Do you need a password manager? How they work and how to start

Quick answer: Yes — for almost everyone. A password manager creates a long, random, unique password for every account, stores them in an encrypted vault, and fills them in for you. You remember one strong master password (and turn on two-step verification for the manager itself). Good free options are built into Google Chrome/Android and Apple's Passwords app; dedicated managers like Bitwarden, 1Password, Proton Pass and Dashlane work across every device and also store passkeys.

Key takeaways

• Reused passwords are the main way accounts get taken over after a data breach.
• A manager makes unique passwords effortless — you never type or remember them.
• Good managers use end-to-end encryption: the company can't read your vault.
• Protect the manager with a long master passphrase and two-step verification or a passkey.
• Switch in stages: start with email, banking and shopping accounts, then fix the rest as you log in.

The average person has well over 100 online accounts. Nobody can remember 100 strong, different passwords — so most people reuse a few, and one leak opens many doors. A password manager fixes that. This guide explains how they work, whether they're safe, how to choose one, and how to move your accounts over without stress.

#Why reused passwords are dangerous

When a website is breached, attackers get lists of emails and passwords. They then try the same pairs on email, banking, shopping and social media sites automatically — called credential stuffing. If you reused that password anywhere, those accounts are at risk too.

Example: You used the same password for an old shopping site and your email. The shopping site gets breached. Within days, a bot tries that email and password on Gmail — and gets in. From your email, the attacker resets your bank and social media passwords.

A password manager breaks this chain because every password is different.

#How a password manager works

1. You create one master password (or passphrase).
2. The manager creates an encrypted vault, locked with a key derived from your master password.
3. When you sign up somewhere, it generates a random password (for example t9#Vq2!mLx7&Rp4z) and saves it.
4. When you log in, it fills it in — on your phone, laptop or browser.
5. The vault syncs encrypted between your devices. With zero-knowledge encryption, even the company can't see what's inside.

Most also store passkeys, credit cards, addresses, secure notes and two-factor codes, and they warn you about reused, weak or breached passwords.

#Types of password managers

Free vs paid

• Free options (Google, Apple, Bitwarden free, Proton Pass free) are enough for many people.
• Paid plans (usually about $1–$5 a month) add family sharing, secure file storage, emergency access, breach monitoring and priority support.

#How to choose

Look for:

• ☐ End-to-end, zero-knowledge encryption
• ☐ Apps for all your devices and browsers
• ☐ Passkey support
• ☐ Two-step verification for the vault (authenticator app, security key or passkey)
• ☐ Independent security audits published
• ☐ Easy import from your browser
• ☐ Family sharing if you need it
• ☐ Emergency access so a trusted person can get in if something happens to you

#Creating a strong master password

Your master password is the one you must remember — make it long and unique:

• Use a passphrase of 4–6 random words: harbor-pencil-mango-ladder-quiet.
• Never reuse it anywhere else.
• Don't base it on names, birthdays or song lyrics.
• Write it down once and keep it somewhere safe at home (not on your phone) until you've memorised it.

Warning: Many managers can't recover a forgotten master password, because they never had it. Set up the recovery options your manager offers (recovery key, emergency contact or account recovery) on day one.

#Move your accounts over in about an hour

1. Install the manager on your phone and computer, and add the browser extension.
2. Import passwords saved in your browser (Chrome, Safari, Edge, Firefox) — most managers do this in a few clicks.
3. Delete the old browser-saved passwords after importing, and turn off the browser's built-in saving so you don't have two systems.
4. Fix the most important accounts first — change these to new random passwords:
   • Email (all accounts)
   • Banking and payment apps
   • Phone carrier account
   • Cloud storage (Google Drive, iCloud, OneDrive)
   • Social media
   • Shopping sites with saved cards
5. Turn on two-step verification or passkeys for those accounts. See what are passkeys.
6. Fix the rest gradually — every time you log in to an old account, let the manager generate a new password.
7. Run the manager's security check and fix anything marked "reused" or "breached".

#Are password managers safe?

No system is perfect, but a good password manager is far safer than reusing passwords or keeping them in a notes app.

• Vaults are encrypted on your device before they're synced. A breach of the company's servers exposes encrypted data that's very hard to crack if your master password is long.
• Real-world incidents have happened (for example the LastPass breach in 2022), which is why a long master password and two-step verification matter so much.
• The biggest risks are a weak master password, malware on your device, and phishing — keep your devices updated.

#Tips for safe everyday use

• Let the manager autofill — it won't fill on a fake site with the wrong address, which protects you from phishing.
• Use 20+ character random passwords for sites that allow them.
• Store your two-factor recovery codes in secure notes.
• Lock the vault automatically after a few minutes of inactivity.
• Use emergency access so a family member can reach important accounts if needed.

#Frequently asked questions

Do I really need a password manager?

If you have more than a handful of accounts, yes. It's the easiest way to use strong, unique passwords everywhere.

Is Google Password Manager good enough?

For many people who use Android and Chrome, yes. If you also use Apple devices or other browsers, a cross-platform manager may be easier.

What happens if the password manager company is hacked?

Your vault is encrypted with a key only you know. With a long, unique master password, the data is very hard to read even if it's stolen.

What if I forget my master password?

Many managers can't recover it. Use their recovery options — a recovery key, emergency contact or account recovery — and set them up early.

Are free password managers safe?

Reputable free options like Bitwarden, Proton Pass, Google and Apple use strong encryption. Paid plans add extra features, not basic safety.

Can a password manager store passkeys?

Yes. Most major managers now store and sync passkeys across devices.

Should I save passwords in my browser?

Modern browser managers (Chrome, Safari, Edge) are encrypted and reasonably safe. Use one system consistently and protect your device with a screen lock.

#Sources

• CISA — Use strong passwords
• NCSC (UK) — Password managers: using browsers and apps to save passwords
• FTC — Creating strong passwords and other ways to protect your accounts
• NIST — Digital identity guidelines (SP 800-63B)
• FIDO Alliance — Passkeys