Password Managers: How They Work, Whether They Are Safe, and How to Choose

A password manager is a program that creates, stores, and fills in passwords, so every account can have a different one without you memorizing anything. The question most people ask before installing one is whether keeping every password in a single place is safe. This guide explains what the vault actually protects, what a breach of the provider would and would not expose, what a password manager cannot do for you, and the features worth comparing before you pick one.

By Prudents·7 min read

September 21, 2026, 7:21 PM·Updated September 24, 2026, 5:21 PM

A worn notebook of crossed-out handwritten lines lying open beside a closed laptop, seen from above

What a password manager actually does

A password manager keeps your passwords in an encrypted file, usually called a vault, that opens with one master password. It also generates long random passwords and types them in for you, which is the part that makes a different password on every site realistic.

Three jobs. It generates a password you would never invent or remember, stores it with the site it belongs to, and fills it in when you return. Most managers also hold notes, recovery codes, and card details, and many now store passkeys.

The filling step carries a quiet defense people rarely notice. A manager matches the saved entry to the web address in front of it, so on a look-alike page at a slightly different address it simply offers nothing. That silence is information.

The federal advice points the same way. CISA’s Secure Our World guidance asks for passwords of at least 16 characters, random, and different on every account, and names a password manager as the practical way to get there. NIST Special Publication 800-63B, Revision 4, published in August 2025, sets a minimum of 15 characters where a password is the only factor, tells the services checking your password not to impose character-mixing rules, and tells them not to force periodic changes unless there is evidence the password was compromised.

Are password managers safe?

For most people the answer is yes, in the sense that decides it: a password manager removes a risk that is running all the time, which is the same password reused across many sites, and replaces it with a risk that is rare and defended. It does not remove risk entirely. A vault is only as strong as the master password and the device it is opened on.

The design worth looking for is one where the vault is encrypted on your own device before anything is uploaded, and the master password itself is never sent to the company. Providers describe this as end-to-end encryption or a zero-knowledge design. Apple documents the same approach for the keychain that syncs its own passwords and passkeys, which it says is end-to-end encrypted with keys Apple does not hold.

So think through what a breach of the provider would actually hand an attacker: not readable passwords, but encrypted vaults plus whatever sat outside the encryption, which can include the list of web addresses each entry belongs to. From there the attack is offline guessing against your master password, with no website to slow it down. That is the whole reason the master password has to be long, and the reason a breach notice is a good moment to change the passwords that matter most.

The comparison that matters

The real question is not whether a vault can ever be attacked. It is what you would be doing instead. Passwords you can remember are passwords you reuse, and one reused password turns a breach at a company you barely remember signing up with into a problem at your bank, your email, and your phone carrier.

A hand feeding torn notebook pages into a desktop paper shredder — Illustrative scene: once the vault holds them, the paper list becomes the weakest copy in the house.

What the vault protects, and what it does not

A password manager protects against weak passwords and reused passwords. It does not protect an account that someone reaches without needing your password at all, and several of the most common attacks work exactly that way.

It does not stop a phishing message that persuades you to read a one-time code out loud or type it into a page you did not open yourself; the FTC’s guidance on phishing covers what those look like. It does not stop malware on a computer where you have already unlocked the vault. It does not reverse a payment you were talked into making. And it does not help if a criminal takes over your phone number and resets accounts through text-message codes, which is what a SIM swap scam is for.

It also leaves open the door most accounts keep open anyway, which is recovery. If your email can reset everything else, your email account is the real master password. That is why the manager is a base layer rather than a finished answer: it pairs with two-factor authentication on the accounts that matter, and increasingly with passkeys, which remove the typed secret from the sign-in entirely.

The three kinds, and who each one suits

Password managers come in three shapes: the one built into your web browser, the one built into your phone or computer’s operating system, and a separate app you install. They differ less in encryption than in reach and portability.

Built into the browser

Free and already there. Fine if you live in one browser and mostly sign in to websites. Weaker at filling passwords inside phone apps, and awkward to move if you change browsers. CISA notes that some managers are free, including the ones built into browsers.

Built into the operating system

Also free, usually better at filling inside apps and storing passkeys. The catch is the brand boundary: a phone on one platform and a laptop on another leaves you copying passwords by hand, which is the habit you installed it to stop.

A separate app

Usually paid, works across platforms, and carries the features households ask for later: shared folders, emergency access, export, and reports on reused passwords. The cost is one more company holding your data.

No ranking here on purpose. A free manager you use beats a paid one you abandoned in week two.

What to compare before you choose

Comparing password managers comes down to about eight questions, and nearly all of them are answered in the provider’s own documentation rather than in its marketing.

Where the encryption happens. Look for a clear statement that the vault is encrypted on your device and the master password is never transmitted. If the provider can show you your passwords, so can anyone who gets in as the provider.
What happens if you forget the master password. Most strong designs cannot reset it. Find out whether there is a recovery kit, a trusted contact, or nothing, and set it up on day one.
Whether you can export. A manager you cannot leave is one you are stuck with after a price change. Check that a full export exists and try it once.
Which devices and browsers it covers. Count every device you sign in from, including a work machine where you cannot install software.
Whether the vault itself takes a second factor. The vault is an account too.
Household and emergency access. Shared entries for a couple, separate vaults for each person, and a documented way in if you cannot use the account.
How the company handles bad news. Published independent security reviews, and the public record of how past incidents were described and how quickly.
What happens when you stop paying. Some plans go read-only, some stop syncing. Know which before the trial ends.

Two features are worth having but should not decide it: a report flagging reused and exposed passwords, and support for storing passkeys.

The master password and what happens if you forget it

The master password is the one you still have to remember, and with most designs the company genuinely cannot reset it for you. That limitation is the same property that keeps them from reading your vault, so it is a feature with a sharp edge.

Build it long rather than clever. A string of four or five unrelated common words is easier to remember and harder to guess than a short word with symbols wedged into it, which is why NIST tells services to stop demanding mixtures of character types and to allow long passphrases instead. CISA’s target of 16 characters or more is a reasonable floor for the one password protecting all the others.

Make a backup that does not live on the device. Most managers generate a recovery kit or emergency code at setup: print it and keep the paper with your other important documents. Whether that is sensible depends on who has access to your home, and for some households it is not; in that case use the provider’s trusted-contact or emergency-access feature instead. Either way, do it before you import anything. A vault with 200 entries and no way back in is a worse afternoon than an empty one.

How to set one up without a bad week

The common failure is not a security failure. It is starting with 200 passwords, changing all of them on a Saturday, and locking yourself out of something you needed on Monday. Use this order and spread it over a few weeks.

Install it on the phone and the computer you use most, and sign in on both before anything else. If it does not work on both, old habits come back.
Set the master password and save the recovery kit offline before importing a single entry.
Turn on a second factor for the manager itself.
Import from the browser, then turn off the browser’s own password saving. Two half-full vaults causes most of the confusion later.
Change the passwords that unlock the others first: main email, phone carrier account, bank, and the manager. Email first, because it is the reset path for everything else.
Turn on two-factor authentication while you are already in each site’s settings.
Work through the reused-password report a few at a time, most sensitive first. Shopping accounts can wait.
Watch what autofill does. When the manager offers nothing on a site where you expected a saved password, check the address in the bar before overriding it by hand.

What a password manager still leaves on your plate

Installing a manager closes the password problem and leaves three others open: the device, the second factor, and the recovery path. All three matter more than any remaining password choice.

Start with the device, because the vault opens there. The FTC’s advice on protecting your phone and the data on it covers what carries most of the weight: a passcode of at least six digits, automatic screen lock, and updates installed promptly. CISA makes the same point about updates, which usually contain fixes for problems already being exploited.

Then the second factor. CISA asks for multifactor authentication on every account that offers it, and its October 2022 fact sheet on implementing phishing-resistant MFA puts it plainly: any form of MFA is better than none, and the phishing-resistant kind is the strongest available.

Finally, the recovery path. Check what each important account uses to let you back in, and whether a criminal holding your phone number could use the same door. If the answer is a text message, that is the weak point, not your password. And one habit outweighs the rest: a verification code is for you to type into a page you opened yourself. No bank or support line has a legitimate reason to ask you to read one back.

Password manager FAQ

Are password managers safe to use?

For most people, yes. A password manager removes the risk of reused passwords, which is constant, in exchange for a rare and heavily defended risk. Look for a provider that encrypts the vault on your device and never receives your master password, and protect the vault with a long master password and a second factor. No design removes risk completely.

What happens if the password manager company is breached?

An attacker would hold encrypted vaults plus whatever the provider stored outside the encryption, such as the web addresses in each entry. Cracking a vault then means guessing the master password offline. A long master password is what makes that impractical, and a breach notice is a good moment to change your most sensitive passwords.

What if I forget my master password?

With most strong designs the company cannot reset it, because it cannot read your vault either. Recovery depends on the kit, emergency code, or trusted contact you set up at the start. Save that before you import your passwords, not after.

Is the password manager built into my browser good enough?

It can be, if you use one browser everywhere and mostly sign in to websites. CISA notes that free options, including browser managers, are legitimate choices. The limits show up when you need passwords inside phone apps, use more than one platform, or want to move your data somewhere else later.

Can a password manager stop phishing?

Partly. It will not offer a saved password on a look-alike address, and that silence is a useful warning. It cannot stop you from being talked into typing a one-time code into a page someone else sent you, which is why the second factor and the habit of never reading a code to anyone matter alongside it.

Do I still need two-factor authentication if I use a password manager?

Yes. They solve different problems. The manager makes each password strong and unique. Two-factor authentication means a stolen password on its own is not enough to get in. CISA recommends turning it on for every account that offers it, starting with email.