Key Takeaways
Start here
What a Password Manager Actually Does
Core concept
How Encryption Keeps Your Vault Safe
Why it matters
The Case Against Reusing Passwords
Making a choice
What to Look for in a Password Manager
Take action
Getting Started: Setting Up Your First Vault
What a Password Manager Actually Does
A password manager is an application that stores your login credentials — usernames, passwords, and sometimes other sensitive data like credit card numbers — in a single, protected location called a vault. Instead of remembering dozens of different passwords, you remember one strong master password that unlocks the vault.
When you visit a website, the password manager recognizes the login page and offers to fill in your credentials automatically. It can also generate new, complex passwords for you whenever you create an account, removing the temptation to use something guessable.
Most password managers work across devices through a browser extension, a mobile app, or both. Your vault syncs securely so your credentials are available whether you're on your phone, laptop, or tablet.
Vault
The encrypted storage container inside a password manager where all your credentials are kept. Only someone with the correct master password can unlock it.
Master password
The single password you use to unlock your password manager vault. It should be long and unique — you don't store it anywhere in the app itself.
AES-256 encryption
A widely used encryption standard that scrambles data into an unreadable format. It is considered extremely difficult to crack with current computing power.
Zero-knowledge architecture
A design approach where the service provider never receives or stores your master password, meaning they genuinely cannot access or hand over your vault contents.
Credential stuffing
An attack where stolen username-and-password pairs from one breach are automatically tried on other websites, exploiting the fact that people reuse passwords.
Autofill
A feature that automatically enters your saved username and password into a website's login fields, so you don't have to type or remember them.
How Encryption Keeps Your Vault Safe
The security of a password manager rests almost entirely on encryption. Reputable tools use AES-256 encryption — a standard considered computationally infeasible to crack with current technology — to scramble your vault contents before they ever leave your device.
The critical concept is zero-knowledge architecture. This means your master password never gets transmitted to the provider's servers. Instead, it is used locally on your device to derive a cryptographic key that encrypts and decrypts your vault. The provider stores only encrypted data — they cannot read your passwords, and neither can an attacker who breaches their servers without your master password.
This is a meaningful distinction from, say, storing passwords in a browser without a separate account password — where a stolen device can expose everything.
Cloud Sync vs. Local Storage
Most password managers sync your encrypted vault to the cloud so it's available across all your devices. Some tools also offer a local-only mode where the vault stays entirely on your device. Local storage reduces exposure to server breaches but means you're responsible for your own backups and lose cross-device convenience. Consider which trade-off fits your situation.
The Case Against Reusing Passwords
Credential stuffing is one of the most common attack methods used today. When a website is breached and its user database is leaked, attackers run those username-and-password combinations against hundreds of other services automatically. If you reuse a password, one breach anywhere becomes a breach everywhere.
Security researchers consistently find that the majority of people reuse passwords across multiple sites, often with only minor variations. A password manager eliminates this habit by making unique, random passwords effortless — you never have to type or remember them yourself.
Pairing a password manager with two-factor authentication raises the bar further. See our guide to two-factor authentication to understand how that extra layer works and how to set it up. For broader protection across all your devices, keeping your devices secure covers foundational habits that complement strong passwords.
What to Look for in a Password Manager
Not all password managers are equal. When evaluating options, consider these practical criteria:
- Encryption standard: Look for AES-256 and a clearly documented zero-knowledge model.
- Independent security audits: Reputable tools publish results of third-party security audits. This is a sign the provider is willing to be held accountable.
- Cross-platform support: Confirm it works on all the operating systems and browsers you use.
- Breach monitoring: Some managers alert you when a site you use appears in a known data breach, prompting you to change that password.
- Secure sharing: If you share accounts with family members or colleagues, look for a tool that supports sharing without revealing the underlying password.
- Recovery options: Understand what happens if you forget your master password — and whether the tool's recovery method aligns with your risk tolerance.
Also consider how the tool handles browser extensions. Our article on browser extension privacy risks is worth reading before you grant any extension broad access to your browser data.
Start With Your Most Important Accounts
When setting up your vault for the first time, prioritize accounts that hold financial, medical, or personal data — email, banking, and any social login you use to access other services. Securing these first gives you meaningful protection quickly, even before you've migrated every credential.
Getting Started: Setting Up Your First Vault
Starting with a password manager doesn't require migrating every password at once. A practical approach:
- Choose a tool that meets the criteria above and install it on your primary device.
- Create a strong master password — a passphrase of four or more unrelated words works well and is easier to remember than random characters.
- Save your recovery key in a physically secure location, such as a printed document in a safe.
- Add passwords gradually — let the manager capture credentials as you log in to sites naturally, rather than trying to import everything at once.
- Enable two-factor authentication on the password manager account itself for an additional layer of protection.
Your home network is another piece of the security puzzle. Home network security basics explains how to reduce risk at the network level without needing technical expertise. Building these habits together creates a layered defense that's far more resilient than any single tool alone.