How password managers work and why they beat reuse
A password manager stores unique passwords in an encrypted vault. Learn how the encryption works, what the master password protects, and how to choose one.
A password manager is a program that generates, stores and fills passwords for you. The point is not convenience alone. It makes unique, long passwords practical, which removes the main reason people reuse the same password everywhere.
The vault
When you add an account, the manager encrypts the entry and stores it in a vault. The vault may live on your device, sync through the vendor's servers or both. Without the key, the stored data should be unreadable.
Most managers derive that key from your master password using a slow key-derivation function such as Argon2, scrypt or PBKDF2. The slow derivation makes guessing expensive. The master password itself should never be stored in plain text.
What the vendor can see
This is the key question when choosing a manager. In a well-designed zero-knowledge system, encryption and decryption happen on your device. The vendor stores ciphertext and cannot read your entries. The trade-off is that if you forget the master password, the vendor usually cannot recover the vault.
Some services offer recovery options that weaken this property, such as a recovery key or emergency access. Understand what you are enabling before you rely on it.
Why unique passwords matter
When a site is breached, attackers reuse the leaked email and password on other sites. If you use the same password everywhere, one breach becomes many. A manager lets every site have a different random password, so a breach stays contained.
Length and randomness matter more than clever substitutions. "P@ssw0rd!" is short and predictable. A generated 16-character password is much harder to guess.
Passkeys are not the same thing
A passkey replaces the password with a cryptographic key pair. The private key stays on your device or in your password manager, and the site stores the public key. Passkeys resist phishing better than passwords because they are bound to the site's origin.
Many managers now store passkeys alongside passwords. The transition will take years, so a manager that handles both is useful.
Choosing and using one
- Pick a reputable manager with independent security audits and a clear encryption model.
- Use a strong, unique master password. A long passphrase is easier to remember and harder to crack.
- Turn on two-factor authentication for the manager account.
- Enable automatic updates so security fixes arrive.
- Store recovery codes offline in a safe place.
- Audit weak and reused passwords with the built-in report.
The limits
A password manager cannot protect a device that is already compromised. Malware that reads your screen or keyboard can capture passwords after decryption. Phishing can still trick you into entering credentials on a fake site, though autofill helps because it will not offer the password on the wrong domain.
A manager is one layer. Keep devices updated, use two-factor authentication and treat unexpected login prompts as a warning. For how data moves across the network, see how the internet works and what end-to-end encryption means.