What Is a Password Manager? How It Works and the Catch

Count your accounts. Email, banking, a phone carrier, an electricity provider, three streaming services, a pharmacy, an airline, a dozen shops that made you register to buy one thing. The list runs longer than anyone expects. Nobody memorizes a different sixteen-character string for every entry on it, which means everyone is doing one of two things: reusing a handful of passwords across everything, or writing them somewhere. A password manager is the tool that makes the third option possible, and the interesting part of the question is not whether it works but what it costs you when it goes wrong.

What Is a Password Manager?

A password manager is a program that holds your login credentials in an encrypted file, called a vault, and hands them back to you when a site asks. CISA describes it in one line as an easy-to-use program that generates, stores and even fills in all your passwords, which is the whole product in thirteen words.

The vault holds more than passwords. Usernames, payment card numbers, addresses, software license keys, passport numbers, the answers to security questions, and free-form secure notes all live in the same encrypted file. The security answers matter more than people expect: your mother's maiden name and the street you grew up on are public records, and treating those fields as extra passwords with random values is one of the quiet upgrades a manager makes possible.

What separates a manager from a list is that it does three jobs at once, and the third is the one people underrate.

• It invents the password, so the password is random rather than a variation on something you already use.
• It remembers the password, so length costs you nothing. A forty-character password is exactly as convenient as a six-character one.
• It decides whether to offer the password, by checking the domain of the page in front of it. A list does not do this, and it is the difference between a filing cabinet and a defense.

That third job is what makes a manager useful against credential stuffing, where attackers take the username and password pairs from one breached site and replay them at scale against every other site. The attack only works on people who reused the password. A manager makes reuse impossible by making it unnecessary.

How Does a Password Manager Work?

The mechanism is simpler than the marketing suggests, and understanding it tells you exactly what a company running a password manager can and cannot see.

Your master password never leaves your device. Instead, the software runs it through a key derivation function, a deliberately slow calculation that turns a typed phrase into an encryption key and takes long enough that guessing millions of candidates becomes expensive. That key encrypts the vault, using AES-256 encryption in every mainstream product. Only the encrypted result is uploaded. This is what the industry calls zero knowledge, and it is a statement about architecture rather than a promise about staff behavior: the company cannot read your vault because it never receives the key, not because it has agreed not to look.

The part you actually feel is autofill. When you land on a login page, the extension compares the page's domain against the domain recorded with each entry. A match means it offers to fill. No match means it stays quiet, and that silence is a security feature rather than a bug.

Read those last two rows twice. A person can be fooled by a login page that copies a bank's design pixel for pixel; a domain comparison cannot. When the manager will not fill on a page you expected it to fill, treat that as an alarm rather than a glitch, because a phishing page is the most common reason for it.

Syncing works the same way. The encrypted blob moves between your phone, laptop and tablet through the provider's servers, and each device decrypts it locally with the key derived from the master password you typed there. The provider is a courier carrying a sealed box.

Types of Password Managers

Three categories cover almost everything on the market, and they differ on one axis that matters more than features: where the vault lives and who can lose it.

Browser built-in managers ship with Chrome, Safari, Edge and Firefox, and with the operating system on iPhones and Macs. They are free, already installed, and vastly better than reuse. Their limits are structural rather than a matter of quality: the vault is tied to that browser or that platform, so a person who uses Safari on a phone and Chrome on a work laptop has two half-populated vaults, and the credentials are recoverable through whoever controls the browser account. The FTC treats them as a legitimate option and notes plainly that a web browser, mobile browser, and password manager all can save your passwords.

Standalone cloud managers are the category most people mean by the term. They run as a browser extension plus a mobile and desktop app, cover every browser and every native app, and add the features that turn a vault into hygiene: reuse audits, breach alerts, secure sharing, emergency access for a partner or executor. The trade is that a company you do not control holds the encrypted file, and that company is a target.

Local vaults keep an encrypted file on your own machine and let you decide whether it ever syncs, usually through a service you already pay for. This is the choice for people who would rather manage their own backups than trust anyone's servers, and it is a real choice rather than a fringe one. The cost is that recovery, syncing and family sharing all become your job.

A fourth arrangement is worth naming because it is the same product wearing a suit. A business password manager is a standalone cloud manager with an administrative layer on top: accounts provisioned through the company's identity provider, policy enforced centrally, shared credentials issued to a team rather than a person, and reporting on password health in aggregate. The vault itself works identically, and a properly built one keeps the administrator out of individual vaults.

What Is the Downside of Using a Password Manager?

The honest answer is that there are six, they are real, and none of them is the one people usually raise.

You create a single point of failure. Every account you own now depends on one secret and one piece of software. That concentration is genuine. What makes it acceptable is that the alternative also has a single point of failure, it is just distributed badly: the password you reused is a single point of failure across every site you used it on, with no encryption, no audit and no alert when it leaks.

Losing the master password can be permanent. This is the cost nobody mentions in the sales copy. Zero knowledge architecture means the provider genuinely cannot reset your password, because it never had the key. LastPass states the position bluntly in its own incident disclosure: the master password is never known to LastPass and is not stored or maintained by LastPass. The mitigations are a written recovery kit stored offline and an emergency access contact, and both need setting up on day one rather than the day you need them.

The vault is a target, and vaults have been breached. In 2022 an attacker copied a backup of LastPass customer vault data. The company's own account of what was in it is the useful part: website URLs were stored unencrypted, while usernames, passwords, secure notes and form-filled data remained under 256-bit AES and could only be decrypted with a key derived from each customer's master password. Practically, that meant attackers learned which sites each customer used, and could then run offline guessing attacks against the encrypted portion at their leisure. Customers with short or reused master passwords were exposed. Customers with long random ones were not. The architecture held; the weakest master passwords did not.

Autofill is a surface of its own. Researchers have repeatedly found ways to trick browser extensions into filling credentials into hidden fields, into pages loaded inside a frame, or into a subdomain that the entry's domain rule matched too loosely. Vendors fix these as they surface, and the class of bug has not disappeared. Turning off automatic filling and requiring a click, or a fingerprint, before anything is entered removes most of it at a small cost in convenience.

An unlocked device is an unlocked vault. A manager protects a file at rest. It does nothing about malware that waits until you have typed the master password and then reads the decrypted contents out of memory, and infostealer malware is built to do exactly that. Short auto-lock timers, a patched machine and not installing software from search ads are what cover this, not the vault.

Migration is real work. Moving between managers means exporting a plaintext file, importing it, then making sure the plaintext file is genuinely deleted rather than sitting in a downloads folder. It is a twenty-minute job done carefully and a disaster done casually.

Where Is the Safest Place to Keep Passwords?

In a dedicated encrypted manager, with the master password in your head and a written copy of the master password and recovery codes in a locked drawer at home. That combination covers both failure modes: an attacker who gets the file cannot read it, and a person who forgets the phrase is not locked out forever.

Ranked, from best to worst:

Two clarifications, because the popular advice on both is dated.

Paper is not a joke. Written credentials cannot be read by malware or by anyone who is not standing in your house, which makes a locked drawer the correct storage for the two secrets that must never be lost and are never typed by an attacker's script. It is a bad system for two hundred logins and an excellent one for two.

And no site should be blocking you from using a manager. Federal guidance now says so explicitly: NIST SP 800-63B requires that verifiers SHALL allow the use of password managers and autofill functionality, and should permit pasting into password fields to make password managers easier to use. The same section sets a fifteen-character minimum for passwords used on their own, bans composition rules about mixtures of character types, and bans forced periodic changes. A site that blocks paste, caps you at twelve characters or demands a reset every ninety days is not following the standard it probably thinks it is following.

Are Password Managers Safe to Use?

Safer than the alternative by a margin that is not close, which is a more useful answer than yes.

Compare the two failure cases honestly. If a well-built manager is breached, attackers get a file encrypted with a key derived from a phrase the company never held, plus whatever metadata that product stored in the clear. They then have to guess each customer's master password offline, one customer at a time, and a long random passphrase makes that uneconomic. If you reuse one password and any site you used it on is breached, attackers get the working password immediately and try it everywhere within hours, at no cost.

The residual risks are worth naming rather than dismissing. A manager does not stop a one-time code being phished from you in real time, it does not clean malware off a machine, and it does nothing about a breach at a company where your password was never the weak point. The 2026 Verizon Data Breach Investigations Report recorded the first year in nineteen where stolen credentials were not the top way into a breach, overtaken by the exploitation of unpatched software at 31 percent of cases. Passwords are one door among several, and a vault only guards that one.

One habit worth adding. Checking whether a password has already appeared in a breach does not require handing it over: Have I Been Pwned's Pwned Passwords service hashes the password on your device and sends only the first five characters of the hash, so the password itself never leaves the machine. Most managers run this check for you against every entry in the vault.

How to Set Up a Password Manager

An evening, once, and then it maintains itself.

Do You Need a Password Manager?

Password Managers for Business

For a company, the reason to buy one is rarely the encryption. It is offboarding.

When someone leaves, a business password manager lets you revoke their access to every shared credential from one console, and see which credentials they had. Without it, the honest position after a departure is that nobody knows which passwords that person memorized, saved in a personal browser profile, or kept in a spreadsheet, and the only safe response is rotating everything by hand. That is the cost the product removes.

The other three jobs it does: it enforces policy without anyone auditing individual behavior, since minimum length and required second factors are set centrally; it gives shared credentials an owner, so the marketing team's social accounts are issued to a group rather than to whoever set them up; and it produces an aggregate view of password health that tells you where the reuse is without exposing anyone's vault.

What it does not do is cover the accounts nobody told you about. Shadow accounts on services bought with a personal card sit outside every console, and the manager only knows what is in it.