How password managers work, whether they are safe, how to choose one, setting it up step by step, passkeys, and how to protect the master password.
The average person has dozens, often hundreds, of online accounts. Remembering a strong, unique password for each is impossible, which is why people reuse passwords, and why one breached site can lead to many hacked accounts. A password manager solves this by remembering passwords for you. The NCSC recommends using one.
How a password manager works?
A password manager stores your passwords in an encrypted "vault". You unlock it with one strong master password (and often your fingerprint or face). It can then:
- generate strong, random passwords for new accounts;
- fill in logins automatically in your browser and apps;
- sync across your devices;
- warn you about weak, reused or breached passwords.
Because it only auto-fills on the genuine site address, it also helps protect you from phishing sites designed to look like the real thing.
Are password managers safe?
No system is perfect, but for most people a reputable password manager is far safer than reusing passwords or writing them in a notes app. Good managers encrypt your vault so the provider can't read it. The main risks are a weak master password, malware on your device, or a provider breach, which is why choosing a reputable provider and protecting your master password matter.
Types of password manager
- Built into your browser or device: such as those in Chrome, Edge, Firefox, Safari or Apple's Passwords app and Google Password Manager. Free and convenient, especially if you use one ecosystem.
- Standalone: dedicated apps that work across browsers and operating systems, often with extra features like secure sharing for families or teams. Many have free and paid tiers.
Choosing one
- Works on all your devices and browsers.
- Supports two-step verification for the account.
- Has a good security track record and is transparent about incidents.
- Offers secure sharing if you need it for family or work.
- Lets you export your data if you switch.
Setting up: step by step
- Choose a strong master password. The NCSC suggests three random words joined together. Make it unique: never use it anywhere else.
- Turn on two-step verification for the password manager account.
- Set up account recovery options, and store any recovery key safely offline.
- Import passwords saved in your browser, then turn off the browser's own saving if you are switching to a standalone manager, to avoid confusion.
- Start with your most important accounts: email first (because it resets other passwords), then banking, shopping and social media. Change each to a new generated password.
- Use the security check to find reused and breached passwords, and fix them over a few weeks.
Passkeys: the next step
Many sites now support passkeys, which let you sign in with your device's fingerprint, face or PIN instead of a password. They are resistant to phishing because there is no password to steal. Most password managers can store and sync passkeys. Use them where offered.
Common questions
What if I forget my master password?
Some managers cannot recover your vault without it, by design. Set up recovery options and consider writing the master password down and keeping it somewhere physically secure at home.
Can I still use two-step verification?
Yes, and you should, especially for email. Some managers can store authentication codes too, though keeping them separate adds protection.
Should I share passwords with family?
Use the manager's sharing feature rather than sending passwords by message.
What happens to my passwords if I die?
Some password managers offer emergency access, letting a trusted person request access to your vault after a waiting period. It is worth setting up, along with a note in your will or estate papers explaining where to find instructions.
Is writing passwords in a notebook acceptable?
For some people, a notebook kept securely at home is better than reusing passwords. A password manager is more convenient and secure across devices, but any system that results in unique passwords is an improvement.
Sources and further reading
Facts checked on 20 October 2026. Spotted an error? Tell us and we will correct it.