passwords carefully and delete temporary export files after confirming the import.
- Replace reused passwords, starting with email, banking and other high-value accounts.
- Review account recovery and emergency-access options before you need them.
What makes a good password?
Length and uniqueness matter more than complicated substitutions. A manager-generated random password is suitable for many accounts. For a password you must memorize, a long passphrase can be easier to use. Follow the requirements of the particular service.
Can a password manager be hacked?
No security product eliminates every risk. Malware, phishing, weak account recovery and a compromised device can still expose sensitive information. Keep your operating system and password manager updated, secure your device and treat unexpected requests for your vault password as suspicious.
Should you use passkeys instead?
Passkeys and password managers are complementary. A passkey uses cryptographic credentials instead of a reusable password, while a password manager remains useful for accounts that do not yet support passkeys. For a related look at secure credential handling, see our report on 1Password and AI-agent sign-ins without exposing passwords.
Why data breaches still matter
Even if you use a password manager, a company can expose personal information through insecure systems or poor credential handling. Our earlier coverage of an exposed database password in an app illustrates why account security depends on both users and service providers. Use unique passwords to limit credential-reuse risks, but also monitor account alerts and respond promptly to credible breach notifications.
Five mistakes to avoid
- Reusing your master password: Make it unique to your password manager.
- Ignoring recovery: Review backup codes and recovery options before losing access to a device.
- Leaving old exported files: Password exports may be unencrypted; remove temporary copies after a successful import.
- Approving unexpected prompts: Treat unfamiliar sign-in and account-recovery requests as suspicious.
- Keeping reused passwords: Replace them gradually, prioritizing your email and financial accounts.
Frequently asked questions
Is a browser’s built-in password manager enough?
It may be suitable for many people. Compare device compatibility, sharing needs, recovery options and security features before choosing a built-in or dedicated manager.
Should I store my master password inside the same vault?
You need a way to unlock the vault if you forget the password. Follow your provider’s recovery guidance and keep recovery materials in a secure location separate from the vault.
What if I change phones?
Depending on the service, you may sign in on a new device and recover your synchronized vault. Confirm recovery procedures and any required recovery codes in advance.
Further reading: NIST Digital Identity Guidelines and CISA guidance on strong passwords.
