What is a password manager?

A password manager is an app that generates, stores, and fills in a different password for every account you own, all locked behind one master password that only you know. In any manager worth using, your credentials are encrypted on your own device before they ever touch the company’s servers — which means the company can’t read your passwords either. (Your browser’s built-in one may not clear that bar by default; Chrome’s sync is readable by Google unless you set a separate on-device passphrase.) That’s the whole product.

The rest of this post is why that sentence matters more than it sounds, the one thing it quietly does that has nothing to do with remembering passwords, and what to do in your first ten minutes.

What’s inside the vault

Passwords, obviously. But a modern vault also holds usernames, credit cards, addresses, recovery codes, secure notes, two-factor codes, and increasingly passkeys — all in the same encrypted container, synced across your laptop and phone.

The load-bearing word there is encrypted. Your vault is scrambled locally, using a key derived from your master password, and the scrambled version is what gets uploaded.

So when people ask “isn’t it risky putting all my passwords in one place?” the honest answer is: it is one place, but nobody at the company holds the key. Not support, not an engineer having a bad week, not a subpoena — a legal request gets them an encrypted blob and your billing address, not your logins. The asterisk: you’re still trusting the vendor’s client not to quietly phone your master password home as you type it. That trust is thinnest in the browser web vault, which re-downloads its own JavaScript from the vendor every visit — an audit of last quarter’s code says nothing about the bundle you loaded this morning. Which is why “open source, independently audited, and installed rather than streamed” beats marketing copy.

That design has a sharp edge: if you forget your master password there’s no reset link — the company genuinely cannot recover it, because it never had the key. A feature and an inconvenience wearing the same coat, which is why every decent manager ships an escape hatch (a recovery kit, an emergency-access contact) — set one up on day one, not day never.

Why “I’ll just remember them” stopped working

Count your accounts. Not the ones you use weekly — all of them, including the forum you signed up for in 2014 and the airline you flew twice.

Most people land somewhere between 100 and 200 — vendor telemetry from the managers that can actually count puts the average personal vault near 170. Nobody generates and recalls 150 distinct random strings, so we all default to one of two coping strategies: reuse one password everywhere, or run one base password with small variations. Fluffy2019!, Fluffy2020!, you know the genre.

They fail differently, and the difference is worth being precise about. Reuse goes first: attackers aren’t sitting at your login screen guessing one try at a time — they take username and password pairs leaked from some unrelated breach and replay them automatically against hundreds of other sites.

That’s called credential stuffing, and it’s the highest-volume way ordinary accounts get taken over — cheap, automated, millions of attempts with no human in the loop. It’s also the machinery behind the 2am “your password was found in a data breach” email — the breach at the original site is rarely the real damage, the reuse is.

The variation trick fails differently, and it fails twice. The direct version doesn’t need a hash leak at all: once your Fluffy2019! is in a dump, the mutation is trivially machine-generatable, and stuffing tools try the obvious next few — increment the year, bump the capital, swap the punctuation — right alongside the original. Researchers call it credential tweaking, and against people who vary a base password it works disturbingly often within a handful of guesses.

The slower version arrives when a site leaks hashes rather than plaintext. Then the attacker works offline through a cracker like hashcat, which has had human mutation patterns modelled in rule files for years: capital on the front, year on the end, exclamation mark for luck.

A password that looks clever to you looks like a rule file to a machine that never gets bored.

Here’s what changes when a manager is doing the work. Every account gets a long random password you never see, never type and never reuse — so a breach at one site goes back to being a one-site problem.

But there’s a second thing happening in the background that almost nobody signs up for, and it’s arguably better than the passwords.

The underrated part: autofill doesn’t fall for phishing

Your password manager fills credentials based on the domain it saved them under. Land on paypa1-security-verify.com and it offers you nothing — no saved login, no autofill prompt, just an extension quietly declining to participate.

You, at 11pm, on a phone screen, reading an email written by someone who does this professionally, might well click through. Your manager won’t, because it isn’t looking at the logo or the tone — it’s matching a string, and the string is wrong.

That silence is the signal. If autofill doesn’t offer, stop and check the URL — that half-second of hesitation has saved more accounts than every “be careful what you click on” lecture ever delivered.

The caveat is real, though: this only works if you let it fill. Copying the password out of the vault and pasting it into whatever page is in front of you throws away the entire protection — as does loosening an entry’s match setting to shut up a login that kept refusing to cooperate. And the guarantee is tightest in the browser extension; mobile autofill matches apps rather than URLs, which is a fuzzier business.

This is also the argument for passkeys, which your manager can store alongside everything else — cryptographically bound to the origin they were created for, so there’s no string to paste into the wrong box. The phishing site asks, and the maths says no.

What a password manager doesn’t do

It isn’t antivirus, and it isn’t a VPN. If your device is already running a keylogger, everything you type — master password included — is exposed, vault or no vault.

It also doesn’t replace two-factor authentication. Most managers will generate your 2FA codes right next to the login, which makes 2FA dramatically less annoying — with the honest caveat that keeping both factors in one vault means one compromised vault hands over both at once.

Still an enormous net win over no 2FA at all. But for your email and your bank, put the second factor somewhere else: a separate authenticator app, or a hardware key. If none of this is set up yet, start with our walkthrough of turning on 2FA without breaking your workflow.

And it can’t make your master password strong on your behalf. Everything hangs off that string, so make it a passphrase — and let the generator pick the words, because five or six randomly chosen words is roughly seventy bits of entropy while five or six words a human thought of on the spot is considerably less than it feels like. Then never type it anywhere except the manager itself.

But what if the vault itself gets breached?

It happens, and pretending otherwise would be insulting. Vault-provider breaches have happened before, and when they do, what actually gets exposed depends almost entirely on how the vault was built and configured.

What attackers get, in a well-built vault, is ciphertext — mostly. Usernames, passwords and secure notes stay encrypted. The failure mode to watch for is metadata sitting unencrypted next to those fields: a site’s URLs are the classic one, since they let attackers sort stolen vaults by whether one contains a crypto exchange or a fantasy football league before spending a single GPU-hour on it.

The vaults that actually fall in an incident like this tend to share two traits: a short master password, and an account still running whatever iteration count it was created with, years after the vendor quietly raised the default for everyone else. A vault stuck on an old, low iteration count isn’t making anyone’s GPU work hard — that’s the whole problem. The maths never failed. The maths was fine. What failed was a settings page nobody opened in years, on accounts whose owners had no idea there was a number on it.

That’s the actual lesson, and it’s an operational one: what stands between a stolen vault file and a cracked one is your master password’s entropy and how expensive the KDF makes each guess. Two dials there — the iteration count, and the algorithm itself, since PBKDF2 rents beautifully on GPUs while a memory-hard KDF like Argon2id does not.

Which makes the takeaway a shopping list rather than a chore list: you want a manager whose KDF defaults are current, that lets you see and raise them, and that supports two-factor authentication on the vault login itself — that guards the front door rather than the stolen copy, a different job worth doing either way. Plus a master password long enough that none of the above ever gets tested.

None of which is an argument against vaults. It’s an argument for setting one up properly — and then weighing that risk against the setup you’re running right now, one password across a hundred and fifty sites, quietly waiting for any one of them to have a bad quarter. It stops being a close call.

So which password manager should I get?

For most people asking this question for the first time: Bitwarden. It’s open source, independently audited, syncs across every platform you own, and its free tier is genuinely usable rather than a trial wearing a disguise.

There are good arguments for the paid alternatives — nicer family sharing, slicker apps, better travel features — and comparison posts are coming. But none of that matters as much as having any manager installed by tonight.

Research paralysis is how people spend six months with Fluffy2020! still guarding their email.

Your first ten minutes

Don’t try to migrate 150 accounts this evening. Install the app, set a long master password you can actually remember, and add exactly three logins.

Email first, always — it’s the password-reset path for every other account you own, whether you think of it that way or not. Then your bank. Then whichever social account would hurt most in someone else’s hands, because getting a hijacked Instagram back takes 47 focused minutes you’d rather not spend.

After that, do nothing on purpose. Let the manager offer to save each login as you sign in over the following weeks, and when its vault report flags one as weak, reused, or turned up in a breach, spend the thirty seconds to let it generate a replacement — the vault fills itself if you just stop saying no to the popup.

One password to remember, a hundred and forty-nine you’ll never see again. That’s the trade, and it’s the best one on offer in personal security.