Password manager

The main job of a password manager is to make reusing passwords unnecessary. When every account has a different random password, a breach of one site cannot be used to break into others. Remembering dozens of such passwords is impossible; the manager does it for you.

Password managers come in two broad forms: those built into browsers and operating systems, and dedicated apps that work across all your devices and browsers and add features such as secure sharing with colleagues. Both are far better than reusing passwords or keeping them in a spreadsheet.

How it works

Your passwords are stored in a vault that is encrypted on your device before it is synced to the provider's servers. Reputable dedicated managers use a design in which the provider never holds the key, so even its own staff, or someone who breaches its servers, sees only scrambled data. The key is derived from your master password, sometimes combined with an extra secret key stored on your devices, which is why that one password must be long, unique and never stored in the vault itself.

When you visit a login page, the manager checks the site's address and offers the matching saved login. Because it matches on the real address, it will not fill your bank password into a look-alike phishing site, which is a useful warning sign in itself. When you create a new account, it generates a long random password and saves it.

Most managers also store two-factor backup codes, secure notes and often passkeys. Business versions add shared vaults, so a team can use the hosting or social media login without the password being sent by email, and let an administrator remove a departing employee's access in one step. Many also warn when a saved password appears in known breach lists.

Example

A five-person design agency keeps its logins in a shared spreadsheet, and several staff use the same password for everything. When a former freelancer's personal email is compromised, the agency realises it cannot tell which accounts that person could still access.

It moves to a business password manager. Each person gets their own vault, and shared vaults hold client hosting, domain and social logins. Over a week the team changes every shared password to a generated one, turns on 2FA where available and stores the backup codes in the vault. When the next freelancer finishes a project, removing their access to the shared vault takes a minute, and the most sensitive passwords are changed afterwards.

Why it matters for your business

Reused and weak passwords are one of the most common ways accounts are taken over, and a single compromised email or hosting login can lead to a data breach or a defaced website. A password manager fixes reuse for a small monthly cost per user, or for free with built-in options, and saves time typing and resetting forgotten passwords. The trade-offs: the master password becomes a single point of failure, so protect it with 2FA, and staff need a short introduction to use it consistently. You can check your exposure by running the manager's password health report, which lists reused and weak passwords.

Common mistakes

• Using a short or reused master password, which undermines everything stored in the vault.
• Keeping old copies of passwords in spreadsheets or email after moving to a manager.
• Sharing business logins by message or email instead of through a shared vault.
• Not setting up an emergency or recovery option, so a forgotten master password locks the business out.

Questions people ask

Are password managers safe?

Reputable ones are far safer than reusing passwords. They encrypt your vault on your device, so the provider cannot read it. The main risk is a weak master password or malware on your own device. Use a long unique master password and turn on two-factor authentication for the vault.

Is the password manager built into my browser good enough?

For one person using one browser and device family, it is a big improvement on reuse. Dedicated managers are better for teams and for people who use several browsers or operating systems, because they work everywhere and support secure sharing and access removal.

What happens if I forget my master password?

With most managers designed so the provider never holds your key, the provider cannot reset it for you. Set up the recovery option offered, such as a recovery key or trusted emergency contact, and for business plans make sure an administrator can restore access.