What Is a Password Manager?

Most of us have dozens of online accounts — email, banking, shopping, streaming, social media, work tools — and every one of them wants a password. Nobody can remember a long, unique password for each of them, so people reuse the same few passwords everywhere, or pick passwords that are easy to remember and therefore easy to guess.

A password manager fixes that habit. It remembers all your passwords for you, so you only have to remember one.

The problem password managers solve

A password has two jobs that pull in opposite directions: it must be hard for an attacker to guess, and easy for you to remember. The longer and more random a password is, the better it is at the first job and the worse at the second. Experts advise a long, unique password for every account, because when a website is breached and its passwords leak, attackers try those same passwords on other services — a technique called credential stuffing. The UK’s National Cyber Security Centre describes the attack as using passwords leaked from data breaches “to attack other systems where users have used the same password.”

A password manager breaks the trade-off. It generates long, random, unique passwords for every account, stores them, and fills them in for you when you sign in. You never have to type them or remember them. The only password you need to memorise is the one that unlocks the manager itself.

How a password manager works

A password manager is an app that keeps your logins in an encrypted database, usually called a vault. Here is what happens behind the scenes.

First, you set a master password — the one password you remember. The app runs it through a slow mathematical process called a key derivation function, commonly PBKDF2 or Argon2, to produce an encryption key. The slowness is intentional: it makes guessing attacks expensive for anyone who gets hold of the encrypted vault.

Second, your vault is encrypted on your own device before it ever leaves it, usually with 256-bit AES encryption, a standard certified by the US National Institute of Standards and Technology. Only the scrambled, encrypted copy is uploaded to the company’s servers for syncing between your devices.

Third, the company cannot read your vault. This design is called zero-knowledge encryption: your master password is never sent to the company’s servers, so even the company itself cannot open your vault. If you forget your master password, most managers cannot recover it for you — that is the price of the design, and it is also why the master password deserves real care.

Finally, when you visit a website, the manager checks the web address, finds the matching login, decrypts just that entry on your device, and offers to fill it in. Because each saved login is tied to a specific web address, the manager will not offer to fill in your password on a lookalike phishing site — which makes autofill a security feature, not just a convenience.

The master password: the one password that matters

Your master password is the single point of failure for the whole system, so it needs to be strong and unique — never used anywhere else, and never shared. Write it down on paper and keep it somewhere safe, like a locked drawer, until you are sure you have memorised it: most providers cannot reset a forgotten master password for you.

The most practical way to make a strong master password is to use a passphrase: several random words strung together. The Electronic Frontier Foundation suggests a passphrase of several randomly chosen words, and recommends a minimum of six words for a password manager passphrase when using its dice-based method. A passphrase is far harder to guess than a short password with a few symbols swapped in, and much easier to remember and type.

Some managers add a second secret on top of the master password. For example, 1Password generates a 128-bit Secret Key on your device when you create your account; your account password and the Secret Key together produce the vault key, and neither is ever sent to 1Password.

Password generation: the feature you will use most

When you create a new account or change an old password, a password manager offers to generate a strong, random password and save it automatically. This is the feature that does the most quiet work for your security: you stop choosing passwords altogether, which means you stop choosing weak ones. Most managers let you adjust the generated password — its length, and whether it includes symbols or is made of words instead. What matters is that every account ends up with a different password you never had to invent or remember. Over time, the manager can also flag reused passwords on old accounts and offer to replace them with fresh, unique ones — work through your important accounts first, and the rest as you go.

Autofill and sync across your devices

Autofill is the everyday face of a password manager. On your computer it usually arrives as a browser extension; on your phone it works through the operating system’s autofill service or the manager’s own app. When a login page appears, the manager offers the right credentials for that exact site. You approve with your master password, fingerprint or face, and the fields fill themselves.

Sync is what makes the system practical. Your encrypted vault is copied to each of your devices, so a password saved on your laptop is available on your phone a minute later. Because the vault is encrypted before it leaves your device, syncing never exposes your passwords to the company storing them — it only ever handles the scrambled copy. Most managers also store passkeys, two-factor codes, card details and secure notes.

Built-in managers vs standalone managers

Password managers come in two broad shapes. Built-in managers come with your device or browser — Apple’s Passwords app on iPhone, iPad and Mac, Google Password Manager in Chrome and Android, Microsoft’s manager in Edge. They are free, already installed, and work well if you live mostly inside one company’s ecosystem. Standalone managers are separate apps that work across every device and browser, a better fit if you use a mix of devices or want features such as secure sharing with family members. There is no wrong choice: the best password manager is the one you will actually use every day, because a manager only protects the accounts you have put into it.

Where passkeys fit in

Passkeys are the next step beyond passwords, and modern password managers store and sync them. A passkey uses public-key cryptography: your device generates a pair of keys, keeps the private key in your vault, and registers the public key with the website. When you sign in, the site sends a challenge that only your private key can answer. No password is ever transmitted, and there is nothing to phish, because the private key only ever responds to the genuine website. The FIDO Alliance notes that the terms password manager and credential manager are now used interchangeably, because the same apps hold both. For now, most sites still use passwords; a manager that handles both lets you use a passkey where a site supports one and a generated password everywhere else.

This is also where password managers and two-factor authentication meet. Many managers can generate the time-based codes used by authenticator apps, so your second factor lives in the same vault as your password. That is convenient, but if someone gets into your vault, they get both factors at once — so for your most important accounts, keep the second factor in a separate authenticator app or on a security key.

What a password manager cannot do

A password manager is a powerful tool, but it has limits. It cannot fix a weak master password — if your master password is short or guessable, your whole vault is only as strong as that one password. It cannot protect a device that is already compromised by malware. It cannot stop you from typing a password into a fake site yourself, although autofill helps: if the manager does not offer to fill in a password on a page, that is a warning sign the address does not match the real site. And it cannot help the accounts you never put into it — the value builds over weeks as you move more accounts into the vault, starting with the important ones.

Getting started: a practical first week

Setting up a password manager does not have to happen in a single afternoon. On the first day, choose your manager, set it up on your main phone and computer, create a strong master passphrase and write it down somewhere safe. Turn on two-factor authentication for the manager itself and save the backup codes it gives you. Over the next few days, let the manager do its work naturally: each time you sign in somewhere, save the login to the vault, and each time you create an account or change a password, let the manager generate a new one. Start with your email and your bank, because those accounts protect everything else. Within a week, the habit settles in — you will sign in faster, stop reusing passwords, and stop resetting forgotten ones.

Sources

Electronic Frontier Foundation, Surveillance Self-Defense, “Creating Strong Passwords” — https://ssd.eff.org
National Cyber Security Centre (UK), guidance on password reuse and credential stuffing — https://www.ncsc.gov.uk
NIST, SP 800-63B-4, Digital Identity Guidelines, July 2025 — https://csrc.nist.gov
FIDO Alliance, passkeys and credential manager guidance — https://fidoalliance.org
Apple Support, “Set up and use the Passwords app” — https://support.apple.com
Google Chrome Help, “Manage passwords with Google Password Manager” — https://support.google.com