Accounts and passwords
What is a password manager, and is it safe to use one?
By Brennan Decker. Published . Last reviewed . Every fact links to its source.
The short answer
A password manager is an app that creates, stores, and fills in your passwords for you. You remember one strong password to open it, and it remembers the rest (CISA).
That makes it easy to use a different password on every account, which is the whole point. If one company leaks your password, the thief can’t reuse it to get into your other accounts (NCSC).
What a password manager does
- Makes strong passwords for you when you create a new account (CISA, NCSC).
- Saves them so you don’t have to remember them or write them on sticky notes (CISA).
- Fills them in on sites and apps as you go (CISA).
- Warns you about weak or reused passwords, and many also tell you if a password showed up in a data breach (CISA, NCSC).
- Syncs across your devices, so the same passwords work on your phone and computer (NCSC).
Why it beats reusing one password
Reusing a password is the risky habit. If one site leaks it, criminals can try the same password on your email, bank, and shopping accounts (NCSC). CISA tells the story of a woman whose bank and email were both taken over because they shared a password that had leaked in a company breach (CISA).
Nobody can remember dozens of long, random passwords. CISA says that for most people it isn’t possible, and suggests a password manager instead of writing them down (CISA). The U.S. government’s own password standard notes that password managers make people more likely to choose stronger passwords (NIST).
Is it safe to keep everything in one place?
It’s a fair worry. Here’s how official guidance sees it:
- Both CISA and the UK’s NCSC recommend using one (CISA, NCSC). NCSC says a password manager stores passwords safely for you (NCSC).
- Your one password has to be good. Make it a long passphrase, and don’t use it anywhere else (CISA).
- Turn on two-step login for the password manager itself. NCSC says that way, even someone who learns your main password still can’t get in (NCSC). Here’s how to turn on two-factor authentication.
- Keep your phone and computer updated. Saved passwords are only as secure as the devices and accounts they live on (NCSC).
No tool is perfect. NIST lists a flaw in a poorly made password manager as one possible risk (NIST), which is why it’s worth picking a well-known one and keeping it updated.
Which kinds are there?
- Built into your phone or browser, like Apple Passwords or Google Password Manager in Chrome and Android. These are free (CISA, Apple, Google).
- Standalone apps, like 1Password or Bitwarden. NCSC says their main advantage is syncing across a mix of browsers and devices (NCSC).
NCSC’s advice on picking one: the best password manager is the one that fits your needs and that you find easiest to use (NCSC). Comparing them? See are browser password managers safe?
One rule a password manager can’t break for you
Never read a login code or your main password to someone who contacts you. Scammers ask for these to get into your accounts (FTC). More on verification code scams.
Common questions
What if the password manager gets hacked?
Use a strong main password you don’t use anywhere else, and turn on two-step login for the password manager. NCSC says that keeps someone out even if they learn your main password (NCSC).
What if I forget my main password?
NCSC says many password managers offer recovery options, like hints or emergency access through someone you trust (NCSC). Some can’t reset it at all; Bitwarden, for example, says it has no way to recover a forgotten master password (Bitwarden).
Are free password managers OK?
Yes. CISA notes some are free, like the ones built into web browsers (CISA).
Is writing passwords in a notebook OK?
NCSC says it can be done safely at home in some cases, but anyone with access to the book can copy them, and you’ll need to check each website yourself before typing (NCSC).
This page is general information, not legal or financial advice. If money already left your account, call your bank or card company first.