What Is a Password Manager? Stop Reusing Passwords for Good

Think about how many accounts you have. Email, banking, shopping, streaming, that one forum you signed up to in 2016 and forgot about, work tools, food delivery, the lot. Security advice says every single one of them should have a long, completely different password, and that you should never reuse any of them. Now be honest with yourself about whether that is actually happening. For almost everyone, it is not, because no human brain can hold dozens of long random strings. So we do the human thing. We pick a handful of passwords we can remember and we spread them around.

That entirely reasonable habit is behind a huge share of account takeovers. A password manager fixes it completely, and it is probably the highest value tool a normal person can adopt. Here is the uncomfortable truth spelled out: nobody can remember a strong, unique password for every account, so almost everyone reuses a few weak ones. This guide explains what a password manager is, how it works, and why trusting one is far safer than the alternative you are almost certainly living with right now.

The problem it solves

When you reuse a password, a leak from one site quietly becomes a key to all the others. And leaks happen constantly. Companies large and small get breached, and lists of email addresses and passwords end up dumped online, bought and sold in bulk. If your password for a hobby website was in one of those dumps, and it is the same password you use for your email, then an attacker now effectively has your email too.

Attackers know reuse is common, so they automate it. They take the passwords dumped from one breach and try them, by the million, against logins everywhere else. This technique has a name: credential stuffing. It is called stuffing because they are stuffing stolen login details into as many doors as possible to see which ones open. It works constantly, precisely because so many people reuse passwords.

You reuse "Summer2023!" on 8 sites.
One of those 8 sites gets breached and leaks it.
Attacker's software tries "Summer2023!" against your email, bank, shopping...
Every account sharing that password just fell in one motion.

The only real fix is a long, unique password for every single account, so that a leak on one site tells an attacker nothing useful about any other. That is impossible to do reliably in your head, which is exactly why the tool exists. A password manager does not ask you to be superhuman. It just removes the need to remember.

What makes a password strong anyway

Before we get to the tool, it helps to know what it is generating for you. Two things make a password hard to crack: length and unpredictability. A short password, even a clever one, can be guessed by a computer trying billions of combinations. A long, random one cannot, because the number of possibilities becomes astronomically large. And a unique password limits the damage of any single leak to just that one account.

"Fluffy1"                      guessed almost instantly
"Summer2023!"                  in a cracking dictionary, falls fast
"7x!Qm2$vL9pR#tKzW4"           effectively uncrackable by brute force

The catch is obvious: that third password is exactly the kind no human can memorise, let alone forty of them. A password manager is the thing that makes strong passwords practical instead of theoretical.

What a password manager does

A password manager is an encrypted vault that generates, stores, and fills in your passwords for you. The word vault is a good one to hold onto, because that is really what it is: a locked container for secrets that only you can open.

1. It generates a long, random password for each site.
2. It stores them all in a vault encrypted with your MASTER password.
3. It fills them in automatically when you log in.

You remember exactly one strong master password. The manager remembers everything else. And because you never have to type or recall the stored passwords yourself, every one of them can be long, random, and completely different from all the others. The manager types them for you, so their unmemorability stops being a problem and becomes a feature.

Most managers also work across your devices, so a password saved on your laptop is there on your phone too, and they can store more than passwords: credit card details, secure notes, software keys, and copies of your MFA recovery codes.

How the encryption keeps things secret

The word encrypted is doing heavy lifting here, so it is worth a plain explanation. Encryption is the process of scrambling data so that it is meaningless to anyone without the right key. Your vault of passwords is scrambled using a key derived from your master password, and crucially, on a reputable manager this scrambling happens on your own device before anything is sent to the company's servers.

This is sometimes called zero knowledge design, which means the company genuinely does not know the contents of your vault. They only ever hold the scrambled version. Even if their servers were broken into, or a rogue employee went looking, what they would find is a blob of unreadable data that cannot be unlocked without your master password, and your master password is never sent to them.

On your device:   master password  ->  unlocks and scrambles/unscrambles vault
On their servers: only the scrambled blob, useless without your key

But is it safe to put all your eggs in one basket?

This is the natural worry, and it deserves a straight answer rather than reassurance. Yes, a password manager concentrates your secrets in one place. The honest conclusion is that the trade off still strongly favours using one, and here is the reasoning laid out plainly:

• The vault is encrypted, and only your master password unlocks it. A reputable manager cannot read your passwords even if its own servers are breached, because everything is scrambled on your device before it ever leaves. An attacker who steals the vault steals an unreadable blob.
• The alternative you are living with, reuse and weak passwords, is not a possible risk, it is a guaranteed, ongoing one that attackers exploit every day through credential stuffing. A single strong, well guarded basket is a far smaller and better managed risk than dozens of flimsy ones scattered everywhere.

Put simply, you are comparing a small, well defended risk against a large, active, constantly exploited one. That is not a close call.

How to use one well

Getting the most out of a password manager comes down to a few habits.

1. Choose a strong, unique master password. This is the one password you do memorise, and it protects everything else, so it needs to be genuinely good. A long passphrase made of several random words is a strong and memorable choice, for example four or five unrelated words strung together. Never use this master password anywhere else.
2. Turn on multifactor authentication for the manager itself, so that even if someone somehow learns your master password, they still cannot open the vault without your second factor. This is the belt and braces step. See multifactor authentication for how to set it up and which types to trust.
3. Let it generate long, random passwords for every account, and stop reusing. Most managers have a built in generator; use it every time you sign up somewhere or change a password.
4. Update your existing accounts gradually. You do not have to fix everything in a day. Start with your most important accounts, your email, your bank, your other logins that hold money or identity, then work through the rest whenever you happen to log in.
5. Use the security check up features. Many managers can scan your saved passwords and flag ones that are reused, weak, or known to have appeared in a breach. Working through that list is one of the most useful hours you can spend on your security.

What about writing passwords in a notebook?

A paper notebook is not a ridiculous idea, and for some people it is a reasonable stepping stone. It cannot be reached by a remote attacker on the other side of the world, which is a real advantage. Its downsides are that it does not fill passwords in for you, so you are tempted back towards short ones, it does not warn you about breaches or reuse, it cannot be everywhere you are, and it can be lost, stolen, or read by anyone who walks past your desk. A password manager gives you all the strengths of the notebook idea, the secrets kept close and under your control, without the practical weaknesses. But if the choice is a notebook of strong unique passwords versus reuse in your head, the notebook wins.

The takeaway

A password manager generates and stores a long, unique password for every account inside an encrypted vault, so you only have to remember one strong master password. It ends password reuse, the habit behind a large share of account takeovers, it makes genuinely strong passwords practical rather than theoretical, and it even helps against phishing by staying silent on fake sites. Yes, it concentrates your secrets in one place, but an encrypted vault protected by a strong master password and multifactor authentication is a far smaller and better managed risk than reusing weak passwords across everything you own. Choose a good master password, turn on a second factor for the vault, let it generate the rest, and work through your old accounts over time. If you take one practical step from this entire site, make it this one.