A Beginner's Guide to Password Managers

Most of us have dozens of online accounts and a handful of passwords we reuse across them. When one site is breached, attackers try the same email and password everywhere else. A password manager solves this by creating and remembering a unique password for every account.

What a password manager does

It stores your logins in an encrypted vault protected by one strong master password. It can generate long random passwords, fill them in automatically, warn you about weak or reused ones, and often store notes, cards and two-factor codes.

Is it safe to keep everything in one place?

Reputable managers encrypt your vault on your device before it is stored online, so the company cannot read your passwords. No tool is perfect, but a unique password for each account protected by one strong master password is far safer than reuse.

How to choose one

• Clear security design and independent audits.
• Apps for every device you use, plus browser extensions.
• Easy account recovery that does not depend on a single point of failure.
• A fair price. Built-in managers from your phone or browser can be a good start.

Getting started

• Create a long master password, such as four or five random words, and never reuse it.
• Turn on two-factor authentication for the manager itself.
• Import saved passwords from your browser, then delete them there.
• Change the passwords for your email, bank and main accounts first.
• Update the rest gradually, whenever you log in.

Habits that help

Let the manager generate passwords of at least 16 characters. Check its security report every few months. Store recovery codes in a safe place, and keep the app updated.

You do not have to fix everything in one day. Start with your email and money accounts and work outward. Each unique password you add makes you harder to attack.