Security Passwords: how to make them strong and keep track of them
Password managers explained: why one app holding everything is safer
How a password manager works, why putting every password in one place is safer rather than riskier, what happens if the company is breached, and how to start without a weekend project.
The short answer
- A password manager is safer than remembering passwords yourself because it removes reuse, which is the habit that turns one website breach into a dozen compromised accounts.
- Your vault is encrypted on your own device with a key derived from your master password, and the provider never receives that password, so it cannot read your vault or reset it for you.
- If the provider is breached, attackers get an encrypted file plus metadata such as your email address and which sites you have accounts on, so expect targeted phishing rather than instant access.
- The master password is the only one you still memorize, so make it a long passphrase and store the recovery kit somewhere physical.
- Start by moving your email, carrier, bank and card storing accounts, then let the manager collect the rest as you sign in over the following weeks.
A password manager is an app that invents a different random password for every account you own, keeps them in an encrypted file called a vault, and types them back in when you need them. The objection writes itself: why put everything in one basket? The short answer is that the basket is locked with a key the company never receives, and the habit it replaces is worse. Most people run five or six passwords across two hundred accounts, which means one careless website can hand over the rest. A manager swaps a memory problem you cannot win for a single secret you can genuinely protect.
How the vault is actually locked
Start with the mechanism, because every other answer follows from it. Your master password is not stored on the provider's servers and is not sent to them when you sign in. It is fed through a key derivation function, normally PBKDF2 or Argon2, which is designed to be slow and repeats its calculation hundreds of thousands of times. What comes out is an encryption key. That key encrypts your vault on your own device, and only the scrambled result is uploaded.
This arrangement is called zero knowledge, and it has one blunt consequence people underestimate: the provider cannot reset your master password, because it holds nothing to reset. Lose the master password and the vault is unreadable to everyone including the company. Some products soften this with a printed recovery kit, a nominated recovery contact, or an admin who can reset a work account, but none of them amounts to someone looking your passwords up.
Several managers add a second ingredient: a long random secret generated on your device at sign up and never transmitted. The encryption key is derived from that secret and your master password together. A stolen vault then cannot be attacked by guessing the master password alone, because the attacker is missing a value they never had a chance to see. If your product hands you a sheet like this, print it.
Because the whole design rests on one human chosen secret, the master password is the only password still worth memorizing. Make it long rather than clever: four or five random words strung together beat a short tangle of symbols, for the reasons set out in why length beats complexity.
What a breach at the provider exposes
Password companies do get breached, and encrypted vault data has been stolen before. Assume it can happen to yours and work out in advance what it would cost you.
An attacker gets your encrypted vault plus everything that sits outside the encryption. That second part is the one people miss. Depending on the product it can include your email address, billing details, IP addresses, the dates you last used it, and in some designs the web addresses your entries point at. A list of which banks, brokerages, crypto exchanges and employers you hold accounts with is valuable even with no passwords attached, which is why such a breach is usually followed by unusually well targeted phishing aimed at its customers.
What the attacker does not get, if your master password is long and unique, is your passwords. They hold a file they can attack offline at their own pace with no rate limiting and no lockout, so the defense is arithmetic rather than a blocked login. That is exactly why master password length and the iteration count of the key derivation function matter more here than anywhere else.
One detail changes what you should do afterward. Changing your master password re-encrypts the copy you hold, but the stolen copy stays locked with the old key forever. So the useful response is to rotate the passwords inside the vault, beginning with email, banking and anything holding money, and to treat the metadata as already public. The wider sequence is in the checklist for when your data turns up in a breach.
The single point of failure objection
It is a genuine concentration of risk and dismissing it is dishonest. The useful way to weigh it is likelihood multiplied by blast radius, comparing the manager against what you would otherwise do.
Reuse fails often and quietly. Ordinary websites are breached constantly, and attackers replay the leaked pairs automatically against hundreds of other services, so one exposure spreads on its own. Over ten years the likelihood of being caught is close to certain. The mechanics are covered in why reusing one password is so expensive.
A manager fails rarely, loudly, and in a way you can prepare for. It also tells you which accounts share a password, which you cannot work out on your own.
Two hardenings are worth the five minutes. Turn on a second factor for the manager account, which protects the ability to download your vault onto a new device even though it is not what encrypts the contents. Then set the vault to lock after a short idle period rather than staying open all day.
The four kinds of manager
| Kind | Where the vault lives | Sharing | If you lose the master secret | Best fit |
|---|---|---|---|---|
| Built into the browser or phone | Tied to your Google, Apple or Microsoft account | Limited or none | Often recoverable through the parent account | One person inside one ecosystem |
| Cloud password manager | Provider servers, encrypted before upload | Shared folders, family and team plans | Gone, unless you saved the recovery kit | Most households and mixed device users |
| Local database file | A file you store and sync yourself | Copy the file, which you cannot revoke | Gone, with no support route at all | People who want no provider involved |
| Self hosted or business vault | A server your employer or you operate | Roles, groups and audit logs | An admin can reset the account, not always the data | Teams with someone who owns the server |
Most readers already use the first row without calling it a password manager. It is defensible for one person on one brand of device, and poor the moment you share a computer or cross ecosystems, as the case for and against browser saved passwords sets out.
Family sharing and emergency access
Sharing inside a manager works by re-encrypting an item to each recipient rather than sending them the text. Put the wifi password, the streaming login and the shared utility account in a family folder and every member sees the current value, including after someone changes it. No password is pasted into a chat window where a copy then sits for years. The other routes, and when to use each, are in sharing a password without putting it in a message.
Revoking access has a limit. Removing someone from a folder stops their app from showing the item, but if they already read it, they still know it. Revocation is a cleanup step, not a lock, so a departure means rotating the important passwords as well as removing the person.
Emergency access is the feature worth setting up while nothing is wrong. You nominate a trusted person who can request your vault. The request starts a waiting period you choose, during which you can decline. If you never respond, access is granted. It is the only part of a manager that answers what happens to your accounts if you are suddenly not around to open them.
Export, lock in and leaving
Every reputable manager can export your vault to a CSV or JSON file, and the time to test it is before you need it. The export is plain readable text with no protection at all, so import it straight away, then delete it from downloads and the trash, and check it did not sync to a cloud drive on the way.
What travels badly is worth knowing first. Shared folders arrive as your own items, custom fields flatten, file attachments usually do not export, and one time code seeds often need moving separately, which is the fiddly part described in setting up an authenticator app properly. Plan an afternoon for a move, not ten minutes.
How to start without a weekend project
The usual failure is trying to change two hundred passwords in one sitting, getting locked out of something, and abandoning the whole thing. Stage it instead.
- Create the account with a long memorable passphrase and print the recovery kit if one is offered, storing it where you keep your passport.
- Install the phone app and the browser extension, then turn off the browser's own offer to save passwords so you do not end up with two records of the same login.
- Change the passwords that carry the most weight, in this order: your main email, your mobile carrier account, your bank, then anything holding a card you can spend from. That is an evening, not a weekend.
- Leave everything else alone. Let the manager capture each password as you sign in over the next few weeks, and generate a new random one only when a site asks you to change it anyway.
- Once a month, open the security audit and deal with anything flagged as reused or exposed, using a breach check on the passwords themselves if your product does not run one.
After a month the vault holds the accounts you actually use, the weak passwords are gone from the places that matter, and you remember one passphrase.
Common questions
What happens if I forget my master password?
In most products the vault is lost. The company never had your master password, so there is no reset link and no support agent who can decrypt it. Your options are a recovery kit you printed at setup, a nominated recovery contact, biometric unlock still active on a device you already signed in on, or an admin reset if it is a work account. This is the main reason to write the master passphrase down and store it physically.
Is a free password manager good enough?
Usually yes for one person. Free tiers normally include unlimited passwords, sync across devices and a breach audit, which covers the core job. What you tend to pay for is family or team sharing, emergency access, file attachments, priority support and extras like one time code storage. Judge a free plan on whether it syncs to every device you own, because a manager you cannot reach on your phone will not get used.
Can a password manager be hacked?
The company can be, and several have been. The design assumes it: your data is encrypted before upload with a key the company does not hold. The realistic threats are a weak master password that makes a stolen vault crackable offline, and malware on your own computer that reads the vault while it is unlocked. Both are addressed by a long master passphrase and a short auto lock timer.
Should I still let my browser save passwords if I use a manager?
No, pick one place of record. Running both leads to two different stored passwords for the same site and no way to tell which is current, so autofill starts failing at the worst moment. When you install a manager, turn the browser prompt off the same day and delete the logins the browser already holds once you have confirmed they are in the vault.
How do I move to a different password manager later?
Export from the old one and import into the new one. Nearly all of them read each other's CSV files, and many have a direct import for the popular formats. The export file is unencrypted plain text, so do the import straight away, then delete the file from downloads and empty the trash. Check one time codes, attachments and shared items separately, because those often do not carry across.