A password manager stores a unique random password for every account in an encrypted vault that you unlock with one master password. For most people the one built into Apple or Google devices, or an open-source option like Bitwarden or KeePassXC, is enough. A long master password and two-factor protection on the vault matter more than the brand.
Most people don’t have a password problem. They have a memory problem. With 100 to 200 accounts, a realistic number for anyone who has shopped online for a decade, nobody can remember 150 different random passwords. So they get reused. And reuse is exactly what attackers exploit after every data breach.
Why a password manager beats “strong passwords”
A strong password used on ten sites is known on all ten the moment one of them is breached. Attackers feed leaked email and password pairs into tools that try them automatically across hundreds of other services. It’s called credential stuffing, and it works because reuse is so common.
A password manager fixes this by generating a different random password for every account and filling it in when you sign in. You remember one thing: the master password. When a site gets breached, only that one account is affected. What to do in that situation is in email in data breach: what to do.
There’s a second benefit people underrate. A password manager only fills in passwords on the correct domain. On paypal.com.account-verify.example it offers nothing, which makes it a decent phishing alarm.
Three kinds of password manager
| Type | Examples | Where the vault lives | Suits |
|---|---|---|---|
| Built into the OS or browser | Apple Passwords, Google Password Manager, Firefox | vendor cloud, end-to-end encrypted (depending on settings) | people who stay within Apple or Google |
| Standalone with sync | Bitwarden, 1Password, Proton Pass | provider cloud, end-to-end encrypted | mixed devices, families, teams |
| Local file | KeePassXC, KeePassDX, Strongbox | a file on your device; you arrange sync | people who want no cloud and don’t mind some tinkering |
The right pick depends on your setup. If you use an iPhone, iPad and Mac, Apple’s app is fine. If you have a Windows laptop and an Android phone and share logins with a partner, Bitwarden or 1Password fits better. Bitwarden and KeePassXC are open source, which makes independent review easier.
Cloud vaults aren’t unsafe by default, but they are targets. In late 2022 LastPass disclosed that attackers had copied backups of encrypted customer vaults. From then on, those vaults were only as safe as each user’s master password. Which brings us to the most important part.
How strong the master password needs to be
The master password is the only thing standing between a stolen vault and your accounts, so it has to survive an offline attack with serious computing power. The simplest way is a passphrase of randomly chosen words, for example rolled with dice from a 7,776-word list (five rolls per word).
| Passphrase | Entropy (approx.) | Verdict |
|---|---|---|
| 4 random words | 52 bits | too weak for a vault |
| 5 random words | 65 bits | minimum |
| 6 random words | 78 bits | good |
| 7 random words | 90 bits | very good |
Each word from 7,776 options adds log2(7776) ≈ 12.9 bits. The words must be genuinely random. A song lyric or a sentence you “made up” has far less entropy than its length suggests.
NIST’s SP 800-63B, revision 4, asks for at least 15 characters for passwords used as the only factor, and advises against composition rules like “one symbol, one number”. A six-word passphrase clears that easily.
Write the master password on paper and keep it somewhere safe at home. It sounds old-fashioned, but a burglar in your flat isn’t the threat you’re defending against here.
Locking down the vault itself
- Two-factor sign-in on the manager account, so the master password alone isn’t enough to pull the cloud vault onto a new device.
- Emergency access. Bitwarden lets a trusted contact request access after a waiting period you set; 1Password provides a printable Emergency Kit and recovery through family accounts. This matters more for your heirs than you might think.
- A strong key derivation function. Bitwarden and KeePassXC can use Argon2id, which slows down guessing attacks considerably. On older accounts it’s worth checking that a weak default isn’t still active.
Passkeys and email addresses belong in there too
Modern password managers also store passkeys, the phishing-resistant successor to passwords. Wherever a site supports them, switch.
If you give each service its own address on your own domain (see catch-all email address), store that address in the same entry. You’ll find it again, and when a breach check flags it, you’ll know at once which account is involved.
Which accounts to fix first
After importing, don’t work alphabetically. Work by potential damage:
- Email, because it can reset every other password
- Your domain registrar, if you own a domain
- Bank, PayPal, credit cards
- Cloud storage with photos and documents
- Shops with a saved payment method
- Everything else, guided by the manager’s reuse and breach warnings
Number two is the one people forget. Whoever takes over your registrar account controls your domain, and with it every email sent to your addresses. At betadomain that account is also where your domain’s DNS records are managed, so it deserves a unique password and 2FA. If you are about to choose a domain for your email, pick one you’ll keep for good, because your logins will hang off it. The yearly prices for every extension apply to renewals too.
Step by step
- Choose a managerPick based on your devices: the built-in manager if you live in one ecosystem, Bitwarden or 1Password for mixed devices or families, KeePassXC for a local file.
- Create the master passwordUse a passphrase of at least six randomly chosen words, write it on paper and keep it somewhere safe at home.
- Protect the vaultTurn on two-factor sign-in for the manager account and set up a recovery key or emergency access.
- Import existing passwordsExport saved passwords from your browser as CSV, import them and delete the CSV file immediately afterwards.
- Replace the important passwords firstGenerate new passwords for email, banking, your domain registrar and cloud storage, then work through the reuse warnings.
- Turn off the old storeIf you moved to a separate manager, disable password saving in the browser so a second, neglected copy doesn't build up.
Found your domain? You can check and register it directly at domain registration without teaser pricing – yearly price from €2.99.
FAQ
Isn't a password manager a single point of failure?
In one sense, yes: everything sits in one place. The realistic alternative is password reuse, where a single breach unlocks many accounts. A well-protected vault with a long master password is by far the smaller risk.
Is the browser's built-in password manager good enough?
For many people, yes. Chrome, Safari and Firefox generate random passwords, sync them encrypted and warn about breached ones. They are weaker at sharing with other people and awkward if you switch between Apple, Google and Windows.
What if I forget my master password?
With true end-to-end encryption, the vault is gone; the provider can't open it. Some managers offer recovery keys, an emergency kit or access via a trusted contact. Set that up on day one.
How often should I change my passwords?
Without a reason, not at all. NIST's SP 800-63B guidance explicitly advises against forced periodic changes and calls for a change only when there is evidence of compromise. A random, unique password doesn't weaken with age.