The problem is reuse, and it is not the one people prepare for
Most advice about passwords is aimed at a threat that barely happens to ordinary people: someone sitting down and guessing yours. What actually happens is bulk. A company gets breached, a file of usernames and passwords ends up circulating, and automated software replays every pair against banks, retailers, mail providers and payment apps. The industry term is credential stuffing. It costs the attacker close to nothing, it needs no knowledge of you at all, and a success rate well under one percent is still profitable at that volume.
Which produces a conclusion that runs against the usual instinct. A long, complicated password used on twelve sites is worth exactly as much as the worst-run of those twelve sites. A shorter, duller password that appears in one place only contains the damage to that place. Uniqueness is the property that matters, and complexity is a distant second.
There is a second reason reuse is worse than it looks. The sites that leak are rarely the ones you would have protected. Nobody carefully secures a hobby forum, a school portal, or a store they ordered from once in 2016. Those are the sites that get breached, and they are the sites people reuse on, because the account felt unimportant. The account was unimportant. The password was not.
Length is where complexity rules went wrong. Requiring an uppercase letter, a digit and a symbol pushed everyone toward the same handful of shapes — a capital at the front, a digit and an exclamation mark at the end — which is precisely what guessing software tries first. Current guidance from standards bodies has moved toward long passphrases and away from mandatory periodic rotation, on the reasoning that forced 90-day changes produce predictable increments rather than better secrets. Four or five unrelated words strung together beats a mangled dictionary word of half the length. Song lyrics, sayings and a team name with a jersey number are long but guessable, which is a different thing from long and random. If you want to see how length and unpredictability actually move the arithmetic, the password strength checker runs entirely in your browser.
What a manager changes
The point of a password manager is not that it makes passwords stronger. It is that it removes the reason you were reusing them, which was that you have somewhere between fifty and three hundred accounts and a human memory.
| How you handle passwords now | What breaks it |
|---|---|
| A few passwords reused across everything | One breach at the weakest site opens the rest. This is the default state for most people and it is the one worth leaving. |
| A base password with the site name bolted on | The pattern is visible from a single leaked example. A human looking at one of your passwords can derive the others in seconds. |
| Written in a notebook by the desk | Better than reuse, honestly. Vulnerable to fire, loss, and anyone in your home or office. No help on a phone away from the desk. |
| Saved in the browser | Genuinely useful and far better than reuse. Tied to that browser and its account, harder to move between ecosystems, and often unlocked whenever the device is unlocked. |
| A dedicated manager | Cross-platform, has its own lock separate from the device, stores more than passwords. Concentrates everything into one vault, which is the trade you are accepting. |
A manager also does something people do not expect it to: it resists phishing. It fills credentials by matching the domain, so on a convincing replica of a login page it simply will not offer to fill anything. That silence is a signal, and it is more reliable than your own reading of the address bar at seven in the morning. Recognizing phishing covers the rest of that ground.
Choosing one, on capability rather than name
Specific products change hands, change terms and change quality, so what follows is a list of things to check rather than a recommendation. Any of these that a candidate cannot do is a reason to look further.
| Ask | Why it matters |
|---|---|
| Is the vault encrypted before it leaves your device? | The vendor should not be able to read your entries even if compelled or breached. Look for wording about zero-knowledge or end-to-end encryption, and for a published description of how it works rather than a marketing adjective. |
| Can you export everything, in a readable format? | This is the exit door. A manager you cannot leave has you where it wants you, and a vendor going out of business is not a hypothetical. |
| Does it run everywhere you actually are? | Phone, laptop, whatever the work machine is. A manager that does not cover one of your devices means you will keep a reused password for that device. |
| Does it support a hardware second factor on the vault itself? | The vault is now the most valuable account you own. It deserves better protection than the rest. |
| Has the vendor published an independent security audit, and did they respond publicly to past incidents? | Incidents happen to everyone. How a vendor described theirs afterward tells you more than the absence of one. |
| Is there a shared vault, if you need one? | Household accounts and utility logins are the ones that otherwise get texted around, which is how they end up in a phone backup somewhere. |
Pricing, free tiers and device limits shift constantly, so compare current terms yourself rather than trusting any figure in an article.
The master password and the recovery kit, which is where this goes wrong
Everything a manager gives you is bought with a concentration of risk. One passphrase now stands in front of every account you have. That is a defensible trade, because the alternative is a reused password standing in front of them anyway, but it needs to be handled with the seriousness it deserves.
Two rules do most of the work. The master passphrase must be long, must be unique, and must never have been used anywhere else — not as an old email password, not as a variation of one. And it must be something you can reproduce cold, because most managers are built so that the vendor cannot reset it for you. That is the security property you were paying for, and it cuts both ways.
Then there is the recovery kit. Most managers issue something at signup — a recovery code, an emergency key, a printed secret — which exists precisely for the day you forget the passphrase or lose every device at once. People click past it. Do not. Write the master passphrase and the recovery material on paper and put the paper somewhere physical and unlikely to burn: a home safe, a locked drawer at a relative's house, a safe deposit box, a sealed envelope with your other documents. Paper does not get breached, does not sync, and does not depend on the thing you are locked out of.
A manager you cannot get into is worse than the problem it solved. Before you migrate your accounts into one, prove you can unlock it on a second device from nothing but what you have written down. That test takes ten minutes and it is the difference between a tool and a trap.
Second factors, ranked plainly
A password is one factor. Adding a second means a stolen password alone is not enough. The options are not equivalent, and the ranking is worth stating flatly.
| Method | Strength | The weakness |
|---|---|---|
| Passkey, or a hardware security key | Strongest | Cryptographically bound to the real site, so it cannot be handed to a lookalike page by mistake. Phishing-resistant in a way nothing else on this list is. Needs a backup key or a second enrolled device, because a lost key with no alternative locks you out. |
| Authenticator app generating a rotating code | Strong | Not bound to the domain, so a convincing fake page can ask you for the code and relay it in real time. Still stops every attack that only has your password. Save the setup codes when you enroll. |
| Code sent by text message | Moderate | Readable from a lock screen, and redirectable by SIM swap, where someone persuades a carrier to move your number onto their device. Also fails when you travel or change numbers. |
| Emailed code or link | Weak to moderate | Only as strong as the mail account, which is the account most likely to be targeted first |
| Nothing | — | Password reuse plus no second factor is the combination behind most everyday account takeovers |
The important qualifier: SMS is far better than nothing. If a service offers only text codes, turn them on. The ranking is for choosing between options that are both available, not an argument for skipping the weaker one.
Where to start, if you are not going to do all of it
Nobody converts three hundred accounts in an evening, and plans that require it get abandoned. Work in order of blast radius — how far a compromise spreads beyond that one account.
First, your primary email, because it resets everything else. Unique passphrase, strongest available second factor, and a check of the account's security settings for forwarding rules and recovery addresses you do not recognize. Second, the phone account with your carrier, since that number guards any SMS codes you still rely on. Third, banking and payment. Fourth, anywhere a card is stored on file. Fifth, everything else, gradually, as the manager prompts you during normal use — that last part matters, because it means the remaining work happens without a project plan.
Two habits finish it. When a manager flags a password as reused or as appearing in a known breach, treat that as a task rather than a badge. And for an old account you do not want any more, deleting it beats changing the password on it — see digital decluttering for how, and what to do after a data breach for the cleanup when a site you used has already leaked.
If you take one thing from this page, take the paper. Set the manager up whenever you like, but write the master passphrase and the recovery kit down first and store them somewhere that survives a house move, because everything else here assumes you can still get in.
Questions people ask
Is putting all my passwords in one place a bad idea?
It concentrates risk, and that is a real trade rather than a marketing objection. What makes it worth taking is the alternative: in practice, people who do not use a manager reuse a handful of passwords across dozens of sites, which means every one of those sites is a single point of failure already. A manager turns many weak points into one strong one. Protect that one properly — a long unique passphrase you have never used elsewhere, the strongest second factor the manager supports, and a recovery kit stored on paper somewhere physical.
Is saving passwords in my browser good enough?
It is a large improvement on reuse, and if the choice is between browser saving and one password everywhere, use the browser. The limits are worth knowing: the vault is generally tied to that browser and its account, so moving between ecosystems is awkward; it often unlocks whenever the device is unlocked, which matters if anyone else uses your computer; and it stores less than a dedicated manager, which will also hold recovery codes, documents and notes. Whichever you choose, the thing that actually protects you is that every site gets a different password.
How long should a password be?
Long enough that length is doing the work rather than symbol substitution. Four or five unrelated words is a practical target and easier to reproduce than a random string of the same length. What matters is that the words are unrelated: a familiar phrase, a lyric, or a team and a jersey number is long and still guessable. Current standards guidance also moved away from forcing changes every 90 days, because scheduled rotation produces predictable increments. Change a password when there is a reason to — a breach notice, a shared device, a suspicion.
Which type of two-factor authentication should I choose?
Where a service offers a passkey or a hardware security key, take it — those are bound to the real domain, so a fake login page cannot collect and reuse them. An authenticator app is the next best, and it defeats anyone who has only your password. Codes by text message are the weakest of the real options, because they can be read off a lock screen and because a SIM swap moves your number to someone else's phone. All that said, SMS is far better than no second factor at all. If it is the only thing offered, turn it on.
What happens if I forget my master password?
With most managers, nothing good, and that is deliberate — the vendor cannot decrypt your vault, which is the property that makes it worth trusting. Recovery depends entirely on material you were given at setup: a recovery code, an emergency kit, or a device that is still unlocked and enrolled. Print or write that material down at signup and store it physically, away from the computer, and tell one other person you trust where it is. Then test it once before you rely on the vault, by unlocking on a second device using only what you wrote down.