Password Managers
A password manager is an app that creates, stores and fills in strong, unique passwords for every account. You only remember one strong master password. It’s the easiest way to stop reusing passwords, which is the most common way accounts get taken over.
- Everyone
- Small businesses
How it works
- The manager keeps your passwords in an encrypted vault, unlocked with your master password (and often your fingerprint or face).
- When you sign up for a site, it generates a long random password and saves it.
- When you log in, it fills in the password, but only on the real website, which also helps protect you from fake login pages.
- It syncs across your phone and computer.
Is it safe to put all your passwords in one place?
Reputable managers encrypt your vault so the company itself can’t read your passwords. The risk of a well-protected manager is far lower than the risk of reusing passwords or writing them down. Protect the vault with a strong master password and two-factor authentication.
Choosing one
- From a well-known company with a good security track record
- Works on all your devices and browsers
- Supports two-factor authentication and passkeys
- Has a way to securely share passwords with family or coworkers, if you need it
- Has an emergency access or recovery option you understand
The password managers built into phones and browsers (like those from Apple, Google and Microsoft) are a big improvement over reusing passwords and are a fine place to start.
Your master password
- Make it a long passphrase you’ve never used anywhere else. See Strong Passwords.
- Turn on two-factor authentication for the manager. See Two-Factor Authentication.
- Store recovery codes somewhere safe, such as a printed copy in a locked drawer.
- Never type it into a site you reached from an email or text link.
Getting started
- Install the manager on your phone and computer.
- Start with your most important accounts: email, bank, payroll, phone carrier.
- Change each one to a new random password the manager generates.
- Add other accounts as you log in to them over the next few weeks.
- Use the manager’s security check to find reused and weak passwords.
For small businesses
Business password managers let crews share logins for supplier portals, permits and equipment without texting passwords around, and let you remove access when someone leaves. See Cybersecurity for Small Contractors.
Standards & references
Last updated: