Password Managers Explained: How They Work and How to Choose One
Reusing passwords is one of the most common ways accounts get compromised. A password manager fixes that by creating and remembering a unique, strong password for every site, so you only need to remember one master password.
How a password manager works
- You create one master password (ideally a long passphrase).
- Your vault is encrypted on your device before it syncs, so reputable providers can’t read your passwords (“zero-knowledge” design).
- It generates strong passwords when you sign up for new accounts.
- It autofills logins in your browser and apps, and syncs across your devices.
Features to compare
| Feature | Why it matters |
|---|---|
| Zero-knowledge encryption | Only you can decrypt your vault |
| Cross-platform apps | Works on your phone, computer and every browser you use |
| Passkey support | Stores and syncs passkeys, the newer password-free sign-in method |
| Two-factor authentication | Protects the vault itself with a second step |
| Breach and weak-password alerts | Flags reused or exposed passwords |
| Secure sharing | Share logins with family or colleagues without sending them in plain text |
| Independent security audits | Evidence the provider’s claims have been checked |
| Emergency access | Lets a trusted person reach your vault if needed |
Types of password managers
- Built into your browser or operating system: free and convenient, best if you stay within one ecosystem.
- Standalone apps: work across all browsers and platforms, with more sharing and security features.
- Open-source options: code can be reviewed publicly; some can be self-hosted.
Getting started
- Choose a long, memorable master passphrase and never reuse it.
- Turn on two-factor authentication for the vault.
- Import saved passwords from your browser.
- Use the security report to replace weak and reused passwords, starting with email and banking.
- Save your recovery codes somewhere safe offline.
Common questions
Is it risky to keep all passwords in one place? A well-designed, encrypted vault protected by a strong master password and two-factor authentication is far safer than reusing passwords or storing them in notes.
What if I forget my master password? With zero-knowledge designs the provider usually can’t reset it for you, so set up the recovery options when you create the account.
The bottom line
Any reputable password manager is a big security upgrade. Pick one that works on all your devices, supports passkeys and two-factor authentication, and that you find easy enough to use every day.