The three categories of authentication factor Three columns showing something you know (a password or PIN), something you have (a phone, hardware key, or passkey), and something you are (a fingerprint or face). Two of the three are required to unlock the account. Text below explains that "two-factor" means two different categories, not two of the same. any two unlocks 1 Something you know • A password • A PIN • A recovery phrase • An answer to a security question Can be stolen, guessed, or reused 2 Something you have • Your phone (SMS, app, push) • A hardware security key • A passkey on your device • A code from an authenticator Requires possessing the device 3 Something you are • A fingerprint • Face recognitio...
What Is a Password Manager? And How Do You Actually Start Using One
-
Original diagram — the vault is encrypted on your device before it is synced. That is what makes a synced password manager safe.
What Is a Password Manager? And How Do You Actually Start Using One
"Use a password manager" is easy advice to give and surprisingly hard advice to act on. The first
time you open one, you are confronted with a vault, a master password, an import dialog, and a set
of decisions you did not know you needed to make. Most people close the app and decide to deal with
it later.
This guide is for the person who has decided it is time. It explains what a password manager
actually is, how the encryption works (in plain language, without cryptography), the three types
of manager and how to pick between them, the step-by-step setup that does not require a weekend,
and what to do when things go wrong — because forgetting the master password is a real problem and
deserves a real answer.
If you have not yet read the earlier guide on
creating strong passwords,
it is worth reading first — it explains why a manager is the answer to the password
problem. This article assumes you are already convinced and want to actually set one up.
Key takeaways
A password manager is an app that stores passwords in an encrypted vault unlocked by one master password. You remember one thing; it remembers everything else.
The vault is encrypted on your device before it is synced. A well-designed manager cannot read your passwords even if the provider wants to.
There are three types — browser built-in, dedicated cloud-synced app, and local-only app — and all three are dramatically better than reusing passwords.
The master password is the whole security model. Make it a random passphrase, write it on paper, and store it somewhere safe.
Most managers also handle passkeys, which are the next generation of authentication and remove the password problem entirely.
1. What a password manager actually is
A password manager is an application that stores a collection of passwords — and often other
sensitive data like card numbers, secure notes, and identity documents — in a single encrypted file
called a vault. The vault is locked by one master password, which is the only password you need to
memorise.
When you log into a website, the manager recognises the login page, fills in the stored username
and password, and gets out of the way. When you create an account on a new site, the manager
generates a random password, saves it, and fills it in on future visits. The generated password is
one you would never have chosen yourself because it is not memorable — and that is exactly the
point.
The practical effect is that every account gets a unique, strong, random password, and you never
need to remember any of them. The password problem — you cannot memorise dozens of unique strong
passwords — is solved by having a tool that can.
Two things distinguish a password manager from other ways of storing passwords:
It encrypts the vault before storing it. A password stored in a notes app, a spreadsheet, or a browser's "save password" prompt is protected by whatever the app's own security is. A proper password manager encrypts the vault on your device, so even the storage location — a cloud server, an external drive, a USB stick — only ever sees the encrypted form.
It is designed for the workflow. Managers fill passwords on websites, sync across devices, flag when a password is reused or has appeared in a breach, and generate new passwords on demand. The workflow matters more than the storage, because the storage is a solved problem.
2. How the encryption works
This is the part that determines whether you can trust the tool, and it is worth understanding in
outline even if the details are not important.
When you set up a password manager, you choose a master password. That password is not stored
anywhere — the app does not save it, and if the app is well designed, the provider does not have
access to it. Instead, the master password is passed through a key derivation function,
which is a deliberately slow mathematical process that turns your password into a long encryption
key. The key is used to encrypt the vault with a standard cipher (usually AES-256).
On subsequent unlocks, the manager runs the same process: master password → key derivation → key
→ decrypt the vault. If the derived key is correct, the vault opens. If it is not, the vault
remains an unreadable block of encrypted data. There is no password reset, because there is no
stored copy of the master password to reset from.
The derivation function is deliberately slow because it raises the cost of guessing. A well-designed
manager might take a full second to derive the key from the master password on a typical device.
That feels like a long delay when you unlock, but it means an attacker trying billions of guesses
has to spend a second on each one, which makes guessing your master password impractical unless it
is very weak.
The design that makes a synced manager safe is called zero-knowledge, or
end-to-end encryption of the vault. The provider stores an encrypted copy of the
vault so it can sync between your devices. It does not have your master password and does not
have the key, so the encrypted copy is unreadable to the provider. If the provider is compelled
to hand over the vault, they hand over encrypted data they cannot decrypt. If they are breached,
the attacker gets encrypted data they cannot decrypt either.
The earlier guide on
what end-to-end
encryption actually protects covers this pattern in more detail — the same principle applies
to a password vault as to a messaging app, and the same caveats do too. The provider can still see
metadata: your account email, when you sync, roughly how much data your vault contains. What they
cannot see is your passwords.
What to verify: a well-designed password manager will publish details of its
encryption model, and increasingly will have had it examined by an independent security firm.
The specific claims to look for are: vault encrypted client-side, zero-knowledge
architecture, and independent audit. If a provider cannot explain these clearly,
that is a signal worth noting.
3. The three types, and how to pick
Original diagram — the three types, honestly compared. None is universally best; the choice depends on how you use devices.
Browser built-in (iCloud Keychain, Google Password Manager, Firefox, Edge)
Every major browser and phone operating system now includes a password manager. It generates
passwords, fills them in, syncs across devices signed into the same account, and increasingly
handles passkeys. It is free, pre-installed, and integrated with the browser in ways a third-party
app cannot always match.
The limitation is that it is tied to one ecosystem. If you use Chrome on Windows and Android, the
Google Password Manager covers you. If you also use an iPhone and Safari, your vault is now split
across two systems. This is not a security problem, but it is an inconvenience that leads to reuse
— which is the thing you were trying to avoid.
For a person who uses one ecosystem — all Apple, or all Google — the browser built-in is genuinely
fine. The "you must use a dedicated app" advice is overstated for this case.
These are standalone apps that work across every platform, sync through the vendor's servers (in
encrypted form), and typically offer more features than browser built-ins — secure sharing, family
accounts, breach monitoring, more flexible entry types. They are the most common recommendation
for people who use a mix of devices and operating systems.
The trade-off is trust. You are trusting the vendor's implementation of the encryption model, and
you are relying on their servers to sync your vault. The way to reduce that risk is to choose a
vendor that publishes its security model, has had independent audits, and has a clear business
model — free tiers supported by paid tiers, not by selling data.
The obvious concrete option for a free starting point is Bitwarden, which has a
generous free tier, is open source, and has published third-party audits. The obvious choice for a
paid option with more polish is 1Password. Both are widely used and both have
clear business models. There are others; the point is not which specific one, but that the choice
is straightforward once you have the criteria.
Local-only app (KeePassXC, KeePass)
These store the vault as a file on your own device, with no cloud component at all. You decide where
the file lives and how to sync it between devices — typically by putting it in a cloud folder
yourself, or copying it to a USB drive, or using Syncthing.
This is the strongest privacy option because there is no provider that could theoretically see
anything. It is also the highest maintenance: you are responsible for backups, for sync, and for
not losing the file. If you lose the vault file, you lose every password in it. A local-only
manager without a reliable backup is a slow-motion disaster.
This option suits people who are comfortable managing their own files, or who have a specific
reason to avoid any cloud storage for credentials. For most people, it is more work than the
benefit justifies.
The pragmatic answer for most people: start with the browser's built-in manager
if you use one ecosystem. If you use a mix of Apple and Android, or a mix of phone and computer
from different manufacturers, choose a dedicated cloud-synced app — Bitwarden's free tier is a
reasonable default. The difference between any of these and reusing passwords is far larger than
the difference between them.
4. Setting one up: a realistic plan
The setup can feel overwhelming because it looks like a project. It does not have to be. The
realistic plan is to do the first four steps in one sitting — about an hour — and then handle the
rest as you go, over weeks.
Original diagram — the setup plan, ordered by what actually reduces risk first.
Step 1 — Install the manager
Pick one of the three types based on the previous section. Then install it on both your computer and
your phone — most managers have both apps, and having the vault on both is the point of using one.
Install the browser extension if the manager offers one; it is how the manager fills forms
automatically.
Step 2 — Set the master password
This is the single most important decision in the whole setup, because the master password is the
entire security model. A weak master password defeats every other protection the manager offers.
Use a random passphrase of four to six words. Not a human-chosen phrase that makes
sense; a random sequence. The XKCD "correct horse battery staple" example is often cited, and the
principle is right — but the words have to be truly random, not chosen to form a sentence.
Write it down on a piece of paper. Store it somewhere physically safe — a drawer, a safe, a locked
box — where you can retrieve it. Yes, written down. The risk of a burglar breaking into your home
specifically to find your master password note is far lower than the risk of forgetting the
passphrase and losing access to every account you own.
Do not store the master password in a text file, a notes app, or an email draft. Those are all
things an attacker who has access to your device would check first. The paper is not.
Step 3 — Protect your email account first
Your email account is the reset path for almost every other account. If someone has access to your
email, they can use the "forgot password" flow on any service you use. Protecting the email password
is therefore the single highest-value change you can make.
Change your email password to a strong random one generated by the manager. Save it in the vault.
Enable two-factor authentication on the email account. Enable the manager's own two-factor
authentication if it offers one (most do).
Do this before touching anything else. It takes about half an hour and covers most of the actual
risk.
Step 4 — Protect financial accounts
Banks, payment apps, anything that stores card details or can move money. Change each password to a
random one generated by the manager. Enable two-factor authentication where it is offered.
This is where the direct financial impact of a compromise is concentrated, so it is worth doing
carefully and thoroughly. Plan for it to take an hour, because banks are often the accounts with
the most involved login flows.
Step 5 — Everything else, gradually
Do not try to change every account in one sitting. You probably have dozens or hundreds, and
trying to handle them all at once is the reason most people abandon the setup halfway through.
Instead, let the manager prompt you. As you log into each service over the following weeks, the
manager will offer to save the new password — accept, let it generate one, and move on. Over
months, you will end up with every account migrated, without ever having done a dedicated session
for it.
For accounts you genuinely never log into, they will not be prompted, and they will remain on
whatever password they had. This is fine — those accounts are usually the ones with the least
value.
Step 6 — Set up a recovery method
Before you finish, set up whatever recovery mechanism your manager offers. Most managers support
a recovery kit — a printable document with a recovery key and instructions — that lets you restore
access if you forget the master password on one device but still have the vault.
Store the recovery kit with the master password note. If both are in the same place and both are
lost, the vault is unrecoverable.
Step 7 — Test it
Before you rely on the manager for anything important, log into a low-stakes account using the
manager's autofill and confirm it works. Then change one password through the manager and log back
in. This validates the whole loop — generation, saving, filling — before you depend on it.
5. Common problems and what to do
"I forgot my master password"
This is the most common problem and the one that deserves an honest answer.
If the manager is well designed, there is no password reset. The provider does not have your master
password and cannot recover the vault without it. This is the security feature working as intended —
the same property that prevents the provider from reading your vault also prevents them from
helping you when you lose access.
The realistic options:
If you wrote the master password down, retrieve it. This is why step 2 above says to write it down. The paper is the recovery mechanism for most people.
If you have a recovery kit, use it. This is what it is for.
If you have the vault on a device that is still unlocked, export it immediately. Most managers offer an export function that produces a readable (not encrypted) copy of the vault. Export it, save it somewhere safe, then set up a fresh manager with the exported data. This is the practical escape route for anyone whose device is still accessible.
If none of those apply, the vault is gone. Every account that was only in the vault needs to be recovered through the "forgot password" flow on each service. This is painful but usually possible, because most services allow password reset through email. The reason it is painful is that it takes hours, not because the accounts are lost.
The lesson, if this has already happened: the paper note and the recovery kit are not optional.
They are what makes the manager usable in the long term.
"My passwords are split between my browser and my manager"
This happens because browsers offer to save passwords automatically, and people click "Save" without
thinking. The result is two vaults that do not know about each other.
The fix: import the browser's saved passwords into the manager. Most managers offer an import from
the major browsers. Then turn off the browser's own saving of passwords, so future entries only go
to the manager. This takes about ten minutes and prevents the fragmentation from getting worse.
"I need to share a password with someone"
Most managers offer a sharing feature — either a family account (shared vault with specific people)
or a one-off share link (a single entry, sent via a link that expires). The family account is the
right choice for a partner or family members you regularly share logins with (streaming services,
utilities, a shared bank account). The one-off link is the right choice for a temporary share
(someone covering your work while you are away).
What not to do: send the password by email, message, or text. Those are not encrypted and will
persist in both parties' inboxes indefinitely. If a manager's share feature is available, use it.
If it is not, the next best option is a service like a one-time secret (privatebin, onetimesecret)
that self-destructs after being viewed.
"My manager is not filling in the password"
The most common cause is that the site changed its login form, or uses an unusual layout the
manager does not recognise. The fix is usually to copy the password from the manager manually for
that site — which is annoying but works. Some managers allow you to specify custom fields for
specific sites to handle this.
A rarer but more serious cause: the site is a phishing imitation and the manager refuses to
autofill because the domain does not match. If a password manager does not offer to fill in a
login form, that is sometimes a warning, not a bug. The earlier guide on
how to tell if a
website is safe covers the underlying reason.
"The vault is showing duplicate or conflicting entries"
This can happen if you edit a password on one device and the change does not sync before you edit
it on another. Most managers handle this reasonably — they show both versions and let you choose —
but the practical fix is to resolve the conflict by picking the correct version and deleting the
other.
The underlying prevention is to make sure the manager's sync is working. Most show a "last synced"
indicator; if it is showing a time from yesterday, something is wrong and the conflict is likely to
get worse before it gets better.
6. Where passkeys fit
Passkeys are the next generation of authentication and they change the password problem in a more
fundamental way than any manager. A passkey is a cryptographic credential stored on your device,
unlocked by your fingerprint, face or device PIN. There is no password to store because there is
no password at all.
The reason they are relevant to a password manager article: most managers now also store passkeys.
The manager becomes the vault not just for passwords, but for the credentials that are replacing
them. If you are choosing a manager today, checking that it supports passkeys is worth doing,
because you will be using them within the next few years whether you have chosen to or not.
The relationship between the two is straightforward. Passkeys replace passwords at the account
level, one account at a time, as services add support. In the meantime, your password manager holds
both the passwords for sites that still use them and the passkeys for sites that have moved on. As
more sites adopt passkeys, the manager becomes less about passwords and more about credentials in
general.
The security advantage of passkeys over passwords — even passwords in a good manager — is that
passkeys are bound to a domain. If you are on a lookalike site, the passkey does
not appear. There is nothing to phish because there is nothing to steal. A password manager
reduces the phishing risk (by matching domains) but does not eliminate it. Passkeys eliminate it.
A password manager solves the problem that cannot be solved by memory alone. You remember one strong
passphrase; it remembers everything else. The vault is encrypted on your device, so even a synced
manager cannot read it, and the only real failure mode is forgetting the master password — which
has a clear mitigation: write it on paper.
The setup is not the project it looks like. Install, choose a master password, protect your email,
protect your financial accounts — four steps in one sitting. Everything else happens gradually as
you go about your normal use, and the manager handles it in the background.
The choice between the three types is less important than the choice to use any of them. Browser
built-in, dedicated cloud-synced, local-only — any one is dramatically better than reusing
passwords, and all three are converging on the same future where passkeys make the password itself
obsolete.
Frequently asked questions
Is it safe to use a password manager?
The established ones are designed to be safer than any alternative approach. The vault is encrypted
on your device with a key derived from your master password, so even the provider cannot read it.
The main risks are a weak master password, a reused master password, and forgetting the password
entirely — all of which are addressed by the setup process above.
What happens if the password manager company is hacked?
The attacker gets an encrypted copy of the vault. Because the vault is encrypted with a key derived
from your master password, and the provider does not have the master password, the attacker cannot
decrypt it without either guessing your master password or exploiting a flaw in the implementation.
A strong master password and a well-audited manager together make this impractical.
Can I use more than one password manager?
You can, but it is usually a mistake. Having passwords split across two managers means neither is
complete, and the fragmentation leads to the same reuse problem you were trying to solve. Pick one,
migrate everything into it, and stick with it. Browser built-in plus a dedicated manager is a
particularly common mistake that leaves passwords scattered.
How do I back up a password manager?
Most managers offer an export function that produces an encrypted or readable copy of the vault.
Export it periodically, save it to an external drive, and store the drive somewhere safe. For
local-only managers, this is essential — the export is the only backup. For cloud-synced managers,
the export is a safety net for the case where you lose access to the account.
Is a free password manager good enough?
Usually, yes. Bitwarden's free tier is generous and includes everything most people need. The
browser built-in managers are entirely free. Paid tiers typically offer family accounts, advanced
sharing, breach monitoring at scale, and priority support — useful, but not necessary for a single
user who just wants unique passwords everywhere.
Should I use a password manager for my bank account?
Yes, and this is one of the most important places to use it. Bank logins are high-value targets and
frequently targeted in phishing. A password manager protects against both credential reuse and
phishing (by matching domains), and autofill is faster than typing the password manually. Enable
two-factor authentication on top for additional protection.
What if I lose my phone with the manager on it?
You still have the vault on other devices — desktop, tablet, or wherever else you installed the
manager. If the phone is the only device, you can typically recover from a cloud-synced manager by
logging in on a new device. For local-only managers, the vault file is the backup — which is why
exporting and storing it separately is essential.
Do password managers work offline?
Local-only managers work entirely offline. Cloud-synced managers usually have an offline mode for
recently accessed entries, but adding new entries may require a connection to sync. Browser
built-ins typically work offline for saved passwords, with sync resuming when the connection
returns.
A note on provider recommendations: this article names Bitwarden, 1Password,
Dashlane, Proton Pass, KeePassXC and the major browser built-ins as examples of their categories.
It does not rank them or claim any is "best." All of these are established products with public
documentation; choosing between them is less important than choosing to use any of them. If any
changes ownership, business model, or security posture significantly, the recommendation should be
re-evaluated.
Sources and further reading:
Bitwarden public documentation on its encryption model and third-party security audits;
1Password public security design documentation and audit history;
KeePassXC public documentation;
Apple Platform Security guide (for iCloud Keychain);
Google public documentation on Google Password Manager;
Mozilla public documentation on Firefox's built-in password manager;
FIDO Alliance documentation on passkeys and WebAuthn;
NIST Special Publication 800-63B on authenticator requirements.
Abstract network of glowing nodes and connecting lines A dark blue field with luminous dots joined by thin lines, suggesting circuits, data flow and interconnected computing systems. Original illustration — computing today is less a stack of parts than a web of connected systems. How Computer Science Is Changing in 2026: Programming, Hardware, AI and Security Four areas of computing are moving at once — and each one is quietly reshaping the other three. Here is a plain-English look at where things actually stand, what is still hype, and what it means for anyone who uses, studies or works with technology. Computer science has always changed incrementally. What feels different right now is the pace at which separate fields are colliding. A new programmin...
Abstract scatter of points radiating outward from a bright origin A dark blue field with hundreds of small dots radiating outward from a bright origin point on the left, suggesting scientific discovery expanding into unexplored territory. Original illustration — research expands outward from what is established into what is not. Science and Technology Frontiers in 2026: AI, Space, Quantum Computing and Biotech The word "breakthrough" is used loosely in science coverage. Some of what follows genuinely earns the label. Much of it doesn't — yet. Here is an honest look at four frontiers, separating what has actually shipped from what is still being researched. A CRISPR therapy is now approved and treating...
Grid of connected nodes suggesting layers of computing A dark navy background with three horizontal bands of glowing nodes connected by lines, suggesting layers of a computing system. Original illustration — computer science is a stack of layers, each built on the one beneath it. Computer Science Fundamentals in 2026: A Practical Guide Computer science covers a lot of ground, and most "complete guides" collapse under their own ambition. This one takes a different approach: a clear map of what the field actually contains, what each area does, and how the pieces fit together — without pretending that reading one article makes you an expert. What you will get ...