What a password manager does and why you might use one

A password manager is software that stores your login credentials — usernames, passwords, and sometimes security questions — in an encrypted vault on your device or in the cloud. When you visit a website you've used before, the manager can fill in your username and password automatically. The main reason people use them is that they can remember dozens or hundreds of different passwords without you having to memorize or write them down.

The second reason is security. A password manager lets you use a unique, random password for every account — something like 7mK$9xQp2nL@4vB — instead of reusing the same password across multiple sites. If one website gets hacked and your password leaks, the attacker can't use that password to break into your email, bank, or social media because each one is different.

You protect all of those stored passwords with a single strong password called your master password. That one password is the only one you need to remember. If you forget it, you typically cannot recover your stored passwords, so this is the password you must not lose.

Key Takeaways

  • A password manager stores your login information in an encrypted vault and fills it in automatically when you visit a website you've used before.
  • You protect all your stored passwords with one master password that only you know — if you forget it, the stored passwords are usually unrecoverable.
  • Common password managers include Bitwarden, 1Password, LastPass, Dashlane, and KeePass, each with different pricing and storage methods.
  • Setting up a password manager takes 15 to 30 minutes and involves creating your master password, installing the software, and letting it capture your existing passwords as you log into sites.
  • Password managers work across devices — phone, tablet, laptop — so you can access your passwords anywhere, though some require a paid subscription for this feature.

Popular password managers and how they differ

Bitwarden is open-source software, meaning its code is public and anyone can inspect it for security flaws. It offers a free version that syncs across all your devices, and a paid tier ($10 per year) that adds advanced features. Bitwarden stores your vault in the cloud.

1Password costs $3.99 per month for an individual account and stores your vault in the cloud. It has a strong reputation for security and includes features like travel mode (which hides sensitive passwords when you cross a border) and watchtower alerts (which notify you if a password has appeared in a known data breach). 1Password does not offer a free version.

LastPass offers a free version that syncs one device type — either your phone or your computer, but not both — and a paid version ($3 per month) that syncs across all devices. LastPass has experienced security incidents in the past, which some users view as a reason to choose a different manager.

Dashlane costs $4.99 per month and includes a VPN service along with password storage. It also offers a free version with limited features. KeePass is free, open-source software that stores your passwords in a file on your computer rather than in the cloud — you control where the file lives and how it's backed up, but you must manually sync it across devices.

The choice between them often comes down to whether you want cloud storage (easier to sync across devices) or local storage (you control the file), whether you're willing to pay, and which features matter to you.

Setting up a password manager: the step-by-step process

Start by choosing a password manager and downloading it from the official website. Visit the company's main website directly rather than searching for a read link — this reduces the risk of downloading a fake version. For Bitwarden, go to bitwarden.com. For 1Password, go to 1password.com. For LastPass, go to lastpass.com.

Once installed, the software will ask you to create a master password. This is the password you will use every time you open the manager. Make it long — at least 12 characters — and use a mix of uppercase letters, lowercase letters, numbers, and symbols. Write it down on paper and store it somewhere safe, like a locked drawer. Do not store it in an email or a text file on your computer.

Next, the manager will offer to scan your browser for saved passwords and import them. Most browsers (Chrome, Firefox, Safari, Edge) store passwords in a way the manager can read. Let it import them — this saves you from typing them in manually. The manager will then ask whether you want to generate a new, random password for each account. You can do this now or later as you log into sites.

Install the browser extension or app on your phone. The extension sits in your browser toolbar and fills in passwords when you visit a website. The phone app works the same way. Both will ask for your master password the first time you open them each day, then stay unlocked for a set period (usually 15 minutes to several hours, depending on your settings).

From this point forward, when you log into a website, the manager will ask if you want to save the password. Click yes. The next time you visit that site, the manager will fill in your username and password automatically — you just press Enter.

What happens when you forget your master password

If you forget your master password, you cannot recover it. The password manager cannot reset it for you because the company does not store a copy of it — that's the security feature that makes the system work. You will lose access to all your stored passwords.

Some managers offer account recovery options if you set them up in advance. 1Password lets you create a recovery code when you first set up your account — a long string of characters you can print and store separately. If you forget your master password, you can use the recovery code to regain access. LastPass offers a similar feature. Bitwarden does not.

Before you finish setting up, check whether your chosen manager offers a recovery code or backup option. If it does, generate one and store it in a safe place — a locked drawer, a safe deposit box, or with a trusted family member. This is your insurance policy if you forget your master password.

Security considerations and common concerns

The most common concern is whether it's safe to store all your passwords in one place. The answer is yes, if you choose a reputable manager and use a strong master password. Password managers encrypt your vault with your master password, which means the company running the service cannot read your passwords even if they wanted to. The encryption happens on your device before the data leaves it.

A second concern is what happens if the password manager company gets hacked. Because your vault is encrypted with your master password, hackers would get an encrypted file they cannot open without knowing your master password. This is why your master password must be strong and unique — something an attacker cannot guess.

A third concern is browser extensions. The extension sits between you and the website, so in theory a malicious extension could intercept your passwords. This is why you should only install the official extension from the official app store (Chrome Web Store, Firefox Add-ons, etc.) and check the reviews and read count before installing.

One practical risk is that if your computer gets infected with malware that logs your keystrokes, the malware could capture your master password when you type it. This is not a password manager problem — it's a computer security problem. Keep your operating system and antivirus software up to date.

Syncing across devices and offline access

Most password managers sync your vault to the cloud, which means your passwords are available on your phone, tablet, and laptop. When you add a new password on your phone, it appears on your laptop within seconds. This requires an internet connection to sync, but once synced, the passwords are stored locally on each device and work offline.

If you use KeePass or another local-storage manager, you must manually sync the password file across devices. You might store it in a cloud folder like Dropbox or Google Drive, or copy it by hand. This gives you more control but requires more work.

Some managers offer a feature called offline mode, which means you can access your passwords even if you don't have an internet connection. This is useful if you're on an airplane or in an area with no signal. Cloud-based managers usually support offline mode on your phone and computer — they read a copy of your vault when you're online, then let you access it when you're offline.

Passwords you should not store in a password manager

Store most passwords in your manager, but keep a few exceptions. Do not store your master password itself — that defeats the purpose. Do not store the recovery code or backup codes that the manager gives you — store those on paper in a safe place instead.

For accounts that are extremely sensitive — like your email account, your bank account, or your password manager account itself — some people choose to use a password they memorize rather than a random one the manager generates. This is optional and adds a small layer of extra security, but it's not necessary if you trust your master password and your device security.

If you use two-factor authentication (which you should), the password manager can store the backup codes that the service gives you, but not the temporary codes that appear in your authenticator app. Those codes change every 30 seconds and cannot be stored.

Frequently Asked Questions

Can I use a password manager on a work computer?

Yes, but check your company's policy first. Some companies prohibit personal software on work devices. If your company allows it, install the manager and use it for personal accounts. Keep your work passwords separate — either memorize them, use your company's password manager if they provide one, or store them in a separate vault within your personal manager.

What if a website doesn't let the password manager fill in my password?

Some older websites or sites with unusual login flows don't work with autofill. You can still use the manager — open it, find the password, and copy it to your clipboard, then paste it into the website. Most managers have a button that does this in one click.

Do I need to pay for a password manager?

No. Bitwarden and KeePass are free and fully functional. LastPass has a free version that works on one device type. If you want cloud sync across all devices, paid options like 1Password ($3.99/month) and Dashlane ($4.99/month) are available, but free options exist.

Can someone hack my password manager if they have my computer?

If someone has physical access to your unlocked computer, they can use the password manager while it's still open. Lock your computer when you step away. If your computer is off or locked, they cannot access the manager without your master password.

Should I use the same master password for multiple password managers?

No. Use a different master password for each manager. If you use multiple managers, each one should have its own unique, strong master password. This way, if one manager is compromised, the others remain find.