Password managers, explained without the jargon

The real danger is not that your password is too short. It is that the same password opens your email, your Amazon account, the pharmacy site and a gardening forum you joined in 2014.

The day one of those sites gets breached, and some site gets breached every week, thieves end up with a list of email addresses and the passwords that go with them. They then feed that list automatically into hundreds of other services. Your gardening forum password has just opened your inbox. That is how most accounts are actually stolen, not by someone sitting there guessing “Fido2019”.

A password manager solves that problem completely, and asks one thing in return: remember a single password, once.

What it is, in one sentence

It is an encrypted vault that holds all your logins and fills them in for you when you land on a site.

You open the vault with a master password. From there the app knows every account you have and types the right password into the right site, without you remembering any of it. The passwords it stores stop looking like words: they become strings like x7Kq!m2Pv8dLnA that nobody, you included, could ever recall. That is exactly the point.

Why the problem is not the one people think

For twenty years we have been told to use “complicated” passwords, with a capital letter, a digit and a special character. The result is that everyone invented a small personal recipe, something like Montreal2024!, and used it everywhere with minor variations.

Password-cracking tools know those recipes very well. Swapping an a for an @ slows nobody down.

More to the point, length and complexity protect you from nothing when the site itself loses its database. In that case your password leaves with everyone else’s, however clever it was. The only real protection is that it works nowhere else. And to have a different password on every site, you have to give up remembering them.

How it works, in plain terms

The vault is an encrypted file. Without the master password its contents are unreadable, including to the company selling the software: the decryption key is built on your own device, from your master password, and never leaves it.

That design is usually called “zero knowledge”. In practice it means that if the company is breached, the attackers walk away with blocks of scrambled data rather than your accounts.

The vault then syncs between your devices: computer, phone, tablet. Save a new password on the computer and it is on the phone a minute later.

Browser built-in, or a dedicated app?

Chrome, Safari, Firefox and Edge all offer to save passwords. Apple has its Passwords app, Google has its own. These are free, already installed, and considerably better than they were a few years ago.

The browser’s manager is a fine choice if you live in one ecosystem, all Apple or all Chrome, and you want something that works without installing anything. It is enormously better than a notebook full of reused passwords.

A dedicated app earns its place if you mix platforms (an iPhone and a Windows PC, say), if you want to share some logins with a spouse, or if you need to store things that are not websites: a social insurance number, the safe combination, the answers to those security questions.

There is no wrong answer here. The worst choice is using neither. If you are undecided, start with the browser’s: every serious manager can import from it later.

One caution about the browser route. Passwords saved in a browser are unlocked whenever your computer session is unlocked, so anyone who sits down at an unattended machine can read them in a settings page. That is acceptable at home alone and much less so on a laptop that travels. A dedicated app locks itself again after a few minutes of inactivity.

The master password: the only one you have to remember

This is the keystone, so it deserves two minutes of thought.

A good master password is long before it is complicated. A phrase of four or five unrelated words, like spoon-tractor-fog-forty, is both stronger and far easier to remember than Xk9$2q. Length is what does the work.

Three rules:

1. It must be used for nothing else. Ever.
2. It must not contain your birthday, a child’s name, or the dog’s.
3. You must be able to type it from memory, daily, without hesitating.

Write it on paper for the first few weeks while your fingers learn it, and keep that paper somewhere other than beside the computer. A master password in a bedroom drawer is a far smaller risk than the same password reused on forty websites.

What if I forget the master password?

This is the question everyone asks, and it deserves a straight answer: in most cases, the vault is gone.

That is not a flaw, it is the direct consequence of the encryption. If the company could let you back in, it could let someone else in too. There is no “forgot password” link the way there is on an ordinary site.

What exists to soften the blow:

• A recovery key or code, generated when you sign up, meant to be printed and filed with your important papers. Most dedicated managers provide one. Do it the same day, not “later”.
• An emergency contact, on some services: a trusted person who can request access after a waiting period.
• Biometrics, fingerprint or face, which spare you from typing the master password twenty times a day. Be careful here: it does not replace it. After a restart or a new device, the real password is asked for again.

For the managers built into Apple and Google, recovery runs through your Apple or Google account, which moves the question rather than removing it: that account’s password quietly becomes the real master password.

Getting started without losing an evening

Nobody should migrate two hundred accounts in one sitting. That is the surest way to abandon the job half done.

The approach that works:

1. Install the manager and create the master password. Thirty minutes, once.
2. Let it import whatever your browser has already saved. That is often fifty or a hundred accounts recovered for free. Those are still the old passwords, and that is fine for now.
3. Change five passwords this week: your main email first, then banking, then the two or three sites holding your credit card. Those are the ones that matter.
4. Let the rest happen on its own. Every time you sign in somewhere over the following months, the manager offers to replace the old password with a generated one. Say yes. Within six months the cleanup is done without a single dedicated evening.

Email first, always. It is the account through which every other password gets reset, so it is the one whose fall takes the others with it.

What changes day to day

Most people expect one more chore. It is the opposite: after two weeks, signing in is faster than it was before, because the hesitation and the “forgot password” detours are gone.

The other change is that you stop knowing your own passwords, and that feels wrong for about a month. It is worth sitting with. Not knowing them is precisely what makes them safe, because a password you can recite is a password short enough to be guessed, and one you would probably reuse.

There is also a benefit nobody anticipates. A manager only fills a password on the exact address it is tied to. On a fake page imitating your bank, it offers nothing at all. That silence is a very reliable alarm, and it is real protection against phishing, a close cousin of the tech-support scams doing the rounds.

Passkeys, the logical next step

You will increasingly see sites offer a “passkey” instead of a password. The idea: your device proves who you are with your fingerprint or face, and there is no password left to steal or phish.

Modern managers store passkeys right alongside ordinary passwords. There is nothing to decide today. The day a site offers you one, say yes, and let the manager handle the rest.

The mistakes to avoid, and where to start

The manager installed, the old passwords never changed. The tool is in place and every reused password is still in service. They have to be replaced, at least on the accounts that matter.

A master password that is also used elsewhere. That cancels most of the exercise.

The recovery code never printed. It exists, it is sitting in the settings, and it has never touched paper.

Two-factor authentication skipped. A manager protects your passwords. It does not replace the second factor on sensitive accounts, which is a separate and complementary layer.

And to begin: pick a manager, create a long master password, import what already exists, print the recovery code, and change the five passwords that count. The rest can wait months without consequence.

If you would rather have someone set it up with you and confirm the vault really syncs to your phone before they leave, that is what our security and privacy service covers. Sorting out email and online accounts usually goes with it, and all of it works well remotely.