Most people have dozens of accounts: email, banking, social media, online shops, streaming services, work platforms. Nobody can remember dozens of long, different passwords. The result is predictable: people use a handful of passwords, with small variations, everywhere. And that is exactly where the problem begins.
The real risk is reuse
When a website suffers a breach, lists of email addresses and passwords often end up in circulation. Whoever gets hold of them tries them automatically on other services: email, social media, shops, banks. This technique is called credential stuffing, and it works because many people use the same combination everywhere.
A complex but reused password is therefore more dangerous than it looks: if just one of the services where you use it is breached, all the others become vulnerable. The rule that really matters is simple: a different password for every account.
How a password manager works
A password manager is an encrypted vault that stores your credentials. You open it with a single main password (the master password), which is the only one you need to remember. It does the rest:
- it generates long, random passwords for every new account;
- it stores them in encrypted form;
- it fills them in automatically on the right website;
- it syncs them between computer and smartphone, if you want it to.
One often underrated advantage: the password manager links each credential to the site's domain. If you land on a fake page imitating your bank, the program won't offer the password, because the domain doesn't match. That makes it an excellent indirect defence against phishing.
Criteria for choosing one
Client-side encryption
Passwords should be encrypted on your device before being sent to the cloud, so that not even the provider can read them. Serious providers describe this architecture publicly.
Transparency and independent checks
Prefer products that publish security audits carried out by third parties, or whose source code is open and verifiable. It isn't an absolute guarantee, but it signals a responsible approach.
Two-factor authentication support
Access to the vault should be protectable with a second factor too, such as an authenticator app or a physical security key.
Compatibility
It must work on the systems you actually use: Windows, macOS, Linux, Android, iOS and the main browsers. An awkward tool ends up unused.
Secure sharing
In a family or a small office it is useful to share certain credentials (the Wi-Fi, for instance, or a shared account) without sending them in plain text by message.
Export
Check that you can export your data in a standard format: if one day you want to switch products, you shouldn't be locked in.
Built into the browser or standalone?
The managers built into browsers and operating systems have improved a great deal and are in any case better than one password repeated everywhere. A standalone password manager usually offers more: secure notes, sharing, checks for weak or leaked passwords, consistent behaviour across different browsers. If you live in a single ecosystem, the built-in one may be enough; if you work across mixed devices, a standalone one is more convenient.
The master password
It's the key to everything, so choose it carefully:
- it must be long: a phrase of four or five random words is stronger and easier to remember than one word with symbols;
- it must be unique: don't use it anywhere else;
- it should be protected by a second factor;
- it's wise to write the recovery code on paper and keep it somewhere safe, because many services cannot reset the master password for you.
Getting started without stress
You don't need to change every password in one afternoon. A gradual approach works better:
- Install the password manager and create the master password.
- Start with the critical accounts: main email, bank, phone account (Apple or Google), work.
- For each one, generate a new random password and turn on two-step verification.
- For all other accounts, update the password the next time you sign in.
- Use the audit feature to find weak, repeated or breached passwords.
Your main email deserves special attention: whoever controls your inbox can reset almost all your other passwords through recovery links.
A common worry
"What if the password manager gets hacked?" It's a fair question. A well-designed vault is encrypted with your master password: even if someone stole the data from the provider, without that password they would see only unreadable information. The residual risk exists, but it is far lower than using the same password on thirty sites.
In short
- The main risk isn't a weak password, it's a reused one.
- A password manager generates, stores and fills in unique passwords for every site.
- Choose one with client-side encryption, independent audits, a second factor and data export.
- The master password must be long, unique and protected by a second factor.
- Start with the critical accounts, beginning with your main email.