The problem a password manager solves
Most people reuse a handful of passwords, because remembering a different strong password for every account is impossible. That is exactly what attackers rely on. When one website is breached, criminals try the leaked email and password on email, banking and social media accounts. This is called credential stuffing, and it is one of the most common ways accounts are taken over.
A password manager fixes this. It creates a long, random, unique password for every account, stores them in an encrypted vault, and fills them in for you. You only need to remember one strong master password, or unlock it with your face or fingerprint.
How it keeps your passwords safe
Reputable password managers use end-to-end encryption. Your vault is encrypted on your own device using a key derived from your master password, before it is synced. The company stores only the scrambled version and cannot read your passwords, so a breach of its servers does not hand attackers your passwords in usable form.
Password managers also protect you from fake websites. A manager fills in a password only on the exact site it was saved for. If it does not offer to fill on a page that looks like your bank, that is a warning sign. See our guide to spotting phishing.
Choosing one
There are two broad options:
Built-in managers, already on your devices:
- Apple Passwords, on iPhone, iPad and Mac, with a Windows option through iCloud
- Google Password Manager, in Chrome and on Android
- Browser managers in Microsoft Edge and Firefox
These are free, simple and good enough for many people, especially if you use one ecosystem.
Standalone managers, such as Bitwarden, 1Password, Proton Pass and Dashlane, are worth considering if you:
- use a mix of devices and browsers, such as an iPhone and a Windows laptop
- want to share passwords securely with family or colleagues
- want extra features like secure notes, file storage or advanced breach alerts
When comparing, look for end-to-end encryption, support for all your devices, two-step verification on the account, independent security audits and passkey support.
How to set one up, step by step
- Choose your manager and install it on your phone and computer, including the browser extension.
- Create a strong master password. Use a passphrase of four or more random words, such as candle-river-orbit-saffron, rather than a short complex password. Never use it anywhere else.
- Turn on two-step verification for the password manager account.
- Save your recovery code or set up account recovery, and keep it somewhere safe offline.
- Import passwords saved in your browser, then delete them from the browser if you are switching to a standalone manager.
- Change your most important passwords first: your main email, your Apple or Google account, banking and payment apps, and social media. Let the manager generate a new, unique password for each.
- Update other accounts as you log in. You do not have to do everything at once. Over a few weeks your vault will cover everything.
Passkeys: the next step
A passkey replaces a password with a cryptographic key stored on your device, unlocked with your fingerprint, face or PIN. Passkeys cannot be phished or reused, and there is nothing to remember. Google, Apple, Microsoft, Amazon, PayPal, WhatsApp and many other services support them.
Where a site offers a passkey, it is usually worth creating one. Your password manager or device will store and sync it.
Two-step verification still matters
Even with strong passwords, turn on two-step verification (2FA) for important accounts. In order of strength:
- Passkeys or a hardware security key, the strongest
- An authenticator app, such as Google Authenticator, Microsoft Authenticator or the one built into your password manager
- SMS codes, better than nothing but vulnerable to SIM-swap attacks
Common mistakes to avoid
- Using a weak or reused master password
- Not setting up recovery, then getting locked out
- Keeping passwords in notes apps, spreadsheets or photos
- Ignoring the manager's warnings about reused or leaked passwords
- Sharing passwords over WhatsApp or email instead of the manager's secure sharing
If you think an account has already been compromised, follow our steps for what to do if your phone is hacked.