Are Password Managers Worth It? How They Work and How to Get Started

The problem it solves

The average person has dozens of accounts: email, banks, stores, social media, rideshare apps, and public services. No one can remember a strong, unique password for every account. So people often reuse the same password everywhere—which is exactly what criminals take advantage of when a website has a data breach.

A password manager is a digital vault: it stores all your passwords in encrypted form, fills them in automatically on websites and apps, and creates strong passwords when you sign up. You only need to remember one password: the one for your vault.

How it works

• Your passwords are encrypted with a key derived from your master password. With reputable password managers, even the service provider can't read what's in your vault.
• Your vault is synced between your phone and computer.
• Autofill only works on the correct website address. This adds protection against fake websites: if your password manager doesn't offer to fill in your password, be cautious.

You may already have one

• Google Password Manager: built into Chrome and Android. Visit passwords.google.com. It can check for compromised, weak, and reused passwords.
• Apple Passwords (iCloud Keychain): built into iPhone, iPad, and Mac. On recent operating system versions, it's available as the Passwords app.
• Microsoft Edge and Firefox also have built-in password managers.

There are also independent password managers, both free and paid, that work across operating systems and browsers. They're useful if, for example, you use an iPhone with a Windows computer. Choose a well-known option with a strong security track record and published audits.

Get started in an afternoon

1. Choose a password manager and create (or review) your master password. Make it long and unique; a passphrase made from five randomly selected words, generated with the Password Generator, is a great option.
2. Turn on two-step verification for your password manager account (or the Google/Apple account that protects it).
3. Start with your most important accounts: your primary email, banks, social media, and other key accounts. Replace each password with a random one generated by your password manager, then save it.
4. Handle the rest as you go: whenever you sign in to a website, choose to save the password. Then replace weak passwords over time.
5. Use your password manager's security checkup to find reused and compromised passwords.

What if you forget your master password?

With end-to-end encrypted password managers, forgetting your master password can mean losing access to your vault, because even the company can't unlock it. That's why you should:

• Set up the recovery options your password manager offers, such as a recovery contact, recovery key, or another trusted device.
• Write your master password on paper and keep it somewhere safe at home until you're sure you have it memorized.
• With Google and Apple, your vault is linked to your account, so make sure that account is well protected.

Risks and precautions

• “Putting all your eggs in one basket” is the most common concern. In practice, a well-protected vault with a strong master password and two-step verification is much safer than reusing passwords across accounts.
• An unlocked phone can provide access to your vault in many cases. Use a strong screen lock and biometrics.
• Shared computers: Don't save passwords in the browser on someone else's computer or a public computer.
• Exports: Exported files containing your passwords aren't encrypted. Delete them after importing your passwords into a new manager.

Frequently asked questions