You have more than a hundred. You can't remember them all. A password manager does it for you, better than you do.
Recognize the reflex? The same password (or nearly) everywhere, with variants like Password123! and then Password2024!. It's human. It's also the most common entry point for online fraud.
A password manager fixes this in one evening. Here's how.
Why it actually matters
When a site gets breached (it happens every month), attackers grab the password list. Then they try those passwords on your email, your bank, Facebook, Amazon. If you reuse the same one everywhere, a single leak opens multiple doors.
A manager lets you keep a different password per site. You never type them again: it autofills, and only on the right domain. That already blocks a lot of phishing: on a fake bank login page, the manager refuses to fill, because it's not the real URL.
What it does, concretely
- Encrypted vault: your passwords are readable only to you
- Automatic generation: 20 random characters in one click
- Autofill: in browsers, on phones, inside apps
- Sync: your passwords follow you across devices
- Breach alerts: you get warned if one of your passwords shows up in a known breach
- Secure sharing: for the home Wi-Fi, the Netflix account, the bookkeeper
The one password to remember
The master password is the only one you have to memorize. Make it long and personal: a four-word phrase nobody can guess, not a dictionary word followed by a number.
A method that works: four unrelated words plus a digit that means something to you. Long, memorable, nearly impossible to guess (NIST 2024 guidance).
Then turn on multi-factor authentication (MFA) on the manager itself. Belt and suspenders.
Three solid options
| Tool | Price (approximate) | Notes |
|---|---|---|
| Bitwarden | Free; paid tier around $10 USD/year | Open source, full featured, great default |
| 1Password | Around $4 USD/month | Polished UI, excellent family sharing |
| Proton Pass | Free; paid inside Proton Unlimited | Swiss company, tight fit with Proton Mail |
All three work for personal use and small business. Prices shift, verify when you pick.
Skip browser-only managers (Chrome, Safari): they work, but cover non-web apps and non-Apple/Google phones poorly.
One hour tonight, once and for all
Install the app (30 seconds), create the master password (two minutes of real thought), then import the passwords already saved in your browser (five minutes). Change the five critical accounts in this order: main email, bank, government portals, Apple or Google, social media. The rest updates on its own, on your next login at each site.
One hour total. After that, you stop thinking about it.
A manager is one piece of the picture. Other habits that matter: multi-factor authentication, checking if your email has already leaked, and six cybersecurity habits for everyone.
Rolling a password manager out across a team (plan choice, secure sharing, offboarding process when someone leaves) is a different job. Book thirty minutes and we'll look at how to start cleanly.