Password manager: what it is, why you need one, and how to choose

The average person today has dozens, if not hundreds, of accounts: email, banks, marketplaces, social networks, work tools, forums. Memorizing a unique, complex password for every single one is physically impossible, so most people take one of two bad routes: they invent one or two passwords and reuse them everywhere, or they pick simple, easily guessed combinations. Both are dangerous. The fix for this problem is a password manager: a program that remembers your passwords for you, encrypts them securely, and fills them in at the right moment. Let’s break down what it is, how it works under the hood, and how to choose one you can actually trust.

Why you can’t reuse one password everywhere

The main threat here is called credential stuffing. It works like this: some service where you signed up gets breached, and the database of logins and passwords leaks onto the internet. Hundreds of such breaches happen every year, and they already contain billions of “email–password” pairs. Attackers then take those pairs and automatically try them on other sites: your email, your bank, your social accounts. If your password is the same everywhere, a leak from one — even the most insignificant — forum opens the door to all of your accounts at once.

That is why the rule is simple and strict: every service must have its own unique password. Then a leak from one site stays a local problem instead of triggering a chain reaction.

But that rule creates another problem. A unique password for each of a hundred services means a hundred different passwords, which a human simply cannot memorize. Writing them in a notebook, in your phone’s notes app, or in a passwords.txt file on your desktop is unsafe: that list isn’t encrypted, and it’s easy to lose, copy, or read. Keeping everything in your head only works if you make the passwords simpler, which lands you right back at the original vulnerability. It becomes a vicious circle: secure passwords are impossible to remember, and memorable ones aren’t secure. A password manager breaks that circle.

What a password manager is

A password manager is an app (or service) that stores all your logins and passwords in encrypted form inside a single protected vault. You memorize only one password — the master password — and it unlocks access to everything else. The manager handles three jobs:

1. Stores passwords in an encrypted vault that no one but you can access.
2. Creates new strong passwords on demand — long, random, and unique.
3. Fills in the right password on the right site automatically, so you never have to type it or even see it.

Managers come in different forms. Cloud-based ones sync your vault between devices through the developer’s servers. Local ones keep an encrypted file only on your machine, and you set up syncing yourself (if you need it). Some managers are built into your browser or operating system, others are standalone apps. The principle is the same for all of them; what differs is the implementation and trust details, covered below.

How it works

Understanding the inner mechanics helps you trust the manager and choose well. There’s no magic under the hood — just proven cryptography.

The master password

The whole vault is protected by a single primary password. From it, a special function (a KDF — key derivation function, such as Argon2 or PBKDF2) computes the encryption key. These functions are deliberately made “slow” and resource-heavy, so that brute-forcing the master password is expensive and practically infeasible.

The key point: the master password is not stored — not on a server, not in the app itself. The key is only derived from it the moment you unlock the vault. That’s why the choice of master password is taken seriously: it should be a long passphrase made of several unrelated words that you use nowhere else. If you forget it, recovering the vault is usually impossible — that’s the price of having a vault that not even the developer can open.

Vault encryption

The passwords themselves are stored encrypted, usually with AES-256 or a similar algorithm. Good managers follow a zero-knowledge principle: data is encrypted and decrypted only on your device, and the server (if there is one) only ever receives an already-encrypted blob that is useless without your master password. This means even the developer cannot read your passwords, and even if their servers are breached, only encrypted vaults leak.

Autofill

When you visit a site, the manager recognizes its address and offers to fill in the login and password for that exact domain. This isn’t just convenient — it’s also anti-phishing protection. The manager ties each entry to a specific address, so if you’re lured to a fake paypa1.com instead of paypal.com, it simply won’t offer the password, because the domain doesn’t match. A human might miss that swap; a program won’t.

Password generation

The built-in generator creates random passwords of the length and complexity you need: with letters, digits, and special characters, or as a passphrase of random words. You don’t have to invent them, let alone memorize them — the manager generates, saves, and fills them in for you. You can see what a truly random password looks like right now in our password generator, and check its strength in the password strength checker.

What a password manager gives you

Three main benefits make the whole thing worthwhile.

Unique strong passwords everywhere. With a manager it costs nothing to give every service its own random 20+ character password. You don’t memorize or type them, so the “as long as I can remember it” limitation disappears. This closes the main vulnerability — password reuse.

Protection from the fallout of breaches. When each service has its own password, a leak from one of them doesn’t touch the others. On top of that, many managers can check your passwords against databases of known breaches and warn you if any is compromised or reused — and prompt you to change it.

Convenience. Counterintuitively, security here doesn’t fight convenience — it reinforces it. Instead of trying to recall a password, hitting “forgot password?”, and resetting it for the tenth time, you unlock the vault once with your master password, and everything else fills in automatically across all your devices. Strong protection turns out to be more comfortable than the usual chaos.

On top of that come nice extras: secure storage not only for passwords but also for notes, 2FA codes, and card details; secure sharing of access with family; change history. But the foundation is exactly those three points.

What to look for when choosing

There are many managers, and they differ. Here’s an honest checklist of criteria to compare them by, with no allegiance to any particular brand.

Encryption and architecture

The baseline requirement is modern encryption (AES-256 or equivalent) and a strong key derivation function (Argon2, scrypt, or PBKDF2 with a high iteration count). Ideally the manager is built on a zero-knowledge principle: decryption happens only on your device, and the developer is technically unable to read your data. This is something to verify in the documentation, not to take on faith from marketing slogans.

Two-factor authentication (2FA)

A vault is “everything in one place,” so protecting the entry point itself is critical. A good manager lets you add a second factor: an authenticator app, a hardware key (FIDO2/WebAuthn), or at least one-time codes. A hardware key is the strongest option. Even if someone learns your master password, they can’t get in without the second factor.

Open source and independent audits

Security can’t be judged by appearance. Serious managers either have open source code (any expert can examine it) or undergo independent security audits by third-party firms and publish the results. Regular public audits and a transparent track record of responding to discovered vulnerabilities are a far weightier argument than pretty promises on a website.

Cross-platform support

A manager is only as useful as it is available on your devices. Check that there are clients or extensions for all your platforms: Windows, macOS, Linux, Android, iOS, and the major browsers. Without convenient autofill on your phone, you’ll start bypassing the manager — and lose its benefit.

Storage model and export

Decide what suits you better: cloud sync (convenient, but you trust the developer’s servers) or local storage (full control, but you arrange syncing yourself). And be sure the manager lets you export your data in an open format. The ability to take your passwords and move to another solution protects you from lock-in and insures you against the project shutting down.

How to get started

Switching to a password manager feels like a big task, but it’s done gradually. Here’s a general, manager-agnostic order of steps.

1. Choose a manager by the criteria above and install it on your main device and phone, and add the browser extension.
2. Come up with a strong master password. This is the only password you’ll have to memorize, so take it seriously: a long phrase of several random words. Write it on paper and keep it somewhere safe at first.
3. Enable 2FA on the manager itself — this is a mandatory step, not an option.
4. Generate strong passwords. You don’t need to change everything at once. Start with what matters: email (it’s the “master key” via account recovery), banks, your main social accounts. For each, create a new random password — for example, in our password generator — and save it in the vault.
5. Check your old passwords. Run the ones you use through the password breach check: if a password has shown up in known databases, change it first. The strength of new passwords is easy to gauge in the password strength checker.
6. Migrate the rest gradually. Every time you log into a site with an old shared password, change it to a generated one right there and save it. Within a couple of weeks of normal use, you’ll have moved almost everything to unique passwords.

Myths and concerns

There are a lot of fears around password managers. Let’s address the main ones.

”If the manager itself gets hacked, I lose everything at once”

This is the most common objection, and it’s understandable: “all your eggs in one basket” sounds risky. But the reality is the opposite. First, that basket is encrypted and guarded: with zero-knowledge design, even a breach of the developer’s servers gives an attacker only encrypted data, useless without your master password. Second, you shouldn’t compare against an ideal but against the reality without a manager — a handful of weak, reused passwords scattered across notes and memory. That scenario is breached far more easily. A password manager concentrates risk in one well-protected point instead of spreading weak spots across all your accounts.

”You can’t trust a cloud manager — the data sits on someone else’s server”

If the manager is built on zero-knowledge, the server only ever receives an already-encrypted vault whose key only you hold. The server stores an “opaque safe” whose contents the provider can’t read. And if you still don’t want to trust the cloud, choose a local manager with a file-based vault — that’s a completely valid path.

”A browser manager is the same thing, for free”

Browser-built-in managers are already a big step up from reused passwords, and you should definitely use one if there’s no alternative. But standalone managers usually offer stronger protection (a separate master password, stricter encryption), work across different browsers, and don’t lock you into a single ecosystem. It’s a question of the level of control, not “works / doesn’t work."

"It’s too complicated for an ordinary person”

The initial setup takes an evening, and after that using a manager is easier than living without one: passwords fill in by themselves and you don’t have to recall anything. Most people who install a manager don’t go back — out of convenience, not a sense of security duty.

Quick FAQ

What happens if I forget my master password? In a manager with true zero-knowledge, recovering the vault without the master password is impossible — that’s the whole point of the protection. So it’s worth writing the master password on paper and keeping it somewhere safe at first; some managers also offer an emergency recovery code — save that too.

Does a password manager cost money? There are both free options (including open-source ones) and paid ones. Many features are available for free; paid tiers usually add advanced syncing, access sharing, and breach monitoring. A good free manager fully covers the needs of an ordinary user.

Do I need a manager if I have 2FA everywhere? Yes. 2FA protects the login, but it doesn’t remove the need for unique passwords: not every service offers a second factor, and not all of them are equally reliable. A manager and 2FA are different layers of protection that work together — and a manager can store the 2FA codes themselves as well.

Is it safe to store 2FA codes in a manager? Storing 2FA codes in the same manager is convenient, but it slightly weakens the idea of “two independent factors”: both end up behind one master password. For the most critical accounts, many people prefer to keep the second factor in a separate app or on a hardware key.

Can’t I just put passwords in an encrypted file? Technically yes, but you’d lose autofill, domain-based phishing protection, generation, syncing, and breach checks. A manager is that same encrypted file, just wrapped in a convenient and secure layer.

In summary

A password manager solves a fundamental problem of digital life: secure passwords are impossible to remember, and memorable ones aren’t secure. It takes over storage, generation, and filling in, leaving you with a single master password. It is arguably the most impactful personal-security improvement you can make in a single evening.

Start small: generate your first strong password in the password generator, check your old ones for leaks in the password breach check — and move your accounts to unique passwords one by one. A password manager is one layer of defense; for how to build the rest at home, see our guide on securing your home network. And to hide the traffic itself from your provider and public networks, take a look at GANVAS VPN — there’s a free VPN to start with. Strong passwords and encrypted traffic are the two pillars that digital privacy rests on.