Part of our guide to How to Spot a Phishing Message Before You Click
The objection to password managers is always the same: putting every password in one place sounds like building a single point of failure. It is worth taking seriously — and then comparing it honestly with what most people do instead.
The realistic alternative to a password manager is not perfect memory. It is one password reused across dozens of sites, with small variations. That arrangement already has a single point of failure — it just fails silently, at whichever site gets breached first, and you find out months later.
How the encryption actually works
This is the part that decides whether the objection holds, and it is simpler than it sounds.
When you save a password, the manager encrypts it on your device before anything is uploaded. The encryption key is derived from your master password, which is never sent to the company. What arrives on their servers is an encrypted blob they cannot open.
That design has a specific consequence people find alarming until they understand it: the company cannot reset your master password. There is no "forgot password" flow that recovers your data, because there is nothing on their side to recover it from. That absence is the feature — the same property that stops an employee, an attacker or a subpoena from reading your vault stops the company from helping you into it.
What a breach of the provider actually exposes
Password manager companies do get breached. It has happened, and it will happen again.
What attackers obtain in that scenario is encrypted vaults plus whatever metadata the provider stored unencrypted — often things like the website addresses you have accounts with, which is not nothing.
Whether the vaults themselves fall depends almost entirely on your master password. A long, unique passphrase makes offline cracking impractical at any realistic scale. A short or reused one makes it feasible.
So the honest framing is not "is the company secure" but "is my master password strong". The company's job is to make cracking expensive; yours is to make guessing hopeless.
Choosing a master password
One password, memorised, never used anywhere else. Current guidance from NIST favours length over complexity — a long passphrase beats a short string of symbols, and forced complexity rules tend to produce predictable patterns.
Four or five unrelated words is the standard advice, and it works because it is long, memorable, and not derived from anything about you. Avoid song lyrics, quotes and anything findable on your social media.
Then write it down and put the paper somewhere physically secure — a safe, a locked drawer, with important documents. This sounds like heresy and is not: the realistic threat to your vault is a remote attacker, not a burglar reading your filing cabinet. Losing the master password means losing everything in the vault.
Getting started without losing a weekend
The mistake is trying to migrate 200 accounts in one sitting. You will stop halfway and end up with two half-systems.
1. Install it and set the master password. Add the browser extension and the phone app.
2. Import what your browser already has. Every mainstream manager imports from Chrome, Safari, Edge and Firefox in a couple of clicks. This does most of the work immediately.
3. Fix the accounts that matter, in this order. Email first — everything else resets through it. Then banking, then anything holding payment details. Change each to a generated password as you go.
4. Let the rest happen naturally. Every time you log into something, the manager offers to save it. Within a month or two most of your accounts have migrated without a dedicated effort.
5. Run the breach check. Most managers flag reused passwords and accounts caught in known breaches. It is usually an uncomfortable list, and it tells you where to spend the next hour.
Browser built-in versus dedicated
Browser password managers have improved considerably and are genuinely fine for many people. They are free, already installed, and sync across your own devices.
Dedicated managers add things worth having if they apply to you: working across different browsers, sharing a password with a partner without texting it, storing more than passwords, breach monitoring, and recovery options for the master password.
The gap between "browser built-in" and "dedicated manager" is much smaller than the gap between "reusing one password" and either of them. If the choice is stopping you from starting, use the browser one today.
What a password manager does not fix
It does not protect you from phishing. If you type your credentials into a convincing fake site, the manager will not save you — although it helps indirectly, because it will not auto-fill on a domain it does not recognise, and that hesitation is a useful warning. See how to spot phishing.
It does not replace two-factor authentication. Those defend against different failures — see the two-factor authentication guide.
It does not help if your device is already compromised. Malware with access to your unlocked machine is a different problem with a different solution.
Related reading
- How to spot phishing
- Two-factor authentication guide
- How to recover a hacked account
- What is a VPN, and do you need one?
- How to spot a fake online shop
This is general information, not security advice for a specific situation — see our disclaimer.
Frequently asked questions
Are password managers safe?
The mainstream ones encrypt your data on your own device before it is uploaded, using a key derived from your master password. The company stores a blob it cannot read. That is meaningfully safer than reusing one password across dozens of sites, which is the realistic alternative.
What happens if the password manager company gets hacked?
Attackers get encrypted vaults, not passwords. With a long, unique master password those vaults are impractical to crack. A weak master password is the case where a breach genuinely endangers you, which is why that one password matters more than all the others combined.
What if I forget my master password?
With most providers you lose the vault. That is a direct consequence of them not being able to read it — there is no reset because there is nothing on their side to reset. Write the master password down and store it somewhere physically safe.
Is the browser's built-in password manager good enough?
It is far better than reusing passwords, and it is free and already installed. Dedicated managers add cross-browser support, secure sharing, breach monitoring and easier recovery options. Browser-built-in is a reasonable starting point rather than a mistake.
Should I pay for one?
Not necessarily. Several reputable managers have free tiers that cover one person on their own devices. Paying usually buys family sharing, more device types or extra features rather than better encryption.
Do I still need two-factor authentication?
Yes. A password manager fixes password reuse; two-factor protects against a password being stolen anyway. They solve different problems and you want both.
Sources
Found an error? Email us and we will fix it and note the change at the bottom of this article. Hello@daily-atlas.com
