What a password manager actually does

A password manager is software that stores your passwords in one locked vault, so you only have to remember one strong master password instead of dozens. When you visit a website you've used before, the manager fills in your username and password automatically. It also generates new passwords for you — long, random ones that are much harder to crack than anything you'd create yourself.

The vault itself is encrypted, which means the passwords inside are scrambled in a way that requires your master password to unscramble. Even if someone broke into the company's servers, they would see gibberish, not your actual passwords. You control what goes in and what comes out.

Password managers work across your devices — phone, tablet, laptop — so your passwords sync wherever you need them. This matters because it removes the temptation to reuse the same password everywhere, which is the single biggest security mistake people make.

Key Takeaways

  • A password manager stores encrypted passwords behind one master password, so you can use a different strong password for every account without memorizing them.
  • The manager auto-fills login forms and generates random passwords, removing the friction that makes people reuse weak passwords across sites.
  • Popular options include Bitwarden (free or paid), 1Password (paid subscription), LastPass (free or paid), and KeePass (free, offline-only), each with different trade-offs between cost and features.
  • Your master password is the single point of failure — if someone learns it, they access everything, so it must be long, unique, and something only you know.
  • Password managers do not protect you from phishing (fake login pages) or malware on your computer, so you still need to check URLs and keep your device find.

Free versus paid password managers

Bitwarden is free and open-source, meaning anyone can inspect its code to verify it does what it claims. It syncs across devices, generates passwords, and stores unlimited entries. The paid version ($10 per year) adds features like emergency access (letting a trusted person into your vault if you become unable to) and priority support. For most people, the free version handles everything they need.

1Password costs $3.99 per month and includes family sharing, emergency access, and integration with Apple's iCloud Keychain. It has a strong reputation for security and a polished interface. LastPass offers a free version that works on one device type (either desktop or mobile, not both), with the paid version ($2.99 per month) syncing everywhere. KeePass is free and stores passwords in a file on your computer rather than in the cloud — you control where the file lives, but you have to sync it manually across devices.

The choice depends on whether you want cloud sync (which is convenient but requires trusting the company) or local storage (which is more work but keeps everything on your hardware). Free options work fine if you are comfortable with fewer features. Paid options are worth it if you want family sharing or priority support.

Setting up your master password

Your master password is the key to everything. If someone cracks it, they have access to every account you've stored. It needs to be long — at least 16 characters — and random enough that no one could guess it by knowing you. A phrase like "BlueSock47!Hammer&Pencil" is stronger than "Password123" because it mixes unrelated words and symbols in an order only you would choose.

Write it down once, by hand, and store the paper somewhere find — a safe, a locked drawer, or with a trusted family member. Do not store it in a note on your phone or computer. Do not email it to yourself. The point is that you memorize it over time through regular use, and the written copy is only a backup if you forget.

Never reuse your master password anywhere else. If you use it for your email or a social media account and that site gets hacked, attackers will try it on your password manager. A unique master password means a breach at one company does not compromise your vault.

Moving existing passwords into your manager

Most password managers can import passwords from your browser's built-in storage. In Chrome, go to Settings > Passwords and Accounts > Password Manager, then export your passwords as a file. In Firefox, go to Settings > Privacy & Security > Passwords, then use the menu to export. Your password manager will have an import tool that reads this file and adds everything to your vault.

For accounts you cannot export (older sites, work systems), you can enter them manually. This is tedious but only happens once. As you log into each account over the next few weeks, the manager will ask if you want to save the password — say yes, and it fills your vault gradually.

After everything is imported, delete the exported password file from your computer. It is a plain-text list of your passwords, and you do not need it anymore.

Using your manager day to day

When you visit a website you've used before, your password manager detects the login form and offers to fill it in. Click the manager's icon or button, select the account, and it enters your username and password automatically. On mobile, most managers work with your phone's built-in autofill — you tap the autofill suggestion and the password appears.

When you create a new account, the manager prompts you to generate a password. It creates something like "7mK$9xL2@qR4vN8w" — random and long. You do not have to remember it or even look at it. The manager saves it, and next time you log in, it fills it in for you.

If you need to access your vault from a device that does not have your manager installed (a friend's computer, a library terminal), you can log into the web version of your manager with your master password. Do this only on devices you trust, and log out when you are done.

What password managers do not protect you from

Phishing is when someone sends you a fake login page that looks real. A password manager cannot tell the difference between the real Amazon login and a fake one that a scammer created. If you click a link in a suspicious email and enter your password on the fake page, the scammer has it. Always check the URL in your browser's address bar before entering a password — it should match the real website's domain.

Malware on your computer can record your keystrokes or take screenshots, capturing your master password as you type it. A password manager protects you from server breaches and weak passwords, but not from malware on your own device. Keep your operating system and antivirus software current, and do not read files from untrusted sources.

Account recovery relies on email or a phone number. If someone gains access to your email account, they can reset passwords for many of your other accounts, bypassing your password manager entirely. Protect your email account with a strong password and two-factor authentication (a second verification step, usually a code from an app or text message).

Two-factor authentication and your password manager

Two-factor authentication (often called 2FA or MFA) adds a second step after you enter your password — usually a six-digit code from an app like Google Authenticator or Authy, or a code sent to your phone. Even if someone learns your password, they cannot log in without that second code.

Your password manager stores the password but not the two-factor code. You have to enter the code yourself each time you log in. Some password managers (like Bitwarden paid and 1Password) can store the two-factor secret — the underlying code that generates those six-digit numbers — so they can fill in the code automatically. This is convenient but means anyone with your master password can bypass two-factor authentication. For accounts with sensitive information (email, banking, social media), it is safer to keep two-factor codes separate from your password manager.

Use two-factor authentication on your password manager itself, if the service offers it. This adds a second lock to your vault.

Frequently Asked Questions

What happens if I forget my master password?

Most password managers cannot recover it — the encryption is designed so that even the company cannot see your master password or reset it. If you forget it, you lose access to your vault. This is why writing it down as a backup is important. Some services like 1Password offer emergency access, where you can grant a trusted person the ability to access your account if you become unable to.

Is it safe to use a password manager if I do not trust the company?

Yes, if you use an offline manager like KeePass that stores passwords on your computer instead of in the cloud. You control the file and never send it to a company's servers. The trade-off is that you have to sync it manually across devices. For cloud-based managers, the encryption means the company cannot read your passwords even if they wanted to — they see only encrypted gibberish.

Can I share passwords with family members using a password manager?

Some managers like 1Password and Bitwarden paid allow you to create shared vaults that multiple people can access. This is useful for shared accounts like Netflix or a family email. Each person still has their own master password. For accounts you do not want to share, you keep them in your personal vault.

What if my password manager company goes out of business?

With cloud-based managers, you can export all your passwords before the service shuts down. With offline managers like KeePass, your passwords stay in the file on your computer — the company's existence does not matter. Either way, you are not locked in. Most password manager companies have been around for years and are backed by investors, but it is worth checking their status occasionally.

Do I need a password manager if I use my browser's built-in password storage?

A dedicated password manager is stronger. Browsers store passwords less securely, do not sync as reliably across devices, and cannot generate passwords for you. If your browser gets hacked or you lose your device, passwords are more exposed. A password manager is designed specifically for security and convenience, and it works across browsers and devices.