What is a password manager in simple terms?

An encrypted app that generates, stores, and auto-fills your passwords. You memorize one strong master passphrase; it securely remembers the other hundred.

Are password managers safe from hackers?

Reputable ones use zero-knowledge encryption: your vault is encrypted on your device and the vendor cannot read it. Even a breach of the vendor's servers does not expose your passwords.

What happens if I forget my master password?

With zero-knowledge managers, nobody — not even the vendor — can recover it. Store a written copy somewhere physically safe until the passphrase is muscle memory.

Should I pay for a password manager?

Free tiers from established vendors cover unlimited passwords and are enough for most people. Paid plans add extras like emergency access and advanced 2FA, typically $10–$40 per year.

Password Manager Guide: How to Choose the Right One

A password manager is the single highest-impact security upgrade most people can make. This guide explains what they do, which features actually matter, and how to switch in one afternoon.

What a password manager does

A password manager is an encrypted vault that generates, stores, and fills your passwords. You remember one strong master passphrase; it remembers the other hundred. When you visit a login page, it offers the right credentials and fills them — defeating phishing sites, because it will not fill your bank password on a lookalike domain.

Modern managers also store more than passwords: passkeys, secure notes, credit cards, Wi-Fi credentials, and software licenses. Many now support passkeys — phishing-resistant login credentials synced across your devices — which are gradually replacing passwords on major sites.

Features that actually matter

Zero-knowledge encryption. The vendor should never be able to read your vault. Look for AES-256 or XChaCha20 encryption with a key derived from your master password on your device.
Cross-device sync. Your vault should follow you between phone, laptop, and tablet without manual export gymnastics.
Built-in generator. One-tap creation of long random passwords (or use our password generator and paste the result in).
Breach monitoring. Alerts when a site you use appears in a known breach, so you know which passwords to rotate.
Passkey support. Increasingly the future of logins; a manager that handles passkeys keeps you current.
Emergency access. A way for a trusted person to get in if something happens to you.

Features that matter less than marketing suggests: a built-in VPN, dark-web "scores," and exact password-strength meters. Focus on the vault fundamentals.

Free vs. paid

Reputable free tiers (from vendors like Bitwarden) cover unlimited passwords on unlimited devices and are genuinely sufficient for most people. Paid plans — typically $10–$40 per year — add things like advanced 2FA options, emergency access, and priority support. The free-vs-paid decision matters far less than the adopted-vs-not-adopted decision: any established zero-knowledge manager beats sticky notes and password reuse.

Avoid managers bundled as an afterthought into antivirus suites unless you have verified they use zero-knowledge architecture. And be wary of browser-only storage without a master password: convenient, but anyone with your unlocked laptop owns every account.

Migrating in an afternoon

Pick one manager and install it everywhere — phone, laptop, and browser extension.
Create your account with a strong master passphrase — four or five random words. Write it on paper and store it somewhere safe until it is muscle memory. If you forget it, nobody can recover your vault.
Import existing passwords from your browser's saved-password export, then delete the browser copies.
Work through your top 20 accounts — email first, then banking, then everything else — generating a fresh unique password for each. Email is the master key to password resets, so it gets the strongest treatment.
Turn on two-factor authentication for the manager itself and your email. Our two-factor authentication guide walks through the options.

Passkeys: the passwordless future, today

Passkeys are cryptographic credentials that replace passwords on supported sites. Instead of something you know, you prove identity with your device — a fingerprint, face scan, or PIN unlocks a private key that never leaves your hardware. The server holds only the public half, so breaches leak nothing reusable, and because the credential is bound to the real site's domain, phishing stops working entirely.

Your password manager is the natural home for passkeys: it syncs them across your phone, tablet, and laptop, so you are not locked into one device or one ecosystem. When a site offers "sign in with a passkey," create it through your manager rather than the platform's built-in storage for maximum portability.

Passwords are not disappearing tomorrow — most sites will support both for years. The pragmatic setup: passkeys where offered, long generated passwords everywhere else, all managed in one vault. When evaluating a manager today, passkey creation, sync, and cross-platform autofill are features worth weighting heavily.

Pair this with our strong password guide for the master passphrase, and skim password myths debunked to unlearn the old rules.