If you read our password basics guide, you will know the rules: long, random and unique for every account. A password manager is how normal people actually follow them. This is part of Everyday passwords.
What a password manager does
A password manager is an app for your phone, computer and browser. It does three jobs:
- Creates a long random password whenever you sign up for something.
- Stores every password in an encrypted vault, as explained in how password managers work.
- Fills them in for you, on the right site.
As the US agency CISA puts it, you "only need to remember one strong password", the one that opens the manager. US government guidance also says that websites must let people use password managers and autofill.
Why it protects you
A manager fixes the two most common password failures at once. Every account gets its own password, so a leak at one site goes no further. And since passwords are random, there is nothing to guess.
It also helps against fake websites. A manager links each password to a site's real address. If a lookalike site appears, your manager usually will not offer to fill anything, which is a useful warning sign.
The honest risks
Every method has a failure mode, and managers are no exception:
| Risk | What it means | What reduces it |
|---|---|---|
| Forgotten master password | You may lose access to everything | Recovery and emergency options |
| Weak master password | One password guards all the others | Six or more random words |
| Malware on your device | It can read what your device can read | Keep devices updated and be careful with downloads |
| A hack at the provider | Attackers may copy encrypted vaults | A strong master password keeps them useless |
| Your account gets taken over | Someone gets into your vault | Turn on two-factor login |
None of these make a manager worse than reused passwords. They do show why your master password matters so much.
Choosing your master password
Your master password is one of the few things you should memorize. Make it a passphrase of six or more random words, and follow our steps for creating a strong password you can remember. Use it nowhere else.
Crypto holders will notice a parallel here. A manager's master password and a wallet's 25th word are both passphrases, and neither can usually be reset.
What to look for
Our criteria-led comparison applies the standards on our how we test page, and free vs paid helps with cost. In short, look for:
- Support on all your devices and browsers.
- End-to-end encryption, so that the provider cannot read your vault.
- Published independent security audits.
- Two-factor login for the vault itself.
- A way to export your data, and emergency access for someone you trust.
Ready to start?
Follow how to set up a password manager in one afternoon. Already using one? See browser vs password manager, cloud vs offline and switching safely.
What not to keep in it
A password manager is a great home for passwords, card details and notes. It is not the place for a crypto recovery phrase. Here is why seed phrases need different handling.