If I asked you how many different passwords you have… I wouldn’t believe you. And if you told me you use the same one for your email, your bank and your online shop, or that you keep them all in a drawer note or a sticky note on the monitor, I’d understand perfectly. Human memory wasn’t made for a hundred secrets โ and that habit (reuse everything, or write it all down) is exactly what attackers exploit.
The good news has a name: password manager. This article walks you through everything you need to make the switch.
This article was automatically translated by an AI tool from the original Spanish version, and may contain errors.
One vault instead of one drawer
A password manager is an app that stores the credentials of your accounts โ email, bank, social networks, stores โ and also other data such as secure notes or your card details. Instead of memorizing or writing down twenty passwords, you only keep one: the master password, the single key that opens the whole vault.
Here’s the best part. Almost every manager can generate long, random, unique passwords for every account, at whatever length you pick. “MyPassword2024” everywhere is replaced by a string for which a brute-force cracking attempt would be meaningless in practice.
One thing that matters a lot: protect your master password like it were the key to your house. If an attacker got it, they wouldn’t steal one password: they’d steal them all. Make it long, use it for nothing else. (There’s exactly one case where sharing it does make sense โ I’ll tell you about it below.)
In the cloud, or only on your machine
Managers come in two main flavors:
- In the cloud: your vault lives encrypted and stays synced across devices. Open it from your phone on the street, from the laptop at work, from the one at home โ Windows, Mac, Android, whatever โ without caring which platform you’re on. It’s convenient, but it means an external server holds the encrypted copy of your vault.
- Only on your machine (local): everything is stored in an encrypted file inside your own device. Nobody outside holds even a byte of your passwords. In return, you can’t open the vault from anywhere else, and if the machine is lost or dies, so are your data โ unless you keep periodic backups on a second medium.
Local is the strictest option: you never hand your secret to “someone else’s computer”. If you don’t trust the cloud, this is the one for you.
A trick I like from the local setup: digital inheritance. If you and a family member you trust both exchange each other’s master password (and, if you have one, the second authentication step), then in the tragic event that one of you passes away, the other can handle email, bank and pending paperwork with no lost keys. You’ll have spared the family members who will take over an endless bureaucratic battle. Run a small rehearsal once in a while to make sure the method works end to end.
Your browser brings them to you
The most common browsers โ Brave, Chrome, Firefox, Edge and Safari โ integrate with password managers through installable extensions, so form fills happen automatically and you don’t have to jump between windows. It’s one of the most practical features, even though I’m not a fan of browser extensions.
Managers get attacked too
I’m not going to sell you the idea that a manager is invulnerable just because it stores passwords: it’s software, and software has bugs and incidents. At least three real cases are worth knowing:
- LastPass suffered several breaches from 2011. In the first one, attackers got users’ email addresses but no passwords. In 2022 came the worst hit: a keylogger on the personal computer of an administrator engineer โ who had access to the decryption keys of the cloud environment โ exposed the passwords of a group of users.
- Passwordstate, by Click Studios, suffered a supply-chain attack in April 2021: a malicious update distributed through the manager’s own official channel infected thousands of business customers with the Moserpass malware, which hid inside the update file in the form of a software library (DLL) that the system itself loaded without anyone noticing.
- Bitwarden, which I’ll mention later, also had minor incidents.
The lesson isn’t “careful, don’t use managers”. The lesson is that your manager’s security depends heavily on the security of the company that builds it: its architecture, its internal practices, its transparency โ which will generally be a thousand times better than yours, by default.
That’s why who builds it matters
Before choosing, do some research on the company. There are governments that could pressure a company into handing over some kind of “company master key” which, if it existed, would give them access to their customers’ passwords. An open-source manager, like Bitwarden and KeePass, lets the whole community read the code, hunt for vulnerabilities and report them. That’s not a security guarantee, but it’s the closest thing to one anyone will offer you.
If I had to recommend, I’d pick Bitwarden, Proton Password Manager and KeePass: two of them are open source, and all three have an excellent reputation with no major recent incidents. Very well known ones are 1Password, Dashlane, LastPass, NordPass, RoboForm and Keeper. There’s one I’d rather not recommend right now: LastPass โ it’s the one you just saw accumulating the incidents above, and it also ships seven third-party trackers (Bitwarden has two, 1Password and KeePass none).
Trackers are third-party code embedded in the app that sends data about your usage to their owners. In an app that manages passwords, I don’t consider it acceptable. Companies usually justify it as “improving the product” โ which is exactly the generic excuse for spying on users across many services. Most managers let you turn telemetry and trackers off from their privacy settings (on some platforms, sadly, you can’t).
A bonus trick to detect a breach early
A trick that pairs very well with a manager: email aliases, the kind SimpleLogin offers. Instead of handing out your real email everywhere, you create a unique alias for each service you register with. If that service gets breached someday, the malicious mail starts arriving at that alias โ and you immediately know exactly where the breach happened.
Something similar is offered by 1Password, which integrates with Fastmail so you can create and manage email aliases directly inside the app. If you go with Bitwarden, you can combine it with SimpleLogin: the two tools talk to each other, so you can create and store your aliases from wherever you are.
Start today, and do it better
If you don’t use a manager yet, this is the moment. Pick one, migrate (most of them can import the passwords from your browser), generate a strong new master password, and from then on let the manager generate a fresh password every time you register or reset an account.
And once it’s working, add multifactor authentication to it: I explained in detail how in Do You Protect Your Accounts Properly? You Should Use Password Managers and Enable Multifactor Authentication. A good manager + MFA + email aliases is the strongest combo you can put in front of your accounts for almost no effort.
And remember: not every attack comes with code. The other big family is social engineering โ tailgating, baiting, pretexting โ where what steals from you isn’t a program but a person playing with your trust, your curiosity and your willingness to help. A good manager doesn’t protect you from that, but it gives you a solid base so that when you do defend your accounts, you do it with something that truly counts as security.