Password Managers Explained: Are They Safe, and How to Get Started

Most people know they shouldn't reuse passwords, and most people do it anyway — because remembering dozens of long, unique passwords isn't realistic. A password manager solves that problem by remembering them for you. The obvious worry is whether putting every password in one place is a good idea. For the vast majority of people, it is, as long as it's set up properly.

How a password manager works

A password manager is an encrypted vault for your logins. You unlock it with one master password, or with your fingerprint or face once it's set up, and it fills in usernames and passwords on websites and apps for you.

• Generates passwords — creates long, random passwords so you never have to invent one
• Fills them in — enters your login automatically on the right site
• Syncs across devices — the same vault works on your phone, laptop and browser
• Flags problems — many highlight reused or weak passwords, and some warn when a login appears in a known breach

Are they actually safe?

Reputable password managers encrypt your vault on your own device before it's synced, using a key derived from your master password. In this kind of design, the company stores only scrambled data it can't read. Even if its servers were breached, an attacker would still need your master password to make sense of what they took.

That's not a promise that nothing can go wrong. Password manager companies have been breached before, and in those cases the strength of each user's master password became what stood between the attacker and the vault's contents. That's why the master password matters so much.

Why it's still the safer choice

The most common way accounts get taken over is through reused or easily guessed passwords. When one site leaks its passwords, attackers try those same combinations elsewhere. A password manager makes every password unique, so one leak stays one leak. It also offers a quiet defence against phishing: it won't autofill your bank login on a lookalike site, because the web address doesn't match.

How to get started

• Pick one — the manager built into your browser or phone is a reasonable start; a standalone manager is worth it if you use mixed devices or want to share logins with family
• Choose a strong master password — a long passphrase of several unrelated words is easier to remember and harder to crack than a short, complex one
• Turn on two-factor authentication — for the password manager account itself, ideally with an authenticator app or security key
• Set up recovery — save any recovery key the manager offers somewhere safe and offline

Move your accounts over gradually

There's no need to change everything in one sitting. Start with the accounts that matter most: your main email, since it can reset everything else, then banking and your phone's main account. After that, update passwords one at a time as you log in to other sites. Within a few weeks, most of your important accounts will be covered without it ever feeling like a big project.

Don't forget the people around you

Many managers let you share selected logins with family members, which is far safer than texting a password. It's also worth making sure someone you trust knows how to access important accounts in an emergency, using the recovery or emergency access features many managers include.

Frequently Asked Questions