Do you need a password manager? Yes, and here is how to choose one

Reusing passwords is the single most common way accounts get taken over. When one site is breached, criminals try the same email and password on banks, shopping sites and email providers, often with automated tools that test thousands of logins at a time. A password manager makes unique passwords painless, and for most people it is the most effective security upgrade they can make in an afternoon.

This guide explains how password managers work, whether it is safe to keep everything in one place, what to look for and how to get started without changing every login in one sitting.

Why reused passwords are so dangerous

Data breaches are routine. Retailers, apps, forums and even government agencies lose records, as our report on the Pentagon personnel data breach shows. When login details leak, they are collected into large lists and traded among criminals.

The attack that follows is simple. Software takes each email and password pair from a leaked list and tries it on popular services. Security researchers call this credential stuffing. If you used the same password on a small hobby forum and on your email account, a breach at the forum can hand someone the keys to your inbox. From there, they can reset passwords on almost everything else.

Unique passwords break that chain. A breach at one site stays at one site. The problem is that nobody can remember dozens of long, random passwords. That is exactly the job a password manager does.

How a password manager works

A password manager stores your logins in an encrypted vault. You remember one strong master password, and the app fills in the rest on websites and apps. Good managers can also generate long random passwords and warn you about reused or breached ones.

In daily use, it feels like autocomplete. You visit a login page, the manager recognizes the site and offers to fill your username and password. When you create a new account, it suggests a strong password and saves it automatically. On phones, it plugs into the system autofill so it works inside apps as well as browsers.

Most managers also store other sensitive items: secure notes, card details for checkout, software license keys and answers to security questions. Some can store the one time codes used for two step verification, though many security experts suggest keeping those in a separate app for the accounts that matter most.

Passkeys

Passkeys are a newer way to sign in that replaces passwords with a cryptographic key stored on your device. You confirm with your fingerprint, face or device PIN. Because there is no password to type, there is nothing for a fake login page to steal. A good password manager can store and sync passkeys across your devices, so supporting them is now a basic requirement.

Is it safe to keep everything in one place?

Reputable password managers encrypt your vault on your device, so the company cannot read it. The real risk is a weak master password, so make it long, such as four or five random words, and turn on two step verification for the manager itself.

The worry is understandable: putting every password in one vault sounds like putting all your eggs in one basket. But compare it with the alternative. Without a manager, most people reuse a few passwords everywhere, which means one leak exposes many accounts. With a manager, an attacker would need to break your vault's encryption or steal your master password and your second factor.

Encryption on your device matters because it means the company stores only scrambled data. Even if its servers were breached, the thieves would get vaults they cannot open without each user's master password. That is why the strength of your master password is the part you control, and the part that matters most.

Watch out for fake prompts

Password managers also offer a quiet protection against phishing. They fill passwords only on the exact website where you saved them. If a convincing fake page asks you to log in and your manager does not offer to fill anything, treat that as a red flag. The same instinct helps with the scams covered in our guides to spotting AI deepfake scams and spotting crypto scams.

What to look for in a password manager

• Works on all your devices and browsers.
• Supports passkeys.
• Offers two step verification for your vault.
• Has a clear security history and independent security audits.
• Lets you share selected passwords with family members.

Cross device support is the feature you will feel every day. If the manager works smoothly on your phone but clumsily on your work laptop, you will stop using it. Try the free tier or trial on every device you own before committing.

A clear security history means the company publishes how its encryption works, commissions outside audits and explains what happened when something went wrong. No company is immune to problems, so judge how openly a provider has handled them.

Sharing is more useful than it sounds. Households share streaming logins, utility accounts and the home Wi Fi password. A shared folder is safer than texting passwords back and forth.

Also check for an emergency access or account recovery option. If you forget your master password, the company usually cannot reset it for you, because it never had access to your vault. Some managers let you name a trusted contact or create a recovery key.

Built in or standalone?

Apple Passwords and Google Password Manager are free and good options if you stay within one ecosystem. Standalone managers such as Bitwarden, 1Password or Proton Pass work across Apple, Windows and Android, which helps if your household mixes devices.

The built in options are a big step up from reusing passwords, and they require almost no setup since they are already on your phone or in your browser. Their limits show up when you cross ecosystems, for example an iPhone at home and a Windows laptop at work, or family members on different platforms.

Standalone managers are designed for that mix. They tend to offer richer sharing, more detailed security reports and more control over how data is exported. Some have free tiers, while others charge a subscription for family or advanced features. Either choice is far better than no manager at all.

How to get started with a password manager

1. Install the manager on your phone and computer.
2. Create a strong master password and write it down somewhere safe at home.
3. Do not try to change everything at once. Update passwords as you log in to sites over the next few weeks.
4. Start with email, banking and shopping accounts that store your card.

Email deserves to go first because it is the master key to everything else: password resets for almost every account arrive there. Once your email has a unique password and two step verification, work through banking and shopping, then the rest as you encounter them.

Most managers can import passwords already saved in your browser. After importing, use the security report to find reused and weak passwords and fix the most important ones first. If you hold cryptocurrency, keep in mind that a wallet recovery phrase is different from a password; our explainer on how crypto wallets work covers how to store it safely.

For a broader checklist that pairs well with this guide, see protect your online accounts in 10 minutes, and browse our tech coverage for more security advice.

Frequently asked questions

What happens if I forget my master password?

In most cases the company cannot recover it, because your vault is encrypted with it on your device. Set up any recovery option the manager offers, and keep a written copy of your master password somewhere safe at home.

Are free password managers safe?

Free options such as the built in managers from Apple and Google, and the free tiers of some standalone services, can be safe and effective. What matters most is encryption, a good security record and a strong master password, not the price.

Should I still use two step verification if I have a password manager?

Yes. Unique passwords protect you from breaches at other sites, while two step verification protects you if a password is stolen anyway. Use both, starting with your email and the password manager itself.

Is it safe to let my browser save passwords?

Browser and phone password managers from major companies are reasonable choices, especially within one ecosystem. They are much safer than reusing passwords. A standalone manager is worth considering if you use devices from several companies.