Most people have far more online accounts than they can remember strong, unique passwords for. The result is predictable: reused passwords, small variations of the same password, or notes on paper and in phone apps. When one site is breached, reused passwords let attackers try the same login elsewhere, a technique often called credential stuffing.
A password manager solves this by generating and storing a unique password for every account, so you only need to remember one strong master password. This guide explains how password managers work, what to compare and how to switch without locking yourself out. We have not tested or ranked specific products here; instead, this is a framework for making your own choice.
How Password Managers Work
A password manager is an encrypted vault. You unlock it with a master password, and sometimes with a device biometric or a hardware key. Inside, it stores logins, and often notes, card details and other sensitive information.
Many reputable managers use what is called a zero-knowledge design. That means your vault is encrypted on your device before it syncs, and the company does not hold the key needed to decrypt it. If the company’s servers were breached, attackers would get encrypted data rather than readable passwords. The strength of that protection depends heavily on your master password, which is why it matters so much.
Autofill
Most managers offer browser extensions and mobile apps that fill logins automatically. Autofill is also a security feature: a manager usually fills credentials only on the website address they were saved for, which can help you notice a lookalike phishing site. If your manager does not offer to fill on a page where you expect it to, stop and check the address. See phishing red flags.
Password Generation
A good generator creates long, random passwords. Since you never type them, length costs you nothing. For the few passwords you do type, such as the master password, a long passphrase is easier. See strong passphrases.
Types of Password Managers
Standalone Managers
Dedicated apps that work across browsers and operating systems. They often include features such as secure sharing, breach alerts, emergency access and support for passkeys.
Browser and Operating System Managers
Major browsers and phone operating systems include built-in password managers. They are convenient and free, and for many people they are a big improvement over reuse. Their limitations can show up if you use several browsers or switch between ecosystems, such as a Windows computer and an iPhone.
Self-Hosted and Offline Options
Some people prefer managers that store the vault in a file they control or on a server they run. These give more control but require more technical care, especially for backups.
Features to Compare
| Feature | Why it matters |
|---|---|
| Cross-platform apps | Works on every device you use |
| Encryption design | Whether the company can read your vault |
| Two-factor support | Protects the vault account itself |
| Secure sharing | Share logins with family without texting them |
| Emergency access | Lets a trusted person reach the vault if needed |
| Breach alerts | Flags reused or exposed passwords |
| Passkey support | Stores modern passwordless logins |
| Export options | Lets you leave without losing data |
| Security audits | Independent review of the company’s claims |
When reviewing a company, look for published security documentation, independent audits and a clear account of any past incidents and how they were handled. A company’s response to a problem tells you a lot.
Choosing a Master Password
Your master password should be long, unique and memorable to you. A passphrase made of several random words works well. Never reuse it anywhere else, and do not store it inside the vault it protects. Many people write it down once and keep it somewhere physically secure at home until it is memorized.
Turn on two-factor authentication for the password manager account. See two-factor authentication setup.
Recovery Planning
Because of zero-knowledge design, many companies cannot reset your master password for you. Before you rely on a manager, set up whatever recovery options it provides, such as a recovery code, a trusted device or emergency contacts. Store recovery codes offline in a safe place.
How to Switch to a Password Manager
- Pick a manager and install it on your main computer and phone
- Create a strong master password and turn on two-factor authentication
- Import passwords saved in your browser, if the manager supports it
- Delete the old saved passwords from the browser once the import is verified, so they are not stored in two places
- Start with your most important accounts: email, banking, phone carrier and the password manager itself
- Change reused passwords to unique generated ones as you go
- Over the next few weeks, update other accounts as you log in to them
Your email account deserves special attention, because it can be used to reset other passwords.
Family and Shared Use
Family plans and shared vaults let households share streaming, utility and Wi-Fi logins without texting passwords. They also make it easier for a trusted person to help in an emergency. See password sharing for families.
Common Mistakes
- Using a weak or reused master password
- Skipping two-factor authentication on the vault
- Not saving recovery codes
- Leaving old passwords stored in the browser and the manager
- Never updating reused passwords after importing them
Frequently Asked Questions
Is it safe to keep all my passwords in one place?
For most people, a reputable manager with a strong master password and two-factor authentication is much safer than reusing passwords. The risk is concentrated, so protect the vault well.
Are built-in browser password managers good enough?
They can be a solid step up from reuse, especially if you use one ecosystem. Standalone managers may suit people who use several browsers or devices.
What happens if I forget my master password?
It depends on the manager. Many cannot reset it, so set up recovery options early.
Should I store credit cards in my password manager?
Many people do for convenience. Consider your comfort level and use two-factor authentication.
Do password managers support passkeys?
Many now do. See passkeys explained.
The Bottom Line
A password manager lets you use a unique, strong password everywhere while remembering only one. Choose one that works on all your devices, protect it with a long passphrase and two-factor authentication, plan for recovery and update your most important accounts first.
Editorial note: Lock and Login is independent and reader-supported. This guide is based on research into manufacturer documentation, published specifications and widely accepted best practices; we have not been paid to mention any product. If we add affiliate links in the future, they will be clearly disclosed per our Affiliate Disclosure.