Home / Guides / Everyday Privacy
Password Managers Explained
The single most useful thing most people can do for their online security is to stop reusing passwords. A password manager makes that practical.
What a password manager does
It creates long, random, unique passwords for each of your accounts, stores them in an encrypted vault, and fills them in when you log in. You remember one strong master password, and the manager remembers everything else.
Why it beats the alternatives
- Reused passwords are the main risk. When one site is breached, attackers try the same email and password on other sites. A unique password for each account limits the damage.
- Memory does not scale. Nobody can remember dozens of long random passwords.
- Notes files and browser tabs are riskier. A spreadsheet or a note on your phone is not encrypted, or is easy to lose.
- It helps against phishing. A manager fills your password only on the real site address, so a look-alike site gets nothing.
Types of password managers
| Type | Pros | Cons |
|---|---|---|
| Built into your browser or phone | Free and convenient | May be tied to one ecosystem, and fewer sharing and audit features |
| Dedicated app | More features, works across devices and browsers | Often a subscription |
| Offline or self-hosted | Full control | More work, and you handle backups |
What to look for
- Strong encryption where the provider cannot read your vault.
- Two-factor authentication for the vault itself.
- Independent security audits and a public record of how the company handled past incidents.
- Cross-device sync and a good browser extension.
- Emergency access or recovery options that do not undermine security.
- A price and business model you understand.
How to get started this weekend
- Pick a manager and install it on your phone and computer.
- Create a strong master password. Use a long passphrase of several random words that you have never used elsewhere. Write it down and store it in a safe place at home until you know it by heart.
- Turn on two-factor authentication for the manager.
- Import your existing passwords from your browser.
- Start with the important accounts: email, banking, and any account that can reset others. Replace old passwords with generated ones.
- Keep going by updating a few accounts each time you log in.
Common concerns
- "What if the manager is hacked?" Reputable managers encrypt vaults so that a breach of their servers should not expose your passwords. A strong master password and two-factor authentication add more protection.
- "What if I forget the master password?" Set up a recovery option the provider offers, and keep an offline copy of the recovery information in a safe place.
- "Is it worth it for one person?" Yes. The benefit does not depend on how much you have to protect.
Next steps
After passwords, enable two-factor authentication on your email, bank and main accounts. See how to spot a phishing email.