Every account you create asks for a password, and almost nobody can remember hundreds of long, unrelated ones. The usual workaround is to reuse a few favourites, which is exactly what attackers count on when a single leaked password opens many doors.
In this article we will discuss what a password manager does, the main kinds on offer, how to compare them sensibly, and how to move your existing logins into one without leaving copies lying around.
Reused Passwords and the Role of a Manager
A password manager is an encrypted vault that stores your logins and fills them in for you. You remember one strong secret, the master password, and the program remembers everything else. Because it does the remembering, it can generate a long random password for every site, so each account has its own and a breach at one service does not spread to the others.
The danger it addresses is reuse. When a website is breached, the stolen email and password pairs are often tried automatically against banks, email providers and shopping sites. If you used the same password in several places, the attacker walks straight in. A unique password per account turns a breach into a contained event: you change that one password and carry on.
There is a second benefit that people notice quickly. A manager fills credentials only on the web address saved with the entry, so it will usually refuse to fill a login on a fake lookalike page. That makes phishing harder to fall for, because the tool is less easily fooled than a tired human looking at a convincing page.
Think about how many accounts you really have. Count email, banking, shopping, travel, streaming, social media, the electricity company, the school portal, the doctor’s online booking and the dozens of forgotten sign-ups from years ago. A person who counts honestly usually lands well above a hundred, and nobody holds that many distinct secrets in their head. The result is predictable: a few passwords are reused everywhere, with a digit added at the end.
The honest downside is that you are now concentrating your secrets in one place, and you must protect that place well. For most ordinary users this is still a clear improvement over sticky notes, a spreadsheet, a notebook of variations on one word, or the same password everywhere. Security agencies that publish guidance for the public generally recommend a manager for exactly this reason.
Main Types of Password Managers
The category is broader than it looks, and the right choice depends on how many devices you use and how much control you want.
Built into a browser or phone
Most browsers and phone operating systems now offer to save and fill passwords. They are free, already installed and very easy to use, and for many people they are a big step up from reuse. The trade-offs are that they tend to work best inside one browser or one ecosystem, the features for sharing and organising are limited, and the vault is often protected by your device login or account sign-in. If someone gets access to your unlocked computer or your main account, they may get the passwords too. Strong protection on the device and the account is therefore essential.
Dedicated standalone managers
These are separate applications and browser extensions that work across systems and browsers. They usually add secure notes, storage for payment cards, password health checks, secure sharing, emergency access for family and a broader choice of two-step login methods. Many offer a free tier with limits and a paid tier for more. They suit people who use a mix of devices, such as a Windows computer, an Android phone and a tablet from another maker.
Local or self-managed vaults
Some programs keep the encrypted vault in a file that you store and synchronise yourself, with no company server involved. This gives you control and removes reliance on a provider, and it appeals to people who enjoy tinkering. The price is responsibility: you handle backups, syncing, updates and recovery. If you lose the file and have no backup, nobody can help. This route is best for technically confident users who are happy to maintain it.
Open source and commercial products
Some managers publish their code so outside experts can inspect it, while others keep it closed and rely on commissioned audits. Open code does not make a product automatically safer, since someone still has to read it, but it allows independent scrutiny. Commercial products usually bring polish, customer support and easier setup. For most households the deciding factor should be reliability and whether you will use the tool daily, not the licence.
Family and team plans
Households often benefit from a family plan, which gives each person a private vault plus a shared one for the broadband account, streaming services and other joint logins. Small businesses should look for team features such as access controls and the ability to remove a departing employee. Do not share master passwords or paste shared logins into group chats; use the sharing feature that the manager provides.
Features That Matter When You Compare
Marketing pages list dozens of features. A handful really decide whether a manager will fit your life, and the table below sets them out with a way to judge each one. Prices and plan details change, so check the current offer from each provider rather than relying on an article.
| Feature | Why it matters | How to judge it |
| Strong encryption with a zero-knowledge design | Keeps the provider from reading your vault | The provider explains that vault data is encrypted on your device before it is uploaded |
| Platform and browser coverage | A manager you cannot use on every device gets abandoned | Check each device and browser you use, including your phone |
| Autofill that works reliably | Poor autofill makes people go back to typing weak passwords | Try the free version or trial on your five most-used sites |
| Two-step login support | Protects the vault itself | Look for authenticator app and hardware key support, not only text messages |
| Password generator and health report | Finds reused, weak and exposed passwords | A report that flags duplicates and known breaches |
| Secure sharing and emergency access | Handles family and the worst case | A feature that lets a trusted person open the vault after a set delay |
| Export and import options | Prevents being locked in | Standard file export that other tools can read |
| Independent security reviews | Gives evidence beyond marketing claims | Published audits by outside firms and an open record of how past incidents were handled |
| Offline access | Lets you reach logins without a connection | A local encrypted copy on each device |
Notice what is not in the table: the longest feature list, the biggest advertising budget and the most fashionable interface. A plainer product that you will use every day is better than an impressive one that you leave on a shelf.
Security Questions to Ask Before You Commit
Because you are handing over your most sensitive data, look at how the provider describes its security model. You do not need to be a cryptographer. You need to know whether the company can read your vault, what happens if its servers are breached, and what happens if you forget your master password.
Most reputable managers use what is called a zero-knowledge or end-to-end design. The vault is encrypted on your device with a key derived from your master password, and only the encrypted version travels to the provider’s servers. If the company is breached, the thieves get scrambled data that is very hard to open without the master password, which is why a strong one matters so much. Be wary of a service that can email you your old password in plain text, because that means it can read your data.
Recovery is the awkward trade-off. If the provider cannot read your vault, it also cannot reset the master password for you. Many offer a recovery key, a long code you print or store safely at setup, or a trusted contact system. Create it on day one and keep it somewhere physically safe, apart from your devices. Skipping this step is the most common way people lock themselves out.
Check, too, whether the manager supports a lock on the app that is separate from the account sign-in, so a stolen unlocked phone does not hand over the whole vault. A sensible product asks for the master password or a biometric check after a short idle time, and lets you set how long that is.
Look at the track record as well. Every software product has bugs, and some password managers have disclosed security incidents. What separates good providers from poor ones is how openly and quickly they explain what happened, what was exposed and what users should do. Reading how a company handled a past incident tells you more than any slogan.
A further point is what the provider does with metadata. Even when your vault contents are encrypted, the company may still know your account email, billing details and when you log in. Read the privacy policy for what is collected and whether it is shared, and prefer providers that keep this to a minimum. This is a matter of personal comfort more than of danger, but it is worth a few minutes before you pay.
Finally, think about who owns and runs the product, how long it has existed, and whether it publishes independent audits. Free software with an open source code base lets outside experts inspect it, which some people value; a commercial product with regular third-party audits offers a different kind of assurance. Neither guarantees safety, but both are better than a closed product with no outside review.
Protecting the Vault Itself
A manager is only as safe as the way you lock it. Two things matter most: the master password and the second step.
Choosing a master password
Make it long, and make it something no one else would guess. A string of several unrelated words, such as four or five random ordinary words joined together, is easy to type and remember and hard to crack, and public guidance increasingly favours long passphrases over short complicated strings.
Do not use a quote, a song lyric, a birthday or a pattern based on any other password you have used. Never reuse it anywhere else. A simple test: if you could tell a colleague the rule you used to build it, it is probably too guessable.
Write it down once, at setup, if that helps you learn it. Keep the paper in a safe place at home and destroy it after a few weeks when typing it has become second nature, or keep it in a locked place as part of your emergency plan.
Turning on two-step login
Add a second factor to the manager account. An authenticator app generating time-based codes is a solid choice, and a hardware security key is stronger still against phishing. Text message codes are better than nothing but are the weakest option because phone numbers can be hijacked. Save the backup codes the service gives you and store them away from the vault, such as in a locked drawer.
Sharing and shared computers
Avoid opening your vault on a computer that belongs to someone else, such as a hotel business centre or a library terminal, because you cannot know what software is running there. If you must, use the mobile app on your own phone to read the one password you need and type it in. Log out and clear the session afterwards.
Locking and device hygiene
Set the vault to lock after a short idle period and whenever the device sleeps. Keep the operating system and the manager up to date, use a screen lock on your phone and computer, and be careful with browser extensions, since a malicious one can read what is on a page. If your computer is infected with malware, a manager cannot fully protect you, so basic security habits still matter.
Moving Your Logins Across Safely
The move is where most mistakes happen, because it means briefly handling all your passwords in a readable form. Take it step by step and keep the exposure short.
Step one: gather what you have
List where your passwords currently live: a browser, a phone, an old manager, a spreadsheet, a notebook, a text file. Collect them in the order of importance. Start with email, banking, work and any account that can reset others, since your email is the key to every other account.
Step two: export from the old place
Most browsers and managers can export saved logins to a file, typically in a comma-separated format. That file is not encrypted. Anyone who finds it can read every password in it. Do the export on a computer you trust, with no one watching, and save it to a location you control, never to a shared folder, an email draft or a cloud-synced directory if you can avoid it. If the old tool offers an encrypted export, use that.
Step three: import into the new manager
Open the new manager, find its import function, choose the matching format and load the file. Check that entries arrived properly: usernames, web addresses and notes. Open a handful of your important logins and test them. Some imports miss secure notes, extra fields or entries with odd characters, so do not assume that everything is complete without a sample check.
Step four: delete every copy
Once the import is confirmed, remove the export file. Delete it, then empty the recycle bin or trash. On a solid-state drive, normal deletion is usually enough for a home user, but if you are worried, move the file to an encrypted location first and delete it from there. Then remove saved passwords from the browser, turn off its autosave feature if you are switching, and clear any old spreadsheet or notes. Leaving duplicates in the old place defeats the purpose of moving.
Step five: upgrade the weak and duplicated ones
Run the manager’s health check, which lists reused, weak or exposed passwords. Do not try to fix the whole list in one afternoon. Begin with email, banking, shopping with stored cards and anything with personal data, change them to generated passwords, and work through the rest over a few weeks. Each time you log in somewhere and the manager offers to save a new password, accept it.
Habits That Keep It Working
After the move, the system needs very little maintenance, but a few routines keep it healthy. Let the manager generate new passwords for new accounts rather than inventing your own, and let it fill logins instead of typing them, because autofill refuses fake sites and gives you a useful alarm when it declines. If a manager does not offer to fill a page you know is real, check the address bar before overriding it.
On a phone, switch on the manager’s autofill service in the system settings so it can fill apps as well as websites. Many people install the app, forget this step, and then wonder why logins still need typing. Biometric unlock, such as a fingerprint, is a convenience layer on top of the master password, and a reasonable one if your device is otherwise well protected, but you must still remember the master password itself because the phone sometimes asks for it after a restart.
Passkeys are a newer sign-in method that many services now support, letting you log in with a device unlock instead of a typed password, and they resist phishing by design. Many managers can store passkeys too. Where a site offers them, they are a good addition, but you will still have passwords for years, so the manager remains useful.
Expect a short adjustment period. For the first two weeks you will meet sites where autofill fails, forms that block pasting, or apps that want a different login flow. Those cases are normal, and the manager can still copy the password for you to paste or type. Do not give up and revert to a memorable password; fix the one awkward site and move on.
Review the vault every few months. Delete accounts you no longer use, since an old forgotten account is a risk you do not need. Check that your recovery key and emergency contact settings are current. Tell one trusted person how emergency access works, because a vault nobody else can open is a real problem if you are ill or have died. Ask your provider how the process works and set it up deliberately.
Be careful with the security questions that some sites still ask, such as your mother’s maiden name or the street you grew up on. Those answers are often easy to find or guess, so treat them as extra passwords: enter a random string, and save the question and answer in the notes field of the entry.
Finally, keep an eye on what happens when a breach is announced. If a service you use reports an incident, change that password at once, and change it anywhere else you used it, which with a manager should be nowhere.
Conclusion
Most people go wrong by choosing a tool first and thinking afterwards. Reverse that and the decision becomes simple. First, decide what you need. A person with one phone and one laptop in the same ecosystem may be well served by the built-in option, provided the device and account are protected by a long passcode and two-step login. If you use devices from different makers, share logins with family, or want stronger features, look at a dedicated manager. If you enjoy control and are willing to handle backups, a local vault is an option.
Second, shortlist two or three providers and test them for a week on your own devices. Check that autofill works on the sites you use daily, that the mobile app is pleasant and that export is possible. Read what each one says about encryption, recovery and its history of security incidents, and note whether independent audits are published. Compare current plan details on the provider’s own pages, because they change.
Third, set up before you migrate: create a long passphrase, turn on two-step login, store the recovery key offline, and enable emergency access if you want it. Then do the move in the five steps above, delete the export file and remove old saved copies.
Before any of that, spare a moment for the mundane failure points. Make sure your phone number and recovery email on the main accounts are current, since these are how you regain access if something goes wrong. Check that you can still sign in on a second device before you delete anything from the first. A cautious order beats a fast one when the data is this important.
Fourth, upgrade the critical accounts first, beginning with email, then money, then everything else over several weeks. If you only change a dozen passwords in the first week, the main risk is already much lower.
If you have already been caught by a breach or suspect an account has been taken over, change that password and the email password immediately, turn on two-step login, and use the provider’s account recovery pages. For serious cases such as financial fraud or identity theft, contact your bank and the relevant authority in your country as well.
Frequently Asked Questions
Are password managers safe to use?
For most people they are far safer than reusing passwords. A reputable manager encrypts your vault, and the main risks are a weak master password, a missing second step and malware on your device. Choose a long passphrase and turn on two-step login.
What happens if I forget my master password?
With a zero-knowledge manager the company usually cannot reset it, because it cannot read your vault. You will need your recovery key or a trusted contact, if you set one up. Create that option on the first day.
Is the password manager in my browser good enough?
For many people it is a solid start, much better than reuse. It works best when you stay in one browser or ecosystem and protect your device and account with a strong passcode and two-step login. Move to a dedicated tool if you need cross-platform sharing and extra features.
Can a password manager be hacked?
Any software can have flaws, and providers have disclosed incidents before. Because vaults are encrypted with a key from your master password, stolen data is hard to open when that password is strong. Keep the app updated and choose a provider that explains incidents openly.
Is it safe to export my passwords to a file?
It is safe only if you handle the file carefully. The export is usually unencrypted, so use it on a trusted computer, import it straight away and delete it along with the trash copy. Never email it or leave it in a synced folder.
Do I still need two-step login if I use a password manager?
Yes. The manager protects against weak and reused passwords, while two-step login protects the accounts and the vault if a password is ever stolen. Use an authenticator app or a security key where you can.