Most people are managing passwords one of three ways. They use the same password — or a slight variation of it — across most of their accounts. They save everything in their browser and hope for the best. Or they keep a list somewhere — a notes app, a spreadsheet, a sticky note they've convinced themselves is hidden well enough.
All three approaches share the same weakness: one breach, one compromised account, one person who sees the wrong file, and the damage cascades. The attacker who gets into one account tries the same credentials on your email, your bank, your phone carrier. It works more often than it should.
If you've already read the browser saved passwords article, you know why the browser approach specifically falls short. If you haven't, it's worth a few minutes — it explains what's actually happening when Chrome or Safari offers to save your password, and why it's not the solution it appears to be.
A password manager solves this at the root. Every account gets a unique, strong, randomly generated password. You never see most of them — the manager fills them in. The only password you ever have to remember is one: the master password that unlocks everything else.
A password manager is an encrypted vault. Inside it, every username, password, and account detail you've stored is scrambled using your master password as the key. Without that master password, the vault is unreadable — to attackers, to the company that made the software, to anyone.
When you log into a site, the manager recognizes it, decrypts the right entry using your master password, and fills in your credentials. You don't type the password. You don't see it. It can be 20 completely random characters and it doesn't matter because you're never the one entering it.
The practical result: every account has a different password, every password is strong, and you only have to remember one thing.
The master password is the one thing you cannot lose and cannot forget. Make it a passphrase — random words, not a phrase you'd naturally say. The passphrase generator is the right tool for this.
Not all password managers are built the same way. A few things worth understanding when you're evaluating one:
Open source matters for trust. Open source means the software's code is publicly available for anyone to read and audit. Security researchers can — and do — examine it for vulnerabilities. You don't have to read the code yourself; you benefit from the fact that others can. A password manager that is not open source is asking you to trust it without the ability to verify.
End-to-end encryption is non-negotiable. This means your vault is encrypted on your device before it ever goes anywhere. The company's servers store an encrypted file they cannot read. If their servers are breached, attackers get scrambled data that's useless without your master password. Any password manager worth using works this way.
The free tier should be functional. You shouldn't need to pay before you can decide if it works for you. The right tool will let you use the core features — storing passwords, filling them in, generating new ones — without a subscription.
This is the decision most guides skip, but it's the one that matters most for how you actually live with the tool day to day.
Local only means your vault exists on one device. Nothing goes to any server. It's the most private option — nobody else ever has your data. The tradeoff is that if your device fails and you haven't backed up manually, you lose everything. And getting passwords onto a second device is not automatic.
Cloud sync through the manager's servers is the most common model. Your vault is encrypted on your device, synced to the company's servers, and available on every device you own. Convenient and seamlessly automatic. You're trusting the company's encryption implementation and their ability to keep their servers secure.
Cloud sync through your own storage is a middle path some managers offer — your vault syncs to a cloud service you already use and trust, like your own storage account, rather than the manager company's servers. The manager never touches your data after it leaves your device. You control where it lives.
I use the third model. I have enough devices — phone, tablets, a PC — that local-only doesn't work for how I actually live. But I wanted to choose where my vault is stored rather than hand that decision to the password manager company by default.
I landed on that preference the hard way. A Windows update crashed my PC and the backup snapshot didn't restore cleanly. I lost access to things that were only on that machine. A password manager vault stored only locally would have been one of them. Syncing to storage I controlled — separate from both the password manager and the PC itself — meant the vault survived the crash intact.
There's no perfect choice here. Every model involves trusting something. Local storage trusts your hardware and your backup discipline. Manager-hosted sync trusts the company. Your own cloud storage trusts that service. The question is which tradeoff fits how you work and which one you can actually sustain.
The best password manager is the one you'll actually use. A perfectly architected system you abandon in three weeks is worse than an imperfect one you stick with.
You don't have to migrate every password on day one. That approach leads to abandonment.
Start by installing the manager and creating your vault with a strong master passphrase. Then the next time you log into any account, let the manager save that credential. Over a few weeks of normal use, the important accounts accumulate naturally. When a site tells you there's been a breach, you change that password to a generated one in the manager. The transition happens gradually.
The accounts worth prioritizing first: your primary email, your bank and financial accounts, and wherever you store anything you'd genuinely lose sleep over if someone else accessed it.
Once those are in the manager with unique, generated passwords, you've meaningfully reduced your exposure — even if you have fifty other accounts still on the old system. Some progress is real progress. The rest follows.