A password manager exists so that every site gets its own long random password that you do not remember and do not need to. It generates passwords, stores them in an encrypted vault, fills them into forms, and, most importantly, refuses to fill them on a phishing site with a look-alike address. One password for everything is the leading cause of account takeovers: one site's database leaks and the password works for your email. A manager breaks that chain.

What it does

  • Generates 16 to 24 random characters that cannot be guessed.
  • Stores them in a vault encrypted with your master password; the service or cloud sees only encrypted data.
  • Fills by matching the domain. On yourbank-secure-login.com the real bank's password will not appear, which is anti-phishing protection you cannot replicate by hand.
  • Syncs between phone and computer.
  • Warns about reused, weak and breached passwords.
  • Often stores 2FA codes, notes, cards and files.

Three kinds

Built into the browser or OS: Chrome, Safari and iCloud Keychain, Firefox. Free, already installed, syncs through your account. Downsides: tied to one ecosystem, weaker protection against someone with your unlocked device, fewer features. A fine start, and far better than one password for everything.

Cloud services: Bitwarden, 1Password, Proton Pass and others. Work on every platform and browser, store the vault encrypted on their servers, support family sharing and shared vaults. Free tiers exist with the basics.

Local: KeePass and its variants (KeePassXC, KeePassDX). The vault is a file on your device; you arrange sync yourself (cloud, NAS). Maximum control, minimum convenience.

What to look for

  1. Encryption on the device. The vault is encrypted before it leaves; the service cannot read it. Look for "zero-knowledge" or "end-to-end".
  2. Open source or independent audits. Bitwarden and KeePass are open; closed ones should publish audits.
  3. All your platforms: phone, computer, browsers.
  4. Autofill by domain, not by site name.
  5. 2FA for the manager itself, ideally with a hardware key.
  6. Export, so you can leave if you dislike it.
  7. Breach checks against known leaks.

Protecting the manager itself

The manager is a single point of failure, so:

  • The master password is a long phrase of four or five words that you remember and never write down in the clear. Impossible to guess, easy to recall.
  • 2FA on the manager is mandatory, preferably a key or passkey; why that beats SMS is in two-factor authentication compared.
  • A recovery code or key in a safe place offline.
  • Auto-lock after a minute of inactivity on phone and computer.
  • Do not keep the 2FA codes for your email in the same manager unless the manager itself has strong 2FA; otherwise one breach gets everything.

How to migrate

  1. Install the manager and its browser extension.
  2. Import passwords from the browser (Chrome and Safari export to CSV; delete the file after import).
  3. Each time you log in somewhere, replace the old password with a generated one. Start with email, banking, social media.
  4. In a month or two no reused passwords remain.
  5. Turn off password saving in the browser so there is one source of truth.

For a password without a manager, for a router or Wi-Fi, use the password generator.

What a manager does not do

It does not protect against malware on the device that reads everything you type. It does not replace 2FA. It does not hide from the network where you log in; that is the VPN's job, covered in what can my ISP see. And it does not help if the master password is your birthday.

In short

  • A unique password per site is the only defense against database leaks.
  • Browser-built-in beats nothing; an open-source cloud manager is the sweet spot; local is for people willing to tinker.
  • Master phrase, 2FA with a key, recovery code offline.

404 VPN covers the network side: a shared network cannot see where you sign in or what the manager fills, and the kill switch keeps traffic from escaping when the tunnel drops. Get started here.