Reused passwords are still one of the most common ways accounts get compromised. A password manager fixes the problem by generating and remembering a unique, strong password for every site, so you only need to remember one. This guide explains how password managers work, which features matter, and how to switch without locking yourself out.
Table of Contents
How password managers work
A password manager stores your logins in an encrypted vault. Most reputable services use end-to-end, zero-knowledge encryption: your vault is encrypted on your device with a key derived from your master password, so the company storing it cannot read your data. The apps then fill your logins in browsers and mobile apps automatically.
Features that actually matter
- Strong security model: zero-knowledge encryption, independent security audits and a published security whitepaper.
- Cross-platform apps: browser extensions plus Windows, macOS, Linux, iOS and Android apps if you use several devices.
- Passkey support: the ability to store and sync passkeys, which are replacing passwords on many sites.
- Two-factor authentication: protect the vault itself with an authenticator app or hardware security key.
- Breach and weak-password alerts: reports that show reused, weak or exposed passwords.
- Secure sharing: share selected logins with family or teammates without sending them in chat.
- Export: a clean export option so you are never locked in.
Cloud, open-source or offline?
Cloud password managers
Services such as 1Password, Bitwarden and Dashlane sync your encrypted vault across devices automatically. They are the easiest choice for most people and families.
Open-source options
Bitwarden is open source and can be self-hosted by technical users. Open code allows independent review, which many developers value.
Offline vaults
KeePassXC stores your vault as a local encrypted file. You control where it lives and how it syncs, at the cost of a little more setup.
Built-in browser and OS managers
Apple Passwords and Google Password Manager are convenient and free, and far better than reusing passwords. A dedicated manager is still the better choice if you mix platforms or need sharing and advanced reports.
How to switch safely
- Choose a long, unique master passphrase you have never used before, such as four or more random words.
- Turn on two-factor authentication for the password manager account and save its recovery codes offline.
- Import passwords from your browser, then delete them from the browser to avoid confusion.
- Use the security report to change reused and weak passwords, starting with email, banking and your main cloud accounts.
- Install the app on every device and disable the browser’s own password prompt.
For developers and teams
Many password managers include CLI tools, SSH key storage and secrets sharing for teams. Never store API keys or credentials in source code or chat; keep them in a vault or a dedicated secrets manager and rotate them when people leave a project.
Frequently asked questions
Is it safe to keep all passwords in one place?
With a reputable, zero-knowledge password manager, a strong master password and two-factor authentication, it is far safer than reusing passwords or storing them in notes. The encrypted vault is useless without your master password.
What happens if I forget my master password?
Because of zero-knowledge encryption, most providers cannot reset it for you. Set up the recovery options your manager offers, such as an emergency kit or recovery code, and store them somewhere safe offline.