Password manager

Overview

A password manager is a tool that encrypts and stores your login information (usernames and passwords) for websites and apps, and fills it in automatically when you log in. Well-known products include 1Password, Bitwarden, Apple's Keychain, and Google Password Manager. By remembering just one master password, you can safely manage passwords for hundreds of services.

Why you need a password manager

It's hard to set a different, complex password for every account and remember them all.

Reusing passwords creates the risk that if a password leaks from one service, other services where you use the same password get broken into one after another. With a password manager, you can generate and store a random, complex password like "Xk9#mP2$vL7@nQ4" for each service, which fundamentally solves the problem of reuse.

How safe password managers are

"Is it really okay to keep all my passwords in one place?" is a natural question. Password managers protect stored data with strong encryption such as AES-256.

Some cloud-based password managers use "zero-knowledge encryption," where even the server can't decrypt your data. With this approach, not even the company running the service can see users' passwords. As long as your master password is strong enough, a password manager is safer than managing each password on your own.

A side benefit against phishing

Password managers have a side benefit as protection against phishing. A password manager fills in saved login information only on the "legitimate domain." Because a phishing site's domain differs from the real one, autofill doesn't work there.

This behavior works as a warning to the user: "This site might not be the real one." If you build the habit of checking the URL carefully whenever your password manager doesn't fill in your details, you can reduce the damage from phishing. When you type passwords in by hand, you don't get this protection.