What Is a Password Manager, and Do You Actually Need One?

The advice to "use a strong, unique password for every account" is correct and also, for most people, practically impossible to follow through memory alone — which is exactly the gap a password manager is built to close. It's one of the highest-leverage, lowest-effort security improvements an individual can make, and yet it remains one of the most commonly skipped, usually because the actual mechanics of how one works aren't well understood.

The core problem a password manager solves

Reusing the same password (or small variations of it) across multiple accounts means a single breach at any one of those services — even one you barely use — potentially exposes every other account using that same password, through a well-established attack called credential stuffing, where leaked username/password pairs are automatically tried against other popular sites. The only real defence against this is a genuinely unique, random password per account, and the only realistic way to manage dozens or hundreds of such passwords is to not memorise them yourself at all.

How a password manager actually works

A password manager stores all your account passwords in an encrypted vault, unlocked by a single master password (and ideally a second factor) that only you know — the manager itself typically never sees or stores your master password in a recoverable form, using it instead to derive the encryption key that unlocks the vault locally. Once unlocked, the manager can autofill credentials into websites and apps, generate new random passwords on the spot when you sign up for something, and flag reused or weak passwords already sitting in your vault.

Local vaults vs cloud-synced vaults

A local-only password manager keeps your encrypted vault solely on your own device, with no cloud sync — maximally private, but inconvenient the moment you need a password on a second device, and genuinely risky if that one device is lost with no backup. A cloud-synced manager stores your encrypted vault on the provider's servers, syncing across your devices automatically — the important detail is that in a well-designed, zero-knowledge system, the provider stores only the encrypted blob and never has access to your master password or an unencrypted copy of your data, meaning even a breach of the provider's servers exposes only encrypted data that's useless without your master password.

Browser built-in password managers vs dedicated apps

Chrome, Firefox and other browsers now include a built-in password manager that's genuinely better than reusing passwords or using no manager at all, and for a casual user with modest needs it can be a perfectly reasonable choice. Dedicated password manager apps typically go further — cross-browser and cross-platform support (useful if you don't use the same browser everywhere), more thorough breach monitoring, secure sharing of specific credentials with family or team members, and storage for more than just website logins (secure notes, payment cards, identity documents). Whether the added functionality is worth a dedicated tool over the free built-in option depends mainly on how much you're juggling across devices and browsers.

Generating strong passwords — what actually makes a password strong

Password strength comes overwhelmingly from length and randomness, not from complexity rules like requiring a symbol and a number — a genuinely random 16-character password is dramatically harder to crack than an 8-character password with a symbol substituted for a letter ("P@ssw0rd" is not meaningfully stronger than "Password" against modern cracking methods, despite satisfying typical complexity requirements). Our free Password Generator creates genuinely random passwords of whatever length and character set you need, entirely in your browser, which is exactly the kind of password a manager is built to store and autofill so you never need to actually type or remember it.

Password managers and two-factor authentication together

A password manager and 2FA solve related but distinct problems — a strong, unique password protects against credential reuse and weak-password guessing, while 2FA protects against the specific scenario where a password does leak anyway (through phishing, a breach, or malware), since the attacker would still need the second factor to actually log in. Our comparison of SMS, app-based and hardware-key 2FA covers which second-factor method offers the strongest protection — many password managers can also store and autofill app-based 2FA codes directly, combining both protections in one place.

What happens if you lose your master password

This is the single most important thing to plan for before you need it: in a genuine zero-knowledge password manager, the provider cannot recover your master password or decrypt your vault for you, by design — that's precisely what makes the encryption meaningful. Most providers offer a recovery mechanism (a printed recovery key, a designated emergency contact, or biometric unlock tied to a trusted device) that must be set up in advance; without one configured beforehand, forgetting your master password can mean permanently losing access to everything stored in the vault, which is a real, serious risk worth explicitly planning for at setup time rather than discovering the hard way.

Common misconceptions

• Believing a password manager creates a single point of failure that's riskier than the status quo — in practice, a well-designed, zero-knowledge manager with a strong master password and 2FA enabled is considerably safer than reusing weak passwords across dozens of sites.
• Assuming complexity requirements (symbols, numbers, capital letters) matter more than length — a long, random password is stronger than a short, complex-looking one.
• Thinking browser autofill and a password manager are the same thing — a browser's built-in manager is a genuine (if more limited) password manager, not merely an autofill convenience feature.
• Not setting up account recovery before it's needed, then having no path back into the vault after a forgotten master password or lost device.

Choosing one — what actually matters

For most individuals, the decision comes down to: does the built-in browser manager cover your actual usage pattern (same browser, modest number of accounts), or do you need cross-platform sync, secure sharing, or more thorough security monitoring that a dedicated app provides. Either choice is a substantial improvement over password reuse, and the honest, most important first step for most people isn't picking the theoretically best manager — it's actually starting to use any reasonable one today, since incremental adoption (migrating your most sensitive accounts first) beats indefinitely postponing the decision while comparing every option in detail.

Choosing a strong master password you can actually remember

The one password you genuinely do need to remember is your master password, and it needs to be both strong and memorable — a real tension, since the passwords a manager generates for everything else don't need to be memorable at all. A passphrase of several unrelated random words (rather than a single word with substitutions) tends to hit both goals well: genuinely long and hard to guess, while still being something you can actually recall without writing it down. Writing your master password down somewhere digital (a note, a document) defeats much of the purpose of using a manager in the first place — if you need a physical backup, a piece of paper stored securely offline is a more sensible compromise than a digital copy that could itself be compromised.

Family and team sharing

Most dedicated password managers support secure sharing of specific credentials — a shared streaming account, a family Wi-Fi password, a shared work tool — without ever revealing the actual password in plain text to the person you're sharing with, and critically, letting you revoke that access later without needing to change the underlying password itself. This is a meaningfully better practice than the common alternative of sharing a password over chat or email, which leaves a permanent, searchable, unencrypted record of the credential sitting in a conversation history indefinitely.

Migrating from a browser's password manager to a dedicated app

Most dedicated password manager apps offer a straightforward import tool that reads your browser's saved passwords (exported as a file, or via a direct browser-extension connection) and brings them into the new manager's vault in one pass, rather than requiring you to manually re-enter every credential. After migrating, it's worth using the new manager's built-in security audit feature — most flag reused, weak, or breached passwords across your entire imported vault — as an opportunity to actually update the worst offenders, rather than just relocating the same weak, reused passwords into a nicer-looking vault.

Passkeys — the direction password management is heading

Passkeys are an emerging authentication standard designed to eventually replace passwords entirely for supporting sites — instead of a password, your device holds a cryptographic key pair, and logging in involves your device proving it holds the private key (typically unlocked by your fingerprint, face, or device PIN) rather than you typing anything at all. Major password managers and operating systems increasingly support storing and syncing passkeys alongside traditional passwords, meaning adopting a password manager now isn't just solving today's password-reuse problem — it's also positioning you to adopt passkeys as more sites support them, without needing to switch tools again later.

Browser autofill risks worth knowing about

Autofill is one of a password manager's most convenient features, but it's worth understanding one specific risk: a poorly implemented autofill (particularly a browser's basic built-in version on an older configuration) can in some documented cases be tricked by a malicious page into revealing saved credentials for a different, legitimate site through a hidden form field — a class of attack that's been demonstrated against under-secured autofill implementations. Reputable dedicated password managers generally match the autofill target strictly against the exact saved domain specifically to prevent this, which is one more reason a purpose-built manager's autofill is generally considered more robust than relying purely on a browser's most basic default behaviour.

Enterprise and business use cases

Beyond individual and family use, businesses increasingly deploy password managers organisation-wide specifically to eliminate shared spreadsheets or sticky notes as the de facto method of managing shared logins for company tools and services — a genuinely common, high-risk practice in smaller organisations that a business-tier password manager directly solves, with the added benefit of instantly revoking a departing employee's access to shared credentials without needing to individually change every password they previously had access to.

Auditing and rotating your existing passwords

Adopting a password manager is most valuable when paired with an actual cleanup of your existing accounts, not just a fresh vault for new signups going forward — most managers include a built-in security audit that scans your imported vault for weak, reused, and (where breach-monitoring is supported) previously compromised passwords, ranked roughly by risk. Working through that list starting with your most sensitive accounts (email, banking, and any account that could be used to reset others) rather than trying to fix everything at once makes the migration genuinely manageable instead of an overwhelming one-time project that gets abandoned halfway through.

Open-source vs proprietary password managers

Some password managers publish their underlying code as open source, letting independent security researchers audit the actual encryption implementation rather than relying solely on the vendor's own claims — a meaningful trust signal for a tool that, by design, holds every one of your credentials in one place. This doesn't mean proprietary (closed-source) managers are inherently untrustworthy — several have a strong track record and undergo regular third-party security audits despite not publishing source code — but for anyone weighing options where trust in the underlying encryption is a primary concern, open-source auditability is a genuine, checkable point of difference worth factoring into the decision.

A reasonable starting checklist

1. Pick any reasonable password manager — the built-in browser one if you want the lowest-friction start, or a dedicated app if you need cross-platform sync.
2. Set a long, memorable passphrase as your master password, and set up a recovery method immediately, before you need it.
3. Import your existing saved passwords, then run the built-in security audit and start replacing the weakest, most-reused ones first.
4. Enable 2FA on the manager itself, and on every account it protects that supports it.
5. Revisit the vault every few months to remove old, unused accounts and update anything flagged as breached or weak in the meantime.