Password managers explained: what they do and what they don’t
Reusing one password across sites is the most common way accounts get broken into. A password manager solves it for about the price of a coffee a month.
Most of us have too many accounts to remember unique passwords for all of them, so we reuse a few. That is the problem a password manager solves.
Why reuse is risky
When a website is breached, attackers take the leaked email and password pairs and try them on other popular sites. If you used the same password on your email, banking and shopping accounts, one leak can open all of them. This is known as credential stuffing.
What a password manager does
A password manager is an app that stores your logins in an encrypted vault. You remember one strong master password, and the manager:
- creates long, random, unique passwords for every site,
- fills them in automatically on the right website,
- syncs them across your phone and computer.
Because it fills only on the correct address, it can also help you notice fake sites that imitate real ones.
What it does not do
It does not stop you from clicking a phishing link and typing your details into a fake page. It also cannot help if your master password is weak or reused, or if your device is infected with malware. It is a strong tool, but not a complete defence.
Getting started in 20 minutes
- Choose a reputable manager. Look for well-reviewed products from established companies, with independent security audits.
- Set a long master password. A passphrase of four or five unrelated words is easy to remember and hard to guess.
- Turn on two-factor authentication for the manager itself, ideally with an authenticator app or a security key.
- Start with the important accounts: email, banking and anything linked to payments. Change those to generated passwords first.
- Save the rest as you go. Each time you log in somewhere, let the manager capture it.
What about browser-saved passwords?
Built-in browser managers have improved and are better than reusing passwords. A dedicated manager usually offers more features, such as secure sharing and support across different browsers.
Whichever you choose, the most important step is to stop reusing passwords. Everything else is detail.
