Most people have the same problem: too many accounts, too many passwords, and one brain that cannot remember them all. The usual answer is to reuse a password, or to use small variations of one password everywhere. That is exactly what attackers count on — one leaked password opens dozens of doors.
A password manager solves this by flipping the problem around. Instead of remembering a hundred passwords, you remember one very good one, and the manager remembers the rest. It sounds like putting all your eggs in one basket. The reason security experts recommend it anyway is that the basket is built very differently from an ordinary list of passwords. Here is how it actually works.
The vault: a locked box, not a list
At the centre of every password manager is the vault — an encrypted database that holds your logins. Each entry typically stores a website address, a username, a password, and often notes, payment cards or secure documents as well.
The key point is that the vault is scrambled before it ever leaves your device. When you save a password, your phone or computer encrypts it on the spot, and only the scrambled version is synced to the company's servers or backed up to the cloud. Anyone who breaks into those servers finds ciphertext — unreadable gibberish — not your passwords.
This is why the comparison with a spreadsheet or a notes app matters. A note that says "bank password: rover2024" is readable by anyone who opens the file. A vault entry is not readable at all without the key, even by the company that stores it.
The master password: the one key that matters
That key comes from your master password — the single password (or, on many devices, a device unlock such as a fingerprint) that opens the vault. You type it, and the app runs it through a deliberately slow mathematical process called a key derivation function, with names like PBKDF2 or Argon2.
The slowness is the point. A normal password check is instant; a key derivation function repeats its work hundreds of thousands of times on purpose, so that guessing passwords one by one becomes extremely expensive for an attacker. Bitwarden, for example, documents 600,000 rounds of PBKDF2 by default, with Argon2id as an option.
The derived key then unlocks the vault using AES-256 encryption, the industry-standard cipher used by banks and governments. A 256-bit key has 2 to the power of 256 possible combinations — a number so large that brute-forcing it with today's computers would take billions of years. The strength of the whole system therefore rests on two things: the cipher, which is effectively unbreakable, and your master password, which must be strong enough that guessing it is impractical.
That is why experts suggest a passphrase rather than a password: four or five random words strung together are both easier to remember and far harder to guess than a short password with a few symbols swapped in.
Zero knowledge: why the company cannot read your passwords
Reputable password managers are built on a design called zero-knowledge architecture. It means the provider never receives your master password in its original form and never holds the key that decrypts your vault. Authentication works by proving you know the master password without sending it — the server checks a verification value, not the password itself.
The practical consequence is reassuring: even if the password manager company suffers a data breach, the attackers walk away with encrypted vaults they cannot open, provided your master password is strong. It is also the reason the same design has a sharp edge, covered below.
One honest caveat: "zero knowledge" is sometimes used loosely in marketing. Optional features such as account recovery, business admin recovery, or trusted-device access can change the picture, because they create an additional way back into a vault. They can be reasonable trade-offs, but if you turn one on, you should know you have changed your security model — read what the feature actually does before enabling it.
Autofill: the feature that also fights phishing
The everyday magic is autofill. A browser extension or mobile app spots a login form, checks the website address against your vault, and offers the matching login. You tap once, and a long random password you never memorised is filled in.
Autofill does quiet security work that most people miss. Each saved login is tied to a specific website address, so the manager only offers it where the address matches. A lookalike site — "your-bank-verify.com" instead of your real bank — gets no suggestion at all. That silence is itself a warning sign. Britain's National Cyber Security Centre has noted that password managers are better than humans at spotting fake websites, precisely because they check the address mechanically instead of glancing at a familiar-looking logo.
The protection is not absolute. If you copy a password out of the vault and paste it into a phishing site by hand, the manager cannot stop you. Autofill protects you only when you let it do the filling.
The generator: why every password should be different
A password manager is not just storage — it is also a password generator. When you create a new account, it can invent a long, random password, typically 16 to 20 characters of mixed letters, numbers and symbols, and save it immediately.
This is the habit that actually fixes the reuse problem. If every account has a unique random password, a breach at one website is contained to that website. The attacker cannot take the leaked password and try it on your email, your bank and your social accounts, because it works nowhere else. Most managers also run a password health check that flags reused, weak or breached passwords in your vault, so you can fix the worst ones first.
The one risk: lose the master password, lose the vault
Here is the trade-off, stated plainly. In a true zero-knowledge design, nobody can reset your master password for you — not the company, not support, not anyone. If you forget it and you have set up no recovery method, your vault is unrecoverable. That is not a bug or poor customer service. It is the same property that keeps attackers out, applied to you as well.
So the setup matters as much as the tool. Before you rely on a manager for everything, do three things: choose a strong passphrase you will genuinely remember, turn on two-factor authentication for the manager account itself, and set up a recovery option the manager offers — such as a printed recovery code stored somewhere safe, or a trusted device — while you still have access. Our guides to two-factor authentication, explained and passkeys, explained cover the two features most often paired with a manager.
Password manager vs browser autofill vs reuse
| Approach | What you remember | If one site is breached | Works across devices |
|---|---|---|---|
| Reusing one password | One password | Attacker can try it everywhere | Yes, but dangerously |
| Browser autofill (Chrome, Safari, Edge) | Your device or browser account | Limited damage if passwords differ | Tied to that browser or account |
| Dedicated password manager | One master passphrase | Damage stays at that one site | Yes, across phones, laptops and tablets |
Browser autofill is far better than reuse, and for some people it is enough. A dedicated manager adds cross-platform portability, secure sharing with family or colleagues, secure notes, and breach alerts — at the cost of a subscription or a setup step for some products. Free, reputable options exist too, so cost alone is rarely the deciding factor.
Takeaway checklist
- A password manager stores your logins in an encrypted vault, scrambled on your device before anything syncs.
- Your master password is turned into an encryption key by a deliberately slow process (PBKDF2 or Argon2), then AES-256 encryption locks the vault.
- Zero-knowledge design means the provider cannot read your passwords — and cannot reset your master password either.
- Autofill only offers a login when the website address matches, which quietly blocks many phishing sites.
- Use the generator: a unique random password per account means one breach cannot cascade into all your accounts.
- Set up two-factor authentication and a recovery method before you need them — losing the master password with no recovery means losing the vault.
- Start with your most important accounts: email first, then banking, then everything else.
