What is a password manager?
Definition
A password manager is an app that creates, stores and fills in a different strong password for each of your accounts, so you only have to remember one strong password: the master password for the manager.
- Category
- Security
- Also called
- password vault
- Last updated
A password manager keeps your logins in an encrypted vault. One master password opens the vault. After that the app fills in your username and password when you sign in. Most can also generate long random passwords for you, which is the part that matters: a random 20-character password is far harder to guess than anything you could invent and remember.
The reason to use one is password reuse. If you use the same password on your email, your bank and a forum, a breach at the forum hands an attacker the keys to all three. They try the leaked login on other sites, which is called credential stuffing. A manager makes a unique password per account easy, so one leak stays one leak.
CISA, the US cyber agency, points people to password managers as one of the simpler ways to protect accounts. It says they can flag weak or reused passwords and fill in logins, and that you then need to remember only one strong password. Its advice for that master password is to make it strong and memorable, and to protect the manager account with multi-factor authentication.
Say you sign up for a new shop. The manager offers a random password and saves it. Next time it fills it in, but only on the real site. If a fake look-alike page asks for your login, many managers won't fill anything in because the web address doesn't match, which is a useful warning sign against phishing.
The trade-off is honest: all your passwords sit behind one master password, so that password and the manager account need to be strong. Losing the master password can also lock you out, so keep a recovery option as the app describes.
Password manager vs. browser password saving
Browsers can save passwords too. A dedicated manager usually works across browsers and devices, and adds password health checks. Either beats reusing one password everywhere.
How to protect yourself
- 1
Choose a long master password you can remember
Use a passphrase of several unrelated words that you don't use anywhere else. CISA advises a strong, memorable master password.
- 2
Turn on multi-factor authentication for the manager
Add a second step to the manager account itself, such as an authenticator app or a security key. See two-factor authentication.
- 3
Replace reused passwords first
Start with email, banking and any account that can reset others. Use the manager's password health check to find weak and reused ones.
- 4
Set up account recovery before you need it
Note the recovery steps your manager offers and keep them somewhere safe and offline, so a forgotten master password doesn't lock you out.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
Are password managers safe?
CISA recommends them, and a unique password per account is a big improvement over reuse. The risk to manage is the master password and the manager account, so make the master password strong and add multi-factor authentication.
What happens if I forget my master password?
It depends on the manager. Many can't reset it for you by design, because they don't hold your master password, so check the recovery options before you rely on it.
Do I still need a password manager if my browser saves passwords?
A browser's built-in saving is better than reusing passwords. A dedicated manager usually adds sharing, cross-device support and password health checks.
Sources
Something wrong or out of date? Tell us and we'll re-check it.