Most of us have dozens of online accounts, from banking and shopping to streaming and social media. Remembering a strong, different password for each one is close to impossible, which is why so many people reuse the same few. That habit is risky: if one website is hacked, criminals try the stolen login on other services.
A password manager is a tool designed to solve this. It creates and stores strong passwords for you and fills them in when needed. This guide explains how they work, how safe they are, what to look for and how to get started. It is general information, not a recommendation of any single product.
What a password manager does
A password manager is an encrypted vault. You remember one strong main password, often called a master password, and the manager remembers the rest. It can generate long random passwords, store them across your phone and computer, and fill them in automatically on the right websites.
Many also store secure notes, payment cards and the codes you use for extra security. The key idea is that you no longer need to invent or recall individual passwords, so you can make each one unique.
Are password managers safe?
No tool is perfectly safe, and managers have occasionally suffered security incidents. However, the National Cyber Security Centre, the UK government’s cyber agency, has long suggested that using a password manager is generally better than reusing weak passwords or writing them where others can see them. The risk of a reputable manager is usually lower than the risk of reusing logins.
Good managers encrypt your vault so that even the company cannot read it, as long as your master password is strong and kept private. Check the current advice from the NCSC and independent reviews, because products and their security records change.
Built-in options versus separate apps
Browsers, Apple devices and Android phones all include basic password saving. These are convenient and free, and they are much better than reusing a password. Their weakness is that they can be tied to one ecosystem, which is awkward if you use a Windows laptop and an iPhone, for example.
More in Tech
Separate password manager apps usually work across all devices and browsers and offer extra features such as secure sharing with family. Some are free with limits, while others charge a yearly fee. Compare the current plans yourself, because prices vary.
What to look for when choosing
Focus on a few practical points. The service should use strong encryption and support two-factor authentication on your vault. It should work on every device you use, and offer a way to recover access if you forget the master password, though the recovery method matters because it can also be a weakness.
Look for a clear privacy policy, a track record of publishing security audits and an easy export option so you are never trapped. Avoid obscure apps from unknown developers, and install only from official stores or the provider’s official website.
How to set up your manager step by step
Install the app and browser extension, then create a long master password. A phrase of several unrelated words is easier to remember than random symbols and can be very strong. Never reuse it anywhere else, and do not store it in your email.
Next, turn on two-factor authentication for the vault itself. Many managers then offer to import saved passwords from your browser. Do this, then delete the old browser copies so passwords are not stored in two places.
Fix your most important accounts first
You do not need to change everything at once. Start with your main email, because it can be used to reset other accounts, then your banking, shopping and social media. Let the manager generate a new random password for each and save it.
Many managers also flag reused or weak passwords and warn about known data leaks. If you have received a notice that your details were exposed, our guide to what to do after a data breach explains sensible next steps.
Watch out for phishing and fake logins
A manager can help here too, because it will normally fill in a password only on the genuine website address. If it does not offer your login, pause and check the address carefully. That can reveal a fake page. Our guides on phishing emails and scam texts and on spotting fake websites are worth a read.
Never type your master password into a link you received by message. Open the app or the website yourself instead.
Plan for emergencies
Think about what happens if you lose your phone or forget the master password. Keep recovery codes somewhere safe offline, such as in a locked drawer, and consider setting up an emergency contact if your manager offers one. Families sometimes use a shared vault for household accounts such as utilities.
Review your vault every few months, delete accounts you no longer use and update anything flagged as weak. A few minutes now can save a lot of stress later.
The bottom line
A password manager is not magic, but for most people it is a big improvement on memory and sticky notes. Choose a reputable one, protect it with a strong master password and two-factor authentication, and move your key accounts across first. We are not security consultants, so for business or high-risk situations seek professional advice.
