How Password Managers Work and Whether You Need One

Be honest: how many of your accounts share the same password, or a close variation of it? For most people, it’s a lot. And that’s exactly what attackers count on. When one site is breached, they try the same email and password everywhere else.

A password manager fixes this by remembering a unique, strong password for every account so you don’t have to. CISA, the US Cybersecurity and Infrastructure Security Agency, recommends using one as one of the easiest ways to protect your accounts. But many people hesitate. Is it safe to put all your passwords in one place? Which kind should you choose? This guide explains how password managers actually work, the trade-offs between options and how to get started.

What a password manager does

A password manager is an app, browser feature or service that:

• Stores your usernames and passwords in an encrypted vault
• Generates long, random passwords for new accounts
• Autofills logins on websites and apps, which also helps you avoid fake sites, since the manager only fills on the real domain
• Syncs your vault across your phone, computer and tablet
• Alerts you to weak, reused or breached passwords

Many also store passkeys, two-factor codes, credit cards, secure notes and identity documents.

How the encryption works

The key idea is that your vault is encrypted before it leaves your device.

1. You create a master password (or use your device’s passcode, Face ID or fingerprint for built-in managers).
2. A key is derived from it. The manager runs your master password through a slow, deliberate key-derivation process to produce an encryption key. The slowness makes guessing attacks expensive.
3. The vault is encrypted on your device using strong encryption, commonly AES-256.
4. Only encrypted data is synced to the provider’s servers. In a “zero-knowledge” design, the company never has your master password or decryption key, so it can’t read your vault.
5. When you sign in to the vault, your device decrypts the vault locally.

This design matters when things go wrong. In its December 2022 security incident notice, LastPass said an attacker copied a backup of customer vault data. The company said sensitive fields remained protected by 256-bit AES encryption that requires a key derived from each user’s master password, while some data, such as website URLs, wasn’t encrypted. The lesson: a strong, unique master password is what stands between an attacker and a stolen vault, and you should check which data your manager encrypts.

Key takeaway: A password manager is only as strong as the way you open it. Use a long, unique master password, turn on multi-factor authentication for the manager itself and keep your devices updated.

Is it safe to keep all your passwords in one place?

It’s a fair worry. Yes, a password manager is a single target. But compare the alternatives:

• Reusing passwords: One breach exposes many accounts.
• Writing them down: Fine at home for a few accounts, but doesn’t scale, sync or protect against phishing.
• Remembering them: People end up with short, predictable passwords.

A well-designed manager with a strong master password and multi-factor authentication is far safer for most people than any of those. Standards bodies agree that password managers should be supported: NIST’s digital identity guidelines (SP 800-63B-4) tell websites to permit paste so people can use password managers, and set a 15-character minimum for passwords used as a single factor.

Built-in vs standalone password managers

You have 2 broad choices.

Built-in managers come with your device or browser: Apple’s Passwords app (with iCloud Keychain) on iPhone, iPad and Mac, and Google Password Manager in Chrome and Android. Browsers such as Microsoft Edge and Firefox also include password managers.

Standalone managers are separate apps and services that work across platforms, such as 1Password, Bitwarden, Dashlane, Keeper, LastPass and Proton Pass. Most offer free tiers or trials and paid individual, family and business plans.

Neither is “best” for everyone. If your household is all iPhone and Mac, Apple’s Passwords app may be all you need. If you use an iPhone with a Windows work laptop, or share accounts with a partner on Android, a cross-platform manager usually makes life easier.

Family sharing explained

Sharing logins for streaming services, utilities or a home Wi-Fi network is one of the best reasons to use a manager, because it replaces texting passwords around.

• Apple: Apple’s shared password groups let you share passwords and passkeys with family and trusted contacts. Apple says the group owner can add or remove members, members can add, edit or delete shared entries, and invitees need iOS 17 or later. Apple also notes that removing someone doesn’t remove what they already saw, so change those passwords afterward.
• Google: Google Password Manager lets you share a saved password with members of your Google family group, and it’s saved in their account for autofill. Google warns that if you reuse a password, sharing it may expose your other accounts.
• Standalone managers: Family plans usually include shared vaults, so you can share a “Household” folder while keeping personal vaults private. Many also offer emergency access, so a trusted person can request your vault if something happens to you.

If you’re setting up a phone for an older parent, a shared family vault can also help with account recovery. See our guide on setting up a phone for a senior.

Where passkeys fit in

Passkeys are a newer sign-in method that replaces passwords with a cryptographic key stored on your device. They resist phishing because there’s nothing to type into a fake site. Password managers are increasingly where passkeys live, syncing them across your devices. Our guide to passkeys and the end of passwords explains how they work. For now, most people will use both: passkeys where sites support them, and a password manager for everything else.

How to choose and set up a password manager

What to look for

• [ ] Works on every device and browser you use
• [ ] End-to-end or zero-knowledge encryption, clearly documented
• [ ] Multi-factor authentication for the vault
• [ ] Passkey support
• [ ] Family or team sharing if you need it
• [ ] Breach and weak password alerts
• [ ] Export option so you’re not locked in
• [ ] Published security audits or a clear security whitepaper
• [ ] A clear account recovery process

Where to start: 6 steps

1. Pick your manager using the checklist above.
2. Create a strong master password. CISA suggests passwords that are long, random and unique. A passphrase of several random words works well. Write it down and store it somewhere safe at home until you’ve memorized it.
3. Turn on multi-factor authentication for the manager and save its recovery codes.
4. Import passwords saved in your browser, then turn off the browser’s own password saving if you’re switching to a standalone manager, so you don’t have 2 vaults.
5. Fix the most important accounts first: email, banking, phone carrier, cloud storage and social media. Change each to a unique generated password.
6. Work through the rest gradually as you log in to each site. Use the manager’s security report to find reused and weak passwords.

When you switch phones, your vault comes with you, which makes our guide on transferring data to a new phone much simpler.

Password managers for small businesses

If you run a business, the case is even stronger. Shared logins in spreadsheets or group chats are a common cause of breaches and messy offboarding. Business plans add admin controls, shared vaults by team and the ability to revoke access when someone leaves. Password managers fit naturally into a zero trust security approach, and they’re a practical layer of ransomware protection for small businesses, since stolen credentials are a common way attackers get in.

Conclusion

A password manager does one simple, powerful thing: it lets every account have its own strong password without you remembering any of them. Built-in managers from Apple and Google are a solid, free start if you stay in one ecosystem. Standalone managers shine across mixed devices and families. Whichever you choose, protect it with a strong master password and multi-factor authentication. For any unfamiliar terms, check our glossary.

Sources

• CISA Secure Our World: Use Strong Passwords — CISA recommendation to use a password manager and long, random, unique passwords
• NIST SP 800-63B-4: Authentication and Authenticator Management — paste support for password managers and 15-character single-factor minimum
• Apple Support: Share passwords and passkeys with people you trust on iPhone — shared password groups, roles and iOS 17 requirement
• Google Account Help: Manage passwords in Chrome — sharing passwords with Google family group members
• LastPass: Notice of Security Incident (December 2022) — encrypted vault backup copied, encryption details and unencrypted fields