Skip to Main Content
Password Security

Password managers: how they work and whether to trust one

The objection to password managers is that they put every password in one place. The answer is that the realistic alternative is not perfect memory — it is reusing six passwords across two hundred accounts.

Subash Poudel4 min read

The short answer

  1. A password manager encrypts your vault on your device, so the provider stores data it cannot read.
  2. The single-point-of-failure objection compares a manager against perfect memory. The real alternative is password reuse, which is far worse.
  3. Autofill is an underrated phishing defence - a manager will not fill your bank password on a lookalike domain, because the domain does not match.
  4. Your master password must be one you have never used elsewhere, and the account must have two-factor authentication.
  5. Browser-built-in managers are a genuine improvement over reuse; dedicated managers add cross-browser support, sharing and breach monitoring.

Almost everyone raises the same objection: putting every password in one place sounds like a terrible idea.

It is a reasonable instinct, and it is answering the wrong comparison. The alternative to a password manager is not a perfect memory holding two hundred unique twenty-character strings. The alternative, in practice, is six passwords recycled across two hundred accounts — which is the exact condition that makes credential stuffing the most productive attack in consumer security.

How they actually work

The mechanism matters, because it answers most of the objections.

  1. Your vault is encrypted on your device, using a key derived from your master password.
  2. The provider receives and stores the encrypted blob. They do not have your master password and cannot derive the key.
  3. Decryption also happens on your device, when you unlock it.

This is usually called zero-knowledge architecture, and the consequence is specific: a breach of the provider yields encrypted vaults, not passwords. This is not a claim about how careful the company is. It is a property of where the encryption happens.

The phishing benefit nobody mentions

This is the most underrated feature of a password manager and it has nothing to do with storage.

A manager associates each credential with a specific domain. On paypal-secure-verify.net, your PayPal password is not offered — because the domain does not match. The manager simply does nothing.

That silence is a warning arriving at precisely the moment you need one, from a component that never gets tired, never feels rushed, and never gives a convincing page the benefit of the doubt.

Choosing one

The differences between reputable options are smaller than the marketing suggests. What genuinely matters:

  • End-to-end encryption, with the vault encrypted before it leaves your device
  • Independent security audits, published
  • Support for every device you use, or you will work around it
  • Passkey support, since that is where authentication is going
  • Breach monitoring, which tells you when a saved password appears in a leak

Cost is a smaller factor than people expect. The free tiers of several mainstream managers are entirely adequate for personal use, and the browser managers built into Chrome, Safari and Firefox are genuinely reasonable.

Setting it up properly

1. Choose a master password you have never used anywhere. Four random words. This is the one password protecting everything else, so it does not get reused, and it does not get to be memorable-because-familiar.

2. Turn on two-factor authentication for the manager itself. Non-negotiable.

3. Write the master password down and store it securely. A sealed envelope in a locked drawer or a safe. The threat model for most people is forgetting it, not a burglar going through their filing cabinet.

4. Set up emergency access if the manager offers it, so a trusted person can reach the vault after a delay if something happens to you.

5. Do not migrate all at once. Add credentials as you log in over the next few weeks. Attempting to import and fix two hundred accounts in one sitting is how people abandon the project.

6. Then fix the reused ones. Most managers will show you which passwords are duplicated or breached. Work down that list, starting with email, banking, and anything holding payment details.

Honest limitations

  • Your device still matters. A compromised machine with a keylogger can capture the master password as you type it.
  • You are trusting a vendor, even if you are not trusting them with plaintext. Choose one that publishes audits.
  • Recovery is genuinely hard by design.
  • It does not solve authentication, only secrets. You still want two-factor authentication and passkeys on top.

None of these outweigh the change from reuse to uniqueness, which is the single most consequential improvement most people can make to their security.

See what reuse actually costs

Our walkthrough follows one leaked password from a breach dump through an automated stuffing run to a compromised email account.

Try it free

Frequently asked questions

Are password managers safe?
Yes, and safer than the realistic alternative. A reputable manager encrypts your vault on your own device before it is stored or synced, so the provider holds data it cannot decrypt. Even in a breach of the provider, attackers obtain encrypted blobs whose security rests on your master password.
What if the password manager gets hacked?
Then attackers have your encrypted vault, not your passwords — provided your master password is long and unique. Breaches of managers have happened, and the practical lesson from them has been consistent — users with strong, unique master passwords were fine, and users who had reused a weak one were not.
What happens if I forget my master password?
With most managers, nothing can be recovered — that is a direct consequence of the provider being unable to read your vault. This is why you should write the master password down and store it somewhere physically secure, and set up any emergency access feature the manager offers.
Is the browser's built-in password manager good enough?
It is much better than reusing passwords, and if that is the realistic comparison, use it. Dedicated managers add cross-browser and cross-device support, secure sharing, breach monitoring and better organisation. The most important step is moving off reuse; which tool you use is a secondary question.
How does a password manager protect against phishing?
It matches saved credentials to a specific domain. On a lookalike page the domain does not match, so nothing is offered — and that absence is a warning at exactly the moment you need one. Unlike a person, a password manager is never tired, rushed, or willing to give something the benefit of the doubt.

Sources

  1. NIST SP 800-63B: Digital Identity Guidelines — National Institute of Standards and Technology, 2025
  2. Password manager buyers guide — UK National Cyber Security Centre, 2025
  3. Pwned Passwords — Have I Been Pwned, 2026

About the author

Subash Poudel

Cybersecurity & Digital Literacy

Subash Poudel builds SafeSurf IQ, a digital literacy platform that teaches people to recognise scams by putting them in front of real ones. He writes the online-safety reference material here, working from primary reporting — FBI IC3, the FTC, Verizon's DBIR, NCSC and Ofcom — rather than secondhand summaries.

  • Founder and engineer, SafeSurf IQ
  • Writes and reviews the platform's phishing, scam and privacy curriculum
  • Works from primary incident and fraud reporting, cited on every article

Last reviewed . Figures are checked against the primary sources listed above at each review.

Read next