Why You Need a Password Manager (And How to Choose One)

The problem password managers solve

Most people have accounts with 50–150 online services — email, banking, social media, shopping, streaming, government portals, work tools. Each one should have a unique, strong password. That’s 50–150 passwords to remember, each ideally 16+ random characters.

No human can do that. The workarounds people use — a single strong password everywhere, or a base password with slight variations per site — are the exact patterns that make credential-stuffing attacks so devastating. When one site leaks your “universal” password, every account you own is at risk.

A password manager is the only realistic solution. It remembers all your passwords, generates new strong ones on demand, and auto-fills them so you never need to type them. You only memorise one strong master password.

Before you set up a password manager, use the Password Strength Checker to assess how strong your current passwords are — it will give you a clear picture of how much work needs to be done.

How password managers work

The core mechanism:

1. Your vault is an encrypted database of credentials, notes, and identities.
2. Your master password is used to derive an encryption key (via a slow KDF like PBKDF2, Argon2, or bcrypt). This key is never sent to the provider.
3. The encrypted vault syncs to the provider’s servers. The provider holds your encrypted blob but cannot decrypt it — they do not have your master password.
4. When you open the app, your master password decrypts the vault locally. Your credentials are only available while the app is unlocked.
5. A browser extension detects login forms and offers to fill credentials automatically.

This is called zero-knowledge or end-to-end encrypted architecture. It means a server-side breach at the provider exposes only encrypted data that is useless without your master password.

What to look for when choosing a password manager

Zero-knowledge encryption (mandatory)

Check that the provider explicitly uses zero-knowledge architecture. This should be clearly stated in their security whitepaper or documentation. Providers that cannot clearly explain their encryption model should be avoided.

Cross-device and cross-browser support

Most users move between a phone, a laptop, and possibly a work computer. Look for:

• iOS and Android apps
• Browser extensions for Chrome, Firefox, Safari, Edge
• A web vault as backup

Password generator

All good managers include a built-in generator. You want control over length (16–64 chars), character sets, and optionally a passphrase mode (4–6 random words). Test a generated password in the Password Strength Meter to see how entropy scales with length.

Breach monitoring

Premium managers watch dark-web breach databases and alert you when any of your stored credentials appear in a known leak. This feature alone can prevent account takeover.

Emergency access

If you’re incapacitated, can a trusted person get into your vault? 1Password has an Emergency Kit, Bitwarden has an emergency access feature. This matters for estate planning and family access.

Open source or audited

Open-source managers (Bitwarden) allow anyone to verify the implementation. Proprietary managers (1Password, Dashlane) should publish third-party security audits. Check for SOC 2 Type II reports and penetration test disclosures.

The main options

Bitwarden (free and open source)

Best for: Everyone, especially budget-conscious users and those who want to self-host.

Bitwarden is fully open-source, meaning the code can be independently verified. The free tier includes unlimited passwords, cross-device sync, and browser extensions. A premium tier adds breach reports, advanced 2FA, and encrypted file attachments. A self-hosting option exists for those who don’t want cloud storage at all.

1Password (premium)

Best for: Teams and families; polished UX.

1Password has no free tier but is arguably the most polished consumer password manager. Its “Travel Mode” removes sensitive vaults when crossing borders. Strong team features with fine-grained sharing controls.

Dashlane (premium)

Best for: Users who want a dark-web monitor and VPN bundled in.

Dashlane includes a built-in VPN and the most comprehensive dark-web monitoring. Premium pricing reflects these extras.

Apple Passwords (free, Apple only)

Best for: Apple-only households.

The native Apple Passwords app (iOS 18 / macOS 15) is now a full-featured manager with iCloud Keychain sync, breach alerts via Safari, passkey support, and 2FA code generation. It does not work on Android or Windows, so it’s only suitable for Apple-only users.

Google Password Manager (free, Google ecosystem)

Best for: Android and Chrome users with no cross-ecosystem needs.

Syncs across Android and Chrome seamlessly. Lacks some advanced features (no cross-browser support, no password health audit dashboard). Zero-knowledge is less clear-cut than dedicated managers.

Setting up your master password

Your master password is the last line of defence. Use a random passphrase of five or six words — something like a Diceware passphrase. Then:

1. Enable 2FA on your password manager account — authenticator app, not SMS.
2. Store the emergency recovery kit in a safe physical location (printed and locked away).
3. Never store the master password in another password manager or write it in a digital note.

Test the strength of your master passphrase candidate in the Password Strength Meter — five Diceware words give about 64 bits of entropy, which is strong.

Migration: getting started

1. Install your chosen manager and create an account.
2. Import existing browser-saved passwords (all major managers accept CSV exports from Chrome/Safari/Firefox).
3. Work through your accounts systematically — change each password to a generated strong password, starting with your most critical accounts (email, banking, primary social media).
4. Enable 2FA on every account that supports it, storing the recovery codes in your manager.

After migration, run the built-in password health audit (most managers have one) to catch reused, weak, or breached passwords.

Summary

A password manager converts the impossible task of remembering 100+ unique strong passwords into a single, manageable responsibility: one strong master passphrase. With zero-knowledge encryption and 2FA, the vault is protected even if the provider’s servers are compromised. For most people, Bitwarden (free, open-source) is the right starting point; 1Password is worth considering for teams and families. The Password Strength Checker and Password Strength Meter can help you audit current passwords and understand what “strong” actually means before and after your migration.