Password Managers Explained: How They Work and How to Choose One

Most people have dozens of online accounts and only a handful of passwords. When one website is breached, attackers try the leaked email-and-password pairs on other sites — and reused passwords open those doors too. A password manager is the simplest way to break that chain.

What a password manager does

A password manager is an app that:

• Creates a long, random, unique password for every account.
• Stores them in an encrypted vault.
• Fills them in automatically on the right website or app.
• Syncs across your phone, computer and tablet.

You remember one strong master password (or use your fingerprint or face to unlock it), and the manager remembers everything else.

Is it safe to keep all passwords in one place?

It's a fair question. Reputable password managers encrypt your vault on your device before it's synced, so the company storing it can't read your passwords. The real-world comparison isn't "password manager vs. perfect security" — it's "password manager vs. reused passwords and notes on paper," and the manager wins clearly.

To keep your vault secure:

• Use a long, unique master password you don't use anywhere else — a phrase of several random words works well.
• Turn on two-factor authentication for the password manager account.
• Keep your devices updated and locked.

A side benefit: because the manager only fills passwords on the genuine website address, it can warn you when you land on a convincing fake login page.

Built-in or third-party?

Built-in options come with your phone or browser — for example, the password managers in Apple, Google and Microsoft accounts and in major browsers. They're free, easy and increasingly capable.

Third-party password managers are separate apps and services. They're often better if you:

• use devices from different companies (say, an iPhone and a Windows PC);
• want to share passwords securely with family or a team;
• want extras such as security reports, secure notes or emergency access.

What to look for

• Works on all your devices and browsers.
• Supports passkeys as well as passwords.
• Offers two-factor authentication for the vault itself.
• Has a clear security record and publishes information about independent security audits.
• Lets you export your data if you ever want to switch.

How to get started without feeling overwhelmed

1. Choose a manager and set a strong master password.
2. Import passwords saved in your browser (most managers can do this).
3. Change the passwords on your most important accounts first: email, phone account, banking.
4. Update other accounts gradually, as you log in to them.
5. Use the manager's report to find reused or weak passwords and fix them over time.

The bottom line

You don't need a better memory — you need a better system. A password manager gives every account its own strong password, and turns the most common cause of account takeovers into a solved problem.