Technology

Password managers explained: how they work and how to choose one

A password manager remembers a different strong password for every account so you don't have to. Here's how the encrypted vault works, the main types, the real risks, and a checklist for choosing and setting one up.

Chander Prakash

By Founder & Editor

7 min read

Illustrative cover: Password managers explained: how they work and how to choose one
Illustration: Pointales

A password manager is an app that creates, stores and fills in your passwords for you. Everything sits in an encrypted “vault” that you unlock with one master password, your fingerprint or your phone’s screen lock. That means you can use a long, different password for every account without remembering any of them. This fixes the biggest weakness of passwords, reuse, and because a manager won’t autofill on a lookalike website, it also helps against phishing.

Why password reuse is the real problem

When a website is breached, the stolen email addresses and passwords are tried automatically on other sites. This is called credential stuffing. The UK’s National Cyber Security Centre (NCSC) describes the attack as using passwords leaked from data breaches “to attack other systems where users have used the same password”.

The fix is a unique password per account, which nobody can memorise across dozens of logins. NIST, the US standards body, says in its digital identity guidelines, SP 800-63B-4, that websites “SHALL allow the use of password managers and autofill” and should let you paste passwords. It also asks sites to require at least 15 characters when a password is the only thing protecting an account. The NCSC recommends password managers for secure storage. In India, CERT-In’s advisory on password management (October 2022), written for organisations, suggests a password vault for all staff to generate “long & unique passwords”.

How a password manager works

Details vary, but most follow the same pattern.

  1. You set a master secret: the one password (or device unlock) that opens the vault.
  2. A key is derived from it. The app runs it through a deliberately slow “key derivation function”, such as PBKDF2 or Argon2, to produce an encryption key. The slowness makes guessing attacks expensive. Bitwarden, for example, documents 600,000 rounds of PBKDF2 by default, with Argon2id as an option.
  3. The vault is encrypted on your device before it syncs, commonly with 256-bit AES. The company’s servers hold only the scrambled copy.
  4. The company can’t read it. This design is called end-to-end or “zero-knowledge” encryption. Bitwarden says the master password is never sent to its servers, and LastPass says its master password is “never known to LastPass”.
  5. Autofill checks the address. Each saved login is tied to a website address, and the manager offers it only where the address matches.

That last step is an underrated safety feature: a lookalike “bank-verify” site gets no suggestion, which is itself a warning sign. The NCSC notes that password managers are “better than humans at spotting fake websites”. The protection is not absolute, though: if you copy the password and paste it in by hand, the manager can’t stop you. Phishing links are a common opening move in the scams covered in how UPI frauds work.

Not every manager works this way by default. Google says its standard setup encrypts passwords but the key is “safely stored in your Google Account”. Optional on-device encryption puts the key only on your devices, but Google warns it can’t be removed once set up, and losing the key could mean losing your passwords.

The three main types

Built-in managers come with your phone, computer or browser: Google Password Manager, Apple Passwords and Microsoft’s password manager are the examples FIDO Alliance lists. Apple’s Passwords app flags weak, reused or leaked passwords, as does Google’s Password Checkup.

Standalone apps work across ecosystems and usually sync through the vendor’s cloud. FIDO lists 1Password, Bitwarden, Dashlane, Keeper and LastPass as third-party credential managers.

Open-source managers publish their code for anyone to inspect. Bitwarden is a cloud service whose source code is on GitHub. KeePass is a free, open-source app that keeps passwords in one database file locked with a master key, stored wherever you choose.

Built-in (browser/OS)Standalone appOpen-source, local file
ExamplesGoogle Password Manager, Apple Passwords1Password, Bitwarden, Dashlane, KeeperKeePass
Works across Apple, Android, WindowsPartly; best inside one ecosystemYes, generallyDepends on the apps you choose
Who holds the vaultThe platform’s cloudThe vendor’s cloudYou
Can the provider read it?Apple: no, end-to-end encrypted; Google holds the key unless you turn on on-device encryptionDesigned not to (end-to-end encrypted)No provider involved
Stores passkeysYesMany doCheck the specific app
Main trade-offTied to your Apple or Google accountAnother account to secure; some features paidBackups and sync are your job

Sources: FIDO Alliance, Passkey Central; Apple Platform Security; vendor documentation linked above.

The real risks

A password manager concentrates risk; the NCSC calls managers “attractive targets in themselves”. What can go wrong:

  • Forgetting the master password. With true end-to-end encryption, the company can’t reset it. If you forget it, the NCSC warns, “you will not be able to get back in”.
  • A breach at the provider. In December 2022, LastPass disclosed that an attacker had copied a backup of customer vault data. Passwords, notes and form data were encrypted, but website addresses were not. LastPass said it would take “millions of years” to guess a master password created under its default settings, but that weaker master passwords were more exposed to guessing. In March 2023 it added that the attacker had reached the backups by delivering malware to a senior engineer through vulnerable third-party software. The lesson: a stolen vault is only as safe as the master password protecting it.
  • Design flaws. Researchers at ETH Zurich and the Università della Svizzera italiana presented attacks on Bitwarden, LastPass, Dashlane and 1Password at USENIX Security 2026. Assuming a malicious or hacked server, they found “zero-knowledge” claims did not always hold; vendors were notified and fixes are being worked on.
  • A compromised device. If malware controls your phone or laptop while the vault is unlocked, encryption doesn’t help. Keep devices updated.

Where passkeys fit in

Passkeys are the next step after passwords, and password managers store and sync them. The FIDO Alliance notes that the terms password manager and credential manager are now used interchangeably because the same apps hold both. You use passkeys where a site supports them and generated passwords elsewhere, from the same app. Apple’s Passwords app can also store verification codes, though keeping your password and your second factor in one place reduces the separation that two-factor authentication is meant to provide.

How to choose: a checklist

  • Which devices do you use? All Apple or all Android/Chrome makes the built-in option simple. A mix of iPhone and Windows, say, points towards a standalone app.
  • Is the vault end-to-end encrypted by default? If not, can you switch it on?
  • Can you protect the manager itself with a second factor or a passkey? CERT-In advises multi-factor authentication for accessing a cloud vault.
  • What is the recovery route if you forget the master password or lose your phone?
  • Can you export your data if you want to leave later?
  • Does it store passkeys, and does it work in the browsers you use?
  • What is the vendor’s security record, and how did it handle past incidents?

Your first hour: setting one up

  1. Pick one manager and install it on your phone and main computer.
  2. Create a long master passphrase, such as four or more unrelated words. Keep a written copy somewhere physically safe until you know it by heart.
  3. Turn on two-factor protection for the manager’s account, or for the Apple or Google account behind a built-in manager.
  4. Set up recovery: a recovery code, emergency contact or second device, depending on the product.
  5. Import passwords saved in your browser, then delete the old copies.
  6. Change your most important passwords first: email, then banking, then your phone’s Apple or Google account. Let the manager generate them.
  7. Run the security check for reused or breached passwords and fix a few accounts at a time.
  8. Add passkeys wherever a site offers them.

The point: A password manager lets you use a unique, strong password everywhere, which defeats credential stuffing, and its address-matching autofill makes fake websites easier to spot. It also puts all your eggs in one well-guarded basket, so the master password, your recovery plan and the account protecting the vault matter more than which brand you choose. Use passkeys inside it wherever you can.

Sources

Share
Chander Prakash

Chander Prakash Founder & Editor

Chander Prakash is the founder and editor of Pointales. He reviews every story before it is published and sets the publication's editorial standards, with a focus on clear, well-sourced explanations of business and technology.

Related stories

Technology

What “3nm” and “2nm” really mean in chips

Chip names like 3nm and 2nm sound like measurements, but they stopped describing any physical size decades ago. Here is what the numbers actually signal, what improves at each step, and why India's first fab is aiming at 28nm.

Chander Prakash

Technology

What is RAG? How AI tools look things up

Retrieval-augmented generation lets an AI tool search a set of documents before it answers. Here is how it works step by step, how it compares with fine-tuning and long context, where it fails, and how to tell when a tool is using it.

Chander Prakash