What Is a Password Manager? (And Why You Need One)

Every piece of good password advice — use long, random, unique passwords for every account — is impossible to follow with your memory alone. A password manager is what makes it practical, and it's arguably the single highest-impact security tool most people can adopt.

What is a password manager?

A password manager is an application that generates, stores and fills in your passwords. It keeps them in an encrypted vault that's locked behind one strong master password (and often a passkey or biometric). You memorise exactly one password; the manager handles the hundreds of unique, random ones for all your accounts.

The problem it solves

Humans cope with "unique password everywhere" in predictable, insecure ways: they reuse one password, use weak memorable ones, or add "1!" to meet rules. Breach data shows the result — the most common passwords are still 123456 and password, and reuse fuels credential stuffing. A password manager removes the trade-off: unique, random, strong passwords become effortless because you never have to recall them.

How the encryption works

A good password manager uses end-to-end, zero-knowledge encryption. Your vault is encrypted and decrypted on your device using a key derived from your master password; the provider stores only the encrypted blob and never sees your master password or the contents. That means even if the provider is breached, attackers get unreadable ciphertext — not your passwords. This is why the strength of your master password matters so much: it's the one key to everything.

What a password manager gives you

• Unique passwords everywhere, generated at full strength, defeating credential stuffing.
• Autofill that also resists phishing — it won't fill a password on the wrong domain.
• A security dashboard flagging weak, reused or breached passwords.
• Secure sharing and storage for other secrets (recovery codes, cards, notes).
• Passkey support for passwordless sign-in where available.

Are password managers safe?

It's a fair question — putting all your passwords in one place feels risky. But the math strongly favours it: the alternative (reuse and weak passwords) is a guaranteed weakness that attackers exploit at scale every day. A reputable manager's zero-knowledge encryption means a breach of the provider doesn't expose your vault. The main residual risk is your master password, so make it long and unique, and protect the manager itself with two-factor authentication.

Choosing and using one

• Pick a reputable manager with zero-knowledge encryption and a clear security track record.
• Set a strong, unique master password — a long passphrase you don't use anywhere else.
• Turn on MFA for the manager itself.
• Save your recovery/backup codes somewhere safe offline.
• Let it generate every new password — never invent them yourself.

Try it

A manager will generate passwords for you, but you can see the kind of output it produces with our password generator, and craft a strong master passphrase with help from how to create a strong password.