Most people do not have a password problem. They have a reuse problem. The average person has well over a hundred online accounts, and no human memory can hold a hundred different long passwords, so the brain does the sensible-sounding thing: it picks a few favourites and rotates them. That is exactly what attackers count on. When one website leaks its user database, and databases leak constantly, the stolen passwords are tried against email, banking, shopping and social accounts everywhere else. Security teams call this credential stuffing, and it works because the same password so often opens more than one door.

A password manager breaks that chain in one move. It gives every account its own long, random password, remembers all of them for you, and fills them in automatically, so you only ever have to remember one thing: the master password that unlocks your vault. Used properly, it is the single highest-value security upgrade most people can make, ahead of almost any other tool, and it costs nothing to start. This guide explains how password managers actually work, how the main types compare, what to check before you pick one, and how to move all your accounts across in a single evening without locking yourself out.

A password can be long, complicated and still unsafe, if it is used in two places. The strength of a password only matters against someone guessing it directly. Against a leaked database, strength is irrelevant: the attacker already has the exact password, and the only question is whether it opens anything else. That is why security guidance from agencies like the US Cybersecurity and Infrastructure Security Agency (CISA) now stresses long, random and unique passwords for every account, and points to password managers as one of the easiest ways to achieve that.

The second problem is scale. Password reuse is not a moral failing; it is arithmetic. Nobody can memorise a hundred unique 16-character passwords, and writing them in a notebook or a phone note is only slightly better than reusing them, because a lost notebook or a compromised note exposes everything at once, with no encryption at all. A password manager solves the memory problem instead of fighting it: the computer remembers the hundred passwords, and you remember one passphrase.

There is also a quieter benefit that rarely makes the headlines. A password manager that autofills only on the correct website will not hand your bank password to a lookalike phishing page, because the saved login simply does not match the fake domain. It is not a replacement for the vigilance described in our phishing guide, but it is a real second layer: even if you are fooled by a convincing fake page, the manager refuses to fill the real password into it.

A password manager stores your logins in a vault, which is a single encrypted file or database. When you save a password, the manager encrypts it on your own device using a key derived from your master password, and only then syncs the encrypted vault to its servers or to your other devices. With a properly designed manager, the company itself cannot read your vault, because it never holds the key. This design is called zero-knowledge or end-to-end encryption, and it is the first thing to look for in any manager you consider.

That design has one consequence you must understand before you start, because it surprises people at the worst possible moment. If the company cannot read your vault, it usually cannot reset your master password for you either. Forgetting the master password can mean losing access to the vault entirely, unless you set up a recovery method in advance. This is not a flaw in the product; it is the price of the privacy. Section 6 covers exactly which recovery steps to set up, in which order, so that this never happens to you.

Day to day, the manager lives in two places: an app on your phone and a browser extension on your computer. When you visit a login page, the extension offers the saved credentials and fills them in with a click. When you create a new account, it offers to generate a password for you, typically 20 or more random characters, and saves it automatically. Good managers also store more than passwords: passkeys, two-factor codes, secure notes, card details and Wi-Fi passwords, and they warn you about weak, reused or breached passwords already in your vault.

The simplest way to choose is to start with the three types, because most of the decision follows from which type fits your life. Built-in managers come with your phone, browser or operating system: Apple Passwords on iPhone, iPad and Mac, Google Password Manager in Chrome and on Android, and Microsoft's tools in Edge and Windows. They cost nothing extra, they are already on your devices, and they work well if you stay inside one ecosystem.

Standalone managers are separate apps, such as Bitwarden, 1Password and Proton Pass, that work across all your devices and browsers. They are the right choice if you mix platforms, for example an iPhone with a Windows laptop, or if you want features the built-in tools lack, such as sharing logins with family, storing passkeys across ecosystems, or generating email aliases that hide your real address from websites. Most offer a genuinely useful free plan, with paid plans typically costing a few dollars a month; always check the official pricing page, because plans and prices change.

Local-file managers, such as the free and open-source KeePassXC, store your vault as a file you control, with no company holding anything at all. That is the maximum-privacy option, and it is popular with technical users, but you take on the jobs the company would otherwise do: syncing the file between devices yourself, usually through a cloud folder, and backing it up yourself. If that sounds like a chore you will not do, it is the wrong choice, however good its privacy story is. The best password manager, as every honest guide repeats, is the one you will actually use for every account.

First, end-to-end encryption. The vault should be encrypted on your device with a key derived from your master password, and the company should state clearly that it cannot read your passwords. Vague claims about "military-grade encryption" without that statement are a warning sign, not a reassurance.

Second, independent security audits. Look for published audit reports from outside security firms, and for how the company responded to anything those audits found. A manager that has never been audited is asking you to take its security on trust, which is the wrong direction for a security product.

Third, protection for the vault itself. You should be able to lock your manager behind a second factor: an authenticator app, a hardware security key, or a passkey. A vault protected only by a password, with no second factor available, is weaker than it needs to be.

Fourth, every device you actually use. Check that the manager has an app for your phone, an extension for each browser you use, and autofill that behaves properly on all of them. A manager that works beautifully on your computer and awkwardly on your phone will quietly push you back to reusing passwords on the phone, which is where you log in most.

Fifth, passkey support. Passkeys are the newer, phishing-resistant replacement for passwords, and all serious managers now support storing them. You do not need to understand passkeys fully to choose a manager, but you should not buy into one that cannot store them, because you will want them within the next year or two.

Sixth, a way out. You should be able to export your data in a standard format such as CSV, and import it into another manager. Never trust a manager you cannot leave; export is your insurance against a company changing its prices, its policies, or its fortunes.

Seventh, recovery. Read the recovery page before you commit, not after you forget something. Find out what happens if you forget the master password, whether there is an emergency contact or family recovery option, and what you need to print or save today to make recovery possible. The answer shapes the setup steps in section 6.

Bitwarden is the best free starting point for most people. Its free plan covers unlimited passwords on unlimited devices, with passkey support and sharing with one other person, and it is open source, so outside experts can inspect its code. Its paid plan adds features such as a built-in authenticator and emergency access for a small annual fee. Its apps are functional rather than beautiful, which is a fair trade for the price.

Proton Pass comes from the Swiss company behind Proton Mail and Proton VPN, and it suits people who care about privacy and want email aliases built in. Its free plan includes unlimited logins and devices, passkeys, and alerts for weak and reused passwords, plus a small number of hide-my-email aliases: disposable addresses you can give to websites instead of your real one. Its paid plan adds unlimited aliases and a built-in two-factor code generator.

1Password is the polished paid option, with no free plan but a free trial. Its autofill and organisation are consistently smooth across iPhone, Mac, Windows and Android, and its family sharing, with account recovery for family members, is the most mature of the three. If you will pay for the smoothest experience and you share logins with family, it is the easiest recommendation to make. If you will not pay, Bitwarden or Proton Pass will serve you better than a trial you let lapse.

Apple Passwords is the right choice if you live entirely inside Apple's world. Since iOS 18 and macOS Sequoia it is a full app, not just a settings screen, storing passwords, passkeys and verification codes, syncing through iCloud Keychain, and warning you about compromised passwords. Its weakness is the same as its strength: moving to Windows or Android later means exporting and starting over. Google Password Manager is the equivalent for Chrome and Android users, and it is perfectly adequate as a first step, but it is harder to leave, and it lacks the sharing and alias features of the standalone managers. KeePassXC remains the choice for people who want no company involved at all, provided they accept the syncing and backup work described above.

One name deserves a caution, because many older guides still recommend it. LastPass suffered a 2022 incident in which attackers stole encrypted customer vaults, and the vaults protected by short or common master passwords were the ones at real risk. That incident is also the clearest possible lesson for this whole guide: the encryption only holds as long as the master password resists guessing. Whatever manager you choose, the master passphrase matters more than the brand.

Step one, create the master passphrase, and make it a passphrase, not a password. Four to six random, unrelated words, such as a sequence you generate with dice or your manager's own generator, are both stronger and easier to remember than a short string of symbols. Use words you have never used anywhere else, and write the passphrase on paper, kept somewhere safe at home, until you have memorised it. Do not store it in an email, a chat message, or a phone note.

Step two, turn on two-factor protection for the manager account itself, and save its recovery codes somewhere safe, on paper or in a second location, not inside the vault you are protecting. If your manager offers emergency access or a trusted family contact, set that up now, while everything works, rather than later when you need it.

Step three, install the manager everywhere: the app on your phone, the app or extension on your computer, and the extension in every browser you use. Log in on each device and confirm that a test login syncs between them before you go further. A manager installed on only one device is a manager you will abandon on the others.

Step four, import your existing saved passwords. Most managers import directly from Chrome, Safari, Apple Passwords or another manager. If you have to export a file to do this, treat that file like a live grenade: it contains your passwords unencrypted. Import it, confirm the entries arrived, and then delete the file immediately, and empty the trash. Never leave an exported password file sitting in your downloads folder.

Step five, turn off your browser's own password saving, so you do not end up with two competing sets of passwords and autofill prompts fighting each other. In Chrome this sits under Settings, then Autofill and passwords; in Safari under Settings, then Passwords. Keep one manager, and let it be the only one filling forms.

Step six, run the manager's security check, which flags weak, reused and breached passwords, and start replacing them in the priority order of the next section. You do not have to fix all hundred accounts in one night. Fix the important ones tonight, and a handful more each week, and the vault will quietly become your strongest defence within a month.

Start with your email account, because email is the master key to everything else. Almost every "forgot password" flow sends its reset link to your email, so whoever controls your email can reset your bank, your shopping and your social accounts one by one. Give your email a unique generated password, protect it with two-factor authentication, and save its recovery codes outside the vault as well as inside it.

Next, anything connected to money: banks, payment apps, investment accounts, and any shopping site with a saved card. Then your main social and messaging accounts, because those are used to impersonate you and to scam your contacts. Then work accounts, cloud storage, and anything holding your photos, documents or identity documents. Only after those come the long tail: forums, news sites, loyalty schemes and the accounts you barely remember, which matter less individually but still deserve unique passwords once the important ones are done.

For each account, use the manager's generator, accept a long random password, and let the manager save it before you click confirm. The classic beginner mistake is generating a new password, changing it on the website, and then closing the tab before the manager saved it. If the manager asks whether to save or update the login, always say yes, and verify the entry is in the vault before moving on. If a website limits password length or bans symbols, that is a sign of a weak site, not a reason to reuse a password: use the longest password it allows, unique to that site.

Passkeys are worth a short explanation, because your manager will start offering them and the prompts can be confusing. A passkey replaces a password with a pair of cryptographic keys: the website keeps a public key that is useless on its own, and your device or manager keeps a private key that never leaves it. When you log in, your device proves it holds the private key, usually with your fingerprint, face or PIN, and nothing secret travels across the internet for an attacker to steal or phish.

In practice, when a site such as Google, Apple or your bank offers to create a passkey, accept it and let your password manager store it, so the passkey syncs across your devices just like a password does. Keep the old password in the vault as a fallback for now, because not every device or browser handles passkeys identically yet. Passkeys will not replace every password this year, but every passkey you store is one account that can no longer be phished or credential-stuffed, and that is a genuine improvement, not marketing.

Never text or email a password to someone, even family. A message that sits in a chat history or an inbox is a password stored in the least secure place you own. Standalone managers solve this properly: create a shared folder or collection for the logins a household genuinely shares, such as streaming services or the home Wi-Fi, and share that collection through the manager, so the other person can use the login without ever seeing the password text, and you can revoke access in one click if circumstances change.

The same thinking applies to emergencies. Ask yourself what happens if you are ill, travelling without your phone, or simply locked out. A manager with emergency access lets a trusted person request access to your vault, with a waiting period during which you can refuse. If your manager lacks that feature, the paper copy of your master passphrase, kept somewhere a trusted person can find it in a genuine emergency, is the low-tech equivalent. Either way, decide the arrangement deliberately, before it is needed, and tell the trusted person that it exists.

For families, a family plan is usually better value and safer than sharing one account between several people. Shared accounts blur whose logins are whose, make it impossible to revoke one person's access without changing everything, and leave no record of who changed what. A family plan gives each person their own vault, plus shared collections for the household, which is the structure that survives arguments, breakups and teenagers growing up.

The first mistake is choosing a weak master password and protecting a hundred strong passwords with one guessable phrase. If your master passphrase is a single word, a pet's name, or a password you have used elsewhere, the vault is only as strong as that choice. Four or more random words, unique to the manager, is the minimum worth doing.

The second mistake is leaving the exported password file behind after importing, as described in section 6. That file undoes the encryption entirely, and it is found by attackers and by anyone with access to your computer alike. Delete it, empty the trash, and check your downloads folder a week later to be sure it is gone.

The third mistake is turning on autofill everywhere without checking what is being filled. Only let the manager fill on websites you trust and recognise, and never approve a fill on a page you arrived at from an unexpected link. A manager that refuses to fill is telling you something: the domain does not match the saved login, and that mismatch is worth a second look before you type anything by hand.

The fourth mistake is assuming the job is finished once the manager is installed. Passwords leak in new breaches every month, and a manager's security dashboard will flag new problems over time. Check it once a month, change any newly breached password the week it appears, and update the handful of accounts you added since your last check. Ten minutes a month keeps a one-evening setup working for years.

If you do this tonight, do it in this order and stop wherever you run out of time. First, pick your manager using the seven checks, and create a master passphrase of four or more random words, written on paper until memorised. Second, turn on two-factor protection for the manager and save its recovery codes outside the vault. Third, install the app and extension everywhere and confirm sync works. Fourth, import your saved passwords and delete the export file immediately. Fifth, turn off your browser's own password saving. Sixth, change your email password first, then your money accounts, then your main social accounts, using generated passwords saved by the manager each time. Seventh, accept passkeys where your important sites offer them, and store them in the manager.

That is the whole setup, and it is the difference between hoping your passwords hold and knowing they do. A password manager does not make you invulnerable, and no honest guide should claim otherwise. What it does is remove the single weakest link in most people's online security, the reused password, and replace it with a system that gets stronger every time you use it, because every new account gets its own random password by default. Start with the manager, start with your email, and let the rest follow one account at a time.