Best Password Manager Tips

What Is a Password Manager?

A password manager is an app that creates, stores and fills in passwords for you. You remember one strong master password; the manager remembers a different random password for every website and app. When you visit a login page, it fills in the right credentials automatically.

Your passwords are stored in an encrypted vault, locked with your master password. Reputable managers use strong encryption and a zero-knowledge design, which means the company itself cannot read your stored passwords. Even if the company’s servers were breached, an attacker would find only encrypted data that is useless without your master password.

Most password managers work across your phone, tablet and computer, syncing the vault between devices. Many also store more than passwords: secure notes, credit card details, addresses, software licences and passkeys. Some include breach monitoring that warns you if one of your accounts appears in a leaked database. For a technical explanation, see the Wikipedia article on password managers.

Why Password Manager Tips Matter

Humans are bad at passwords, and that is not a personal failing — it is arithmetic. A typical person has dozens of accounts: email, banking, shopping, social media, work tools, streaming and more. Remembering a unique, strong password for each one is impossible without help, so people do the natural thing and reuse a few passwords everywhere. That is exactly what attackers count on. When one website leaks its password database, criminals test those same credentials on other services in an attack known as credential stuffing.

A long, clever password used on ten sites is weaker than a plain one used on just one, because it only takes one of those ten sites to leak it. A password manager removes the trade-off entirely: it generates a unique random password for every account and remembers them all, so reuse disappears. It also protects against phishing, because a manager will only fill in credentials when the website address matches the saved one. If a fake lookalike site tries to capture your login, the manager simply will not fill, and that silence is a warning.

The risk of a well-built password manager being breached is far smaller than the risk of password reuse, which is how most account takeovers actually happen. Our guide on how to protect your online privacy explains how a manager fits into your wider security habits.

How to Choose a Password Manager

Start with the security fundamentals. Look for end-to-end encryption, which means the provider cannot read your vault, and a recent independent third-party audit, which means someone has checked the provider’s claims. Open-source managers such as Bitwarden are widely respected because their code can be inspected. Commercial options such as 1Password offer polished interfaces, family plans and travel-friendly features. Both approaches can be excellent.

Check that the manager works on every device you use — Windows, Mac, iPhone, Android and your browser — and that it can import your existing saved passwords easily. A good export option matters too: you should be able to take your data elsewhere at any time. If your workplace provides or approves a particular manager, use that one for work accounts, because it lets the organisation remove access when someone leaves.

Price matters less than most people think. Good free plans cover the basics, and paid plans are typically a few dollars a month. Popular managers with zero-knowledge end-to-end encryption include 1Password, Bitwarden, Dashlane, Enpass, NordPass and Proton Pass. The best password manager is the one you will actually use every day, so pick one whose apps feel comfortable and stick with it.

Set a Strong Master Password

Your master password is the one key to everything, so it deserves more care than any other. Make it a passphrase: four to six unrelated words, at least 15 characters long, that only you would choose — something like “crystal onion clay pretzel”. Random words are easier to remember than a short string of symbols and just as strong, because length is what defeats password-cracking software.

Do not reuse the master passphrase anywhere else, ever. Do not base it on a sentence, your children’s names, your street, your football team or your birth year — those are the first things an attacker guesses, and much of it is public on social media. A capital letter at the start and an exclamation mark at the end are also predictable, because cracking tools try those first.

Memorise the master passphrase rather than writing it down in an obvious place. Type it regularly so it becomes muscle memory, and practise entering it before you depend on the manager for everything. Some people keep a sealed copy in a safe or with a trusted person, which is a reasonable backup if you are worried about forgetting it.

Let the Manager Generate Your Passwords

Once your manager is set up, let it generate every password. Accept the long random strings it suggests — you will never type them, because the manager fills them in for you. Aim for at least 15 characters, and longer where the site allows it, mixing uppercase, lowercase, numbers and symbols.

Work through your accounts in order of importance: email first, then banking, then social media, then shopping. Change each password to a generated one and save it in the vault as you go. It does not need to be done in one sitting; an hour here and there over a week will cover most accounts.

Resist the urge to invent your own “clever” passwords. People are predictable: we reuse patterns, add the current year, and swap letters for lookalike numbers in ways that cracking software anticipates. Random generation removes that weakness entirely. The current guidance from the US National Institute of Standards and Technology (NIST), in its SP 800-63B recommendations, supports this approach: long, unique passwords, changed only when there is a reason. See the Wikipedia article on passwords for background on how password guidance has evolved.

Turn On Two-Factor Authentication

Turn on two-factor authentication (2FA) for the password manager itself before anything else. If someone got into your vault, they would have the keys to your entire digital life, so this layer is non-negotiable. An authenticator app is a good choice; a hardware security key is even stronger.

Then enable two-factor authentication on your important accounts as well, starting with email and banking. Your manager can often store the two-factor codes alongside the password, which is convenient, though some security experts prefer keeping the second factor in a separate authenticator app — that way, one compromised app does not hand over both factors at once. Either setup is far better than none.

Save the backup recovery codes for your manager and your key accounts somewhere offline, such as a printed sheet in a safe. If you lose your phone or your two-factor device, those codes are the way back in. Read more about the technology in the Wikipedia article on two-factor authentication.

Organise Your Vault Properly

A password manager works best when the vault is organised. Group logins into folders or tags — finance, email, shopping, work, social — so you can find things quickly and audit them easily. Use the notes field for useful details: the answers to security questions (generate random answers and store them, since real answers are often public), the date you set the password, or which email address the account uses.

Run your manager’s security check regularly. Most managers will show you weak passwords, reused passwords and accounts that appeared in breaches. Treat that report as a to-do list, and fix the worst items first. Delete accounts you no longer use rather than keeping their logins, and update entries when a site changes its login page or web address.

Use the secure sharing feature for shared accounts, such as a family streaming service, instead of texting the password. Shared logins sent over chat or email live forever in message history and are easy to leak. A manager’s sharing feature keeps the password hidden and lets you revoke access when it is no longer needed.

Plan Your Recovery Before You Need It

The most common password manager disaster is not a hack — it is the owner getting locked out. With a zero-knowledge design, the provider cannot reset your master password for you, because it cannot read your vault. That is the point of the security model, but it means a forgotten master password can mean a lost vault.

Plan for this before it happens. Store an encrypted backup of your vault, keep a paper copy of your recovery codes in a safe place, or designate an emergency contact inside the app if your manager supports one. Some managers offer account recovery through a trusted family member or a printed emergency kit — set it up on the day you install the manager, not the day you need it.

Test your recovery plan once. Log out on one device and sign back in using your master passphrase and second factor, to confirm you know both. A plan you have never tested is a guess, and a guess is not a plan.

Common Password Manager Mistakes to Avoid

The biggest mistake is storing passwords in plain text anywhere else: notes apps, spreadsheets, sticky notes or screenshots. If it is not inside the encrypted vault, it is not protected. Move every password into the manager and delete the old copies.

Another mistake is trusting autofill on unfamiliar sites. Your manager protects you here, but only if you pay attention: if it does not offer to fill in your credentials, stop and look at the web address, because you may be on a fake site. Never override that warning carelessly.

Do not ignore the manager’s updates, and do not leave old devices signed in. Keep the apps updated, because updates patch security gaps that criminals actively use. When you replace a phone or laptop, sign out of the manager on the old device before selling or recycling it. Finally, do not share your master password with anyone, including family members. If someone else needs access, use the manager’s sharing features or an emergency contact instead. For more security habits, browse our Technology category and our technology and software articles.

Frequently Asked Questions About Password Managers

Are password managers safe?

Yes. Reputable password managers use strong encryption and zero-knowledge architecture, which means the provider cannot read your stored passwords. The risk of a well-built manager being breached is much smaller than the risk of reusing passwords across sites, which is how most account takeovers happen.

What happens if the password manager company gets hacked?

Because of zero-knowledge encryption, a breach of the company’s servers should expose only encrypted vault data, which is useless without your master password. That is why your master password must be long, unique and never reused anywhere else.

What if I forget my master password?

With a zero-knowledge design, the provider cannot reset it for you. This is why you should store recovery codes offline and set up an emergency contact or recovery option when you first install the manager. Without a recovery method, a forgotten master password can mean losing access to the vault.

Should I use the password manager built into my browser?

Browser password managers are better than reusing passwords, but they are usually tied to one browser or one brand of device, and they often lack the stronger encryption, auditing and sharing features of a dedicated manager. A dedicated manager such as Bitwarden or 1Password works the same way on every platform and gives you more control.

Is it safe to store my credit card details in a password manager?

Storing card details in an encrypted manager is generally safer than typing them into websites repeatedly or saving them in plain notes. The vault is encrypted, and autofill reduces your exposure to fake checkout pages. Keep two-factor authentication on the manager itself, and monitor your card statements for unusual activity as usual.

Ryan Cole

Ryan Cole writes about technology for Homeyo, from everyday gadgets to the apps and tools changing how we live and work. He has spent years testing consumer tech and explaining it in plain English for non-experts. His guides focus on what a product actually does — and whether it is worth your money.