Password Managers Explained: Why You Really Need One

Most people manage passwords one of three ways: the same password everywhere with small variations, a notebook by the desk, or a genuine attempt at unique passwords that collapsed years ago and now runs on the "forgot password" link.

All three have the same weakness. Let me explain the weakness, then the fix.

The problem with reused passwords

Companies get breached regularly. When it happens, lists of email addresses and passwords end up circulating publicly.

Attackers do not need to guess your password. They take a list from one breached site and try those same combinations on email providers, banks and shopping sites, automatically, at enormous scale. It is called credential stuffing, and it works because most people reuse passwords.

So a forgotten account on a hobby forum you joined in 2014 becomes the way into your email. And email is the master key, because it is where every other password reset lands.

Adding "!" or a number to the end does not help much. Attackers automate those variations too.

What a password manager does

It is an encrypted vault for your logins. You remember one strong master password; the manager remembers everything else.

In practice:

• It generates long random passwords, unique to each site
• It fills them in automatically when you visit
• It syncs across your phone, laptop and tablet
• It warns you when a saved password appears in a known breach

The important shift is that you stop needing to remember or invent passwords at all. That is what makes unique passwords realistic rather than aspirational.

"But isn't keeping everything in one place risky?"

It is the most common objection, and it deserves a straight answer.

Reputable password managers use zero-knowledge encryption. Your vault is encrypted on your own device before it is ever uploaded, using a key derived from your master password. The company storing it cannot read the contents, and has no copy of your master password. If their servers were breached, attackers would get encrypted data they cannot open.

Compare that with the realistic alternative: the same password on sixty sites, several of which will be breached. Concentrated risk that is well protected beats distributed risk that is not protected at all.

Choosing one

The main options fall into three groups:

Dedicated services such as Bitwarden or 1Password. These work across every platform and browser. Bitwarden's free tier is generous and it is open source, which is why it is the one I most often suggest to people starting out.

Built into your device — the password tools included with Apple and Google accounts, or your browser. Convenient and much better than nothing. Less flexible if you use a mix of platforms.

Fully offline, such as KeePass, where the encrypted file stays on your own machine. Maximum control, more manual effort, syncing is your own responsibility.

Any of these beats what you are doing now.

Setting one up

Create a strong master password. Four or five unrelated words strung together is both stronger and easier to remember than a short tangle of symbols. Never reuse it anywhere else.

Write the master password down once, on paper, and store it somewhere secure at home. This sounds like heresy. It is not — the realistic threat to a piece of paper in your house is far lower than the risk of losing access to your entire vault.

Turn on two-factor authentication for the vault itself.

Import saved passwords from your browser, then delete them from the browser so there is one source of truth.

Do not change everything at once. Update the important accounts first — email, banking, your main shopping account, anything holding payment details. Then change others as you naturally log in over the following weeks.

The habits that matter after setup

• Let the manager generate passwords. Do not invent your own out of habit.
• Enable two-factor authentication on important accounts, ideally with an app rather than SMS.
• Act on breach alerts when the manager flags one.
• Store recovery codes for important accounts in the vault's secure notes.

If you do nothing else

Make sure the password on your main email account is long, unique, and protected by two-factor authentication. Email is the account that can reset all the others. Securing that one is the highest-value thirty minutes in personal digital security, and everything else is an improvement on top of it.

Do you use a password manager, or are you still running the notebook system? No judgement either way.