Account security
Should I Use a Password Manager?
A password manager creates and stores unique passwords so one leak does not open every account. This guide covers the benefits, the limits, and a safe setup.
What a password manager actually does
A reputable manager:
CISA’s household essentials include long, unique passwords and a manager so you do not memorize the random strings. That pairing is the whole product: uniqueness plus memory. A notebook in a drawer is a manager of sorts. It cannot warn you about reuse, and it cannot stop you from typing the same pet’s name on a new site. Digital managers exist because the number of accounts is no longer human-scale.
- Generates long random passwords
- Stores them in a vault protected by a master password or a passkey
- Fills the correct secret on the real site
- Warns you when you are about to reuse something old
- Can store extra notes, backup codes, and passkeys on some products
Why leaks make reuse so expensive
Attackers know that an old shopping password is often the current email password. The FTC has warned that a reused secret can turn a breach at one company into trouble at another. If you are asking should I use a password manager after an email check comes back with a match, the honest answer is: only if you will let it issue new unique passwords. Saving Summer2024! in a vault changes nothing. Replace in this order:
Leave dead accounts closed, not “saved for later” with the old reused string.
- Banks and tax logins
- Apple, Google, or Microsoft accounts
- Shopping sites that store cards
- Everything else you still use
What a manager cannot do
Protect the vault the way you protect email: a long unique master password or a passkey, MFA if the manager offers it, and a screen lock on the device. The FTC says that if you use a manager, the password that opens the manager must itself be strong.
- It cannot guarantee the vendor will never have an incident of its own.
- It cannot freeze your credit.
- It cannot tell a fake support agent from a real one if you paste the master password into chat.
- It cannot save you if the phone is unlocked and someone opens the vault.
- It cannot replace multifactor authentication.
How to choose and set one up
You have three honest options:
There is no single official brand to name here, and this site will not rank vendors. Look for a product that encrypts the vault, supports MFA or a passkey, and does not ask you to email your secrets to “customer success.” Setup that stays safe:
Never type the master password into a page that opened from an unexpected “vault locked” email.
- The password tool already built into the browser or phone
- A standalone manager you pick after reading independent reviews, as the FTC suggests
- A mix: browser for low-stakes sites, a dedicated vault for email and money
- Install from the official store or the vendor’s typed website.
- Create a long master password you do not use anywhere else, or a passkey.
- Turn on the manager’s own MFA.
- Save a printed or offline emergency kit in a place only you reach.
- Let it generate new passwords as you visit important sites. Do not import a spreadsheet of old reused ones and call the job done.
- Autofill only after you confirm the domain in the address bar.
Browser lists versus a dedicated vault
Built-in browser saving is better than reuse. It is weaker if you sync that browser to a cloud account with a soft password and no MFA. A dedicated manager is useful if you switch browsers, share a household vault with care, or want one place for backup codes. Sharing should be limited. A partner may need the streaming login. They do not need the bank. If you already use passkeys, the manager can sit beside them: passkeys for sites that support them, generated passwords for the rest.
After the vault is working
Keep reviewing login activity on official account pages. A manager reduces reuse. It does not sign out a session that is already open. Update the manager and the phone. If you stop using a product, export only through its official export tool and move the secrets, then delete the old copy you no longer control. Should I use a password manager is really two questions. Can you remember 80 unique passwords? Almost nobody can. Will you protect the one vault that holds them? That part is on you.
Practical checklist
- Use a manager or a built-in generator instead of reused phrases.
- Give the vault a unique master password or passkey plus MFA.
- Replace email and banking passwords first.
- Autofill only on domains you recognize.
- Store backup codes in the vault, not in a camera roll.
- Screen lock on every device that can open the vault.
- Do not send the master password to anyone who emails you.
- Still enable MFA or passkeys on important accounts.
Frequently asked questions
Is a password manager safer than my memory?
For unique random passwords, yes. Human memory pushes people back toward reuse. Reuse is the failure mode that follows leaks.
What if the manager company is breached?
That risk exists. It is why the vault should be encrypted, why the master secret must be unique, and why MFA on the manager matters. It is still a better design than one password on twenty sites.
Can I share a vault with family?
Only for accounts you intend to share, and only through the product’s official sharing tools. Do not text screenshots of passwords.
Sources
This guide is reviewed against official guidance. External pages may be updated by their respective owners.