Password Managers Explained: How They Work and How to Choose One

The single most effective step most people can take to protect their online accounts is to stop reusing passwords. The problem is that nobody can remember a different strong password for a hundred accounts. A password manager solves that: it creates, stores and fills a unique password for every site, and you only remember one.

Why reused passwords are the real risk

Large data breaches happen regularly, and the stolen email-and-password lists end up for sale. Criminals then use automated tools to try those combinations on banks, shopping sites, email and social media, a technique called credential stuffing. If you used the same password on a forum that was breached years ago and on your email account today, the forum breach becomes an email breach.

Federal guidance reflects this. CISA, the US cybersecurity agency, recommends long, random, unique passwords for every account and suggests using a password manager. The National Institute of Standards and Technology's digital identity guidelines favor length over complicated character rules and advise against forcing routine password changes without evidence of compromise.

How a password manager works

1. You create one master password, or unlock with your device's face, fingerprint or PIN.
2. The manager stores your logins in an encrypted vault. With reputable managers, encryption and decryption happen on your device, so the company stores only scrambled data it can't read.
3. It syncs the vault across your phone, computer and browser.
4. It fills logins automatically, and only on the matching website, which also helps protect you from look-alike phishing sites.
5. It generates new passwords when you sign up or change a password.
6. It audits your vault, flagging weak, reused or breached passwords.

Many managers also store passkeys, the passwordless sign-in method now supported by many major sites, along with secure notes, card details and identity documents.

Built-in vs standalone managers

Built-in managers such as Apple's Passwords app (iCloud Keychain) and Google Password Manager are a big improvement over memorizing passwords and are perfectly good for people who stay within one ecosystem.

Standalone managers make sense for mixed households (an iPhone user and an Android user sharing streaming logins), for people who use several browsers, and for small businesses that need shared vaults and admin controls.

What to look for

• Zero-knowledge, end-to-end encryption described in the provider's security documentation.
• Independent security audits published or summarized by the provider.
• Two-factor authentication for the manager account, ideally supporting an authenticator app or security key.
• Passkey support for storing and syncing passkeys.
• Apps for every device you own, including your browser of choice.
• Secure sharing for family members or coworkers.
• Emergency access, so a trusted person can reach your vault if something happens to you.
• Clear export options, so you can leave if you ever need to.
• Breach transparency. Every major company can be attacked. Look at how a provider has communicated about past incidents and what it changed.

Choosing a strong master password

Your master password is the one password you must memorize, so make it long and unique:

• Use a passphrase of several random, unrelated words. Length is what makes it strong.
• Never use it anywhere else.
• Don't base it on personal details that appear online.
• Write it down once and keep it somewhere physically secure at home until you've memorized it, if that helps.

Setting up in an afternoon

1. Pick a manager and install it on your phone and computer, plus the browser extension.
2. Turn on two-factor authentication for the manager account and save the recovery key or emergency kit.
3. Import existing passwords from your browser or old manager. Most managers can import directly or from an export file. Delete the export file afterward, since it's unencrypted.
4. Turn off the browser's own password saving if you're switching to a standalone manager, so you don't end up with two vaults.
5. Run the security audit and change passwords on your most important accounts first:
   • Primary email (it can reset everything else)
   • Bank, credit card and investment accounts
   • Phone carrier account
   • Apple, Google or Microsoft account
   • Online stores with saved payment details
   • Social media
6. Fix the rest gradually. Update each remaining password the next time you log in.

Sharing and planning ahead

Password managers also solve two problems most households handle badly.

Sharing. Instead of texting the Wi-Fi or streaming password, put it in a shared vault or shared group. Everyone gets the current password automatically, and you can remove access when a roommate moves out or an employee leaves, without changing passwords for everyone else.

Digital legacy. If something happens to you, your family may need access to bank, utility and email accounts. Most standalone managers offer an emergency access feature that lets a trusted contact request entry after a waiting period you choose. Apple and Google also let you name a legacy contact or set up an inactive account plan for your main account. Set these up now, and mention them in your estate documents.

Common worries

"Isn't it risky to keep all my passwords in one place?" It concentrates risk, but strongly encrypted vaults protected by a unique master password and two-factor authentication are far safer than reused passwords spread across hundreds of sites. Weighing the two, security agencies consistently recommend password managers.

"What if the service goes down?" Most managers keep an encrypted copy on each device, so you can still access your passwords offline.

"Do I still need two-factor authentication?" Yes. A password manager stops reuse; two-factor authentication protects you if a password is stolen anyway. Use both on important accounts.

A password manager takes an afternoon to set up and then saves time every day. More importantly, it turns the next big data breach from a personal emergency into a non-event for every account except the one that was breached.