What is a password manager and how does it work?

A password manager is an app that remembers your passwords for you. It generates a long, random password for each of your accounts, stores them in an encrypted vault, and fills them into websites and apps when you sign in. You only need to remember one thing: the master password that unlocks the vault. Used properly, it is one of the simplest and most effective security upgrades you can make.

This explainer covers how a password manager works, why it is safe, what can go wrong and how to start. The information here comes from vendors’ official documentation and well-established security principles.

Why do we need one?

Most people have dozens or hundreds of online accounts. The human brain cannot remember that many strong, unique passwords, so people reuse them or make small variations. That is dangerous: when one site is breached, attackers try the leaked email and password on other sites, an attack called credential stuffing. A password manager fixes the root problem by making unique passwords effortless.

It also helps against phishing. Because the manager fills a login only on the website address it has saved, it will not offer your password on a lookalike fake site, which is often the first clue that something is wrong.

How does a password manager work?

The process has five parts.

1. You create a master password. This is the one secret you memorise. It should be long and used nowhere else.
2. The app builds an encrypted vault. Your logins, notes, cards and other items go into a vault. Your master password is used to derive an encryption key, and the vault is encrypted with it.
3. Encryption happens on your device. In a well-designed manager, your data is encrypted before it leaves the device. This is often called end-to-end or zero-knowledge encryption.
4. The encrypted vault syncs. The company stores the scrambled vault on its servers so that it can sync to your other devices. It holds the data but cannot read it.
5. Autofill does the work. When you visit a site, the browser extension or app recognises the address and offers to fill the right login. New accounts get a generated password, saved automatically.

Note

Some managers add a second secret to your account. For example, 1Password uses a Secret Key stored on your devices in addition to your account password, so a stolen password alone cannot open your vault.

What else can it do?

Modern password managers have grown beyond storing passwords.

• Security checks. They flag weak, reused or breached passwords. 1Password calls this Watchtower, and Proton Pass offers password health alerts, with Dark Web Monitoring on its paid plan.
• Two-factor codes. Many can store the one-time codes used for two-factor authentication. This is a Premium feature in Bitwarden. See our tutorial on setting up two-factor authentication.
• Passkeys. They can store and sync passkeys, the newer passwordless sign-in method.
• Secure sharing. Families and teams can share logins without sending them in a message.
• Email aliases. Proton Pass includes hide-my-email aliases, so you can give each site a unique forwarding address.
• Notes and cards. Documents, payment cards, addresses and licence details can be kept in the same vault.

Is it safe to put everything in one place?

It sounds risky, but the answer from the security community is generally yes, for sensible reasons. The alternative, reusing passwords or storing them in a document, is considerably riskier. Reputable managers use strong encryption, and because the vault is encrypted on your device, a breach of the company’s servers should expose only scrambled data.

That does not make them invulnerable. In 2022, LastPass disclosed that attackers had copied customers’ encrypted vault backups, which showed that the strength of your master password matters if encrypted data is ever stolen. The lessons are to choose a long, unique master password, enable two-factor authentication and favour providers with a clear security record and published audits.

The main risks to manage are:

• A weak master password. Use a passphrase of several unrelated words, or a long random string.
• Malware on your device. A manager cannot protect you if your computer is compromised. Keep devices updated.
• Losing access. Store your recovery kit or codes offline.
• Phishing of the master password itself. Only type it into the manager’s real app or site.

What happens on a new phone or computer?

You install the app, sign in with your account details and the encrypted vault downloads and unlocks on the new device. Most managers also keep a local, encrypted copy, so you can usually open your vault without a connection. Many support unlocking with fingerprint or face recognition after the first sign-in, which is convenient, but the master password remains the key behind it.

If you lose a device, you can sign in from another and remove the lost one from your account. This is a good moment to appreciate the recovery kit: with end-to-end encryption, the company cannot restore access if you lose both your master password and your recovery information.

How to make a good master password

Your master password is the one thing you must remember, so it deserves some care. The most effective approach is a passphrase: four or more unrelated words, ideally chosen at random, joined together. A phrase like that is long enough to resist guessing and far easier to remember than a jumble of symbols.

• Make it long. Length matters more than clever substitutions such as swapping letters for numbers.
• Never reuse it. It must exist nowhere else, or a breach elsewhere puts your vault at risk.
• Avoid personal details. Names, birthdays, pets and favourite teams are the first things an attacker tries.
• Practise it. Type it from memory for a few days, and write a copy on paper for your recovery kit, kept somewhere safe at home.
• Do not change it without a reason. Change it if you suspect it has been exposed, not on a schedule.

Myths worth dropping

“If the company is hacked, my passwords are gone.” In a properly built manager, the company holds only encrypted data and cannot read your vault. A strong master password is what protects you if that data is ever stolen, which is why the LastPass incident mattered.

“I will just remember my passwords.” Anyone who can remember a strong, unique password for every account has a small number of accounts. Everyone else is reusing passwords, whether they admit it or not.

“A manager is only for techies.” Modern managers fill in logins automatically. Most of the effort is the first hour of setup.

“My browser is enough.” Browser managers are far better than nothing, but they have limits, as described below.

“Two-factor authentication makes a manager unnecessary.” The two do different jobs. A manager creates and stores unique passwords, and two-factor authentication adds a second step if one is stolen. You want both.

Key terms

What to do if one of your accounts is breached

If a service tells you it has been breached, or your manager flags one of your logins as exposed, act in this order.

1. Change the password on that site to a freshly generated one.
2. Check whether you used it elsewhere. If you reused it, change those too, starting with email and financial accounts.
3. Turn on two-factor authentication on the affected account if it was off.
4. Watch for phishing. Breach notices are often copied by scammers, so go to the site directly rather than clicking links in messages.
5. Review account activity, such as recent sign-ins and changed settings, if the site shows them.

With a manager this takes minutes, because each account already has its own password and the other accounts are unaffected.

Which password manager should you use?

The best choice depends on your priorities.

For a longer list with plans and prices, see our guide to the best password managers, and for a head-to-head, read 1Password vs Bitwarden.

What about the built-in browser or phone manager?

Browsers and phones include their own password managers. They are convenient, free and a big step up from reusing passwords. Their limits are flexibility and portability: they may be tied to one browser or ecosystem, and offer fewer sharing, auditing and recovery options. If you use a single platform and want something simple, a built-in manager is a reasonable start. If you switch between devices and browsers, a dedicated app is usually a better fit.

What this means for you

Here is a simple way to get started.

1. Choose a manager and create an account with a long, unique master password.
2. Turn on two-factor authentication for the manager and save the recovery kit offline.
3. Install the browser extension and phone app.
4. Import passwords from your browser, then delete the saved copies.
5. Start with your most important accounts, such as email, banking and your Apple or Google account, and replace their passwords with generated ones.
6. Fix the weak and reused logins the manager flags, a few at a time.

You do not need to do it all in one evening. Each password you replace removes a risk, and over a few weeks your accounts will be in far better shape.