How Password Managers Work, and Are They Safe?

By
Harris
-
33

Key Points

  • A password manager generates, stores and fills in passwords for you, so you only need to remember one strong primary password.
  • CISA, the FTC and the U.K.’s National Cyber Security Centre all recommend password managers as a practical way to use a long, unique password for every account.
  • Autofill adds phishing protection: a manager fills a saved password only on the website it belongs to, not on a lookalike page.
  • The main risks are a weak primary password, an insecure device and flaws in a poorly built product, so turn on two-factor authentication for the manager itself.
  • NIST’s federal guidelines say password-checking systems must allow password managers and autofill; the NCSC recommends passkeys wherever offered.

A password manager is a program that creates strong passwords, stores them behind one primary password and fills them in when you sign in to a website or app. For most people, it is the easiest way to stop reusing passwords. Used with care, password managers are considered safe, and U.S. and U.K. cybersecurity agencies recommend them.

Here is how they work, what can go wrong and where passkeys fit in, based on guidance from the Cybersecurity and Infrastructure Security Agency (CISA), the Federal Trade Commission (FTC), the National Institute of Standards and Technology (NIST) and the U.K.’s National Cyber Security Centre (NCSC). This guide does not rank or endorse any product.

What is a password manager?

CISA describes a password manager as a tool that generates complex passwords, fills them in automatically and stores them securely, so you only need to remember one strong master password. The NCSC calls the same thing a primary password and describes it as the key to the whole manager.

There are two broad types. Most web browsers and device operating systems include a built-in password manager that offers to save your passwords. Third-party password managers are separate apps for phones, tablets and computers, and some also work through a website in your browser. The FTC notes that a web browser, a mobile browser and a password manager can all save passwords for you.

How does a password manager work?

Once you sign in with your primary password, the manager keeps your logins for all your online accounts in one protected place, according to the NCSC. Most managers add four everyday features.

It generates strong passwords

When you create an account or change a password, the manager can suggest a long, random one. The FTC says studies show people are not very good at creating or remembering random, strong passwords. NIST adds that password managers have been shown to increase the likelihood that people choose stronger passwords, particularly when the manager includes a password generator.

It stores and syncs your logins

Your saved usernames and passwords sit in the manager instead of on sticky notes or in a file on your computer. Many managers also sync them across devices. The NCSC says one main benefit of a third-party manager over a browser’s built-in one is that it can sync passwords even when you use a mix of browsers and devices.

It fills in passwords for you

Autofill saves time, but it also adds security. The NCSC explains that because a manager fills a password only on the correct website, autofill helps protect you from phishing attacks. If autofill does not work on a page that looks right, check the web address carefully. Our guide on spotting a phishing scam covers the other red flags to watch for.

It warns you about weak or exposed passwords

The NCSC says many managers can notify you when a password has been breached or leaked, giving you a prompt to change it. CISA says a password manager helps prevent password reuse and weak passwords.

Why do security agencies recommend password managers?

The core problem is reuse. If you use the same password on several accounts and one is compromised, a hacker can try that password on your other accounts, the NCSC warns. The FTC says criminals buy credentials stolen in data breaches, and trying them on your other accounts works only when the same username and password are used in more than one place.

CISA’s advice is that strong passwords should be long, random and unique: at least 16 characters, either a random mix of upper and lowercase letters, numbers and symbols or a passphrase of five to seven unrelated words, and used for only one account. A manager makes that realistic.

Federal guidelines point the same way. In its current digital identity guidelines, NIST Special Publication 800-63B, NIST says systems that check passwords shall allow the use of password managers and autofill, and should let users paste a password when autofill is not available. The same guidelines require passwords used on their own to be at least 15 characters long, bar rules that force a mix of character types, and say users should not be required to change passwords periodically unless there is evidence of compromise.

Are password managers safe?

The agencies above treat password managers as a clear improvement over reused or weak passwords. They are not risk-free, though.

  • The primary password is the key to everything. The FTC says the password you use for your manager should be strong and secure, and you should protect it like your other passwords.
  • Your device matters. The NCSC warns that passwords stored in a browser are only as secure as your devices and accounts, so keep automatic security updates turned on for your browser and operating system.
  • Not every product is equally well built. NIST lists the exploitation of a vulnerability in an insufficiently secure password manager as one way login secrets can be copied, and tells agencies to evaluate managers carefully before recommending them.
  • Shared and public computers are a problem. The NCSC says you should never save passwords in the browser on a shared device outside your home, such as a library or college computer.
  • Forgetting the primary password can lock you out. The NCSC says many managers offer recovery options, such as secure password hints or emergency access through trusted contacts, so set those up early.

The single most effective safeguard is two-step protection on the manager account. The NCSC says that with two-step verification turned on, even a criminal who knows your primary password still cannot get into your account.

Built-in browser manager vs. third-party app

The NCSC says saving passwords in your browser or operating system is safe on your own devices and is the easiest option, particularly if you use the same browser or system everywhere. The best choice, it says, is the one that meets your needs and that you find easiest to use.

Question Built-in (browser or device) Third-party app
Setup Usually already there; offers to save passwords Install an app or use a website
Works across Easiest within one browser or operating system Can sync across a mix of browsers and devices
Cost Free with the browser or device Free and paid versions exist
Main caution Only as secure as your device and account Research reputation before trusting it

If you are weighing third-party options, the NCSC suggests thinking about whether you need it to work across different devices and operating systems, whether you want control over the kind of passwords it generates, whether you are willing to pay, and extras such as easier password sharing or breach alerts. The FTC recommends reading expert reviews to find a reputable manager.

How to set up a password manager safely

These steps, drawn from CISA, FTC and NCSC guidance, cover most of the risk:

  • Create a long, unique primary password or passphrase that you use nowhere else.
  • Turn on two-factor authentication for the password manager account.
  • Set up the manager’s account recovery options before you need them.
  • Replace reused and weak passwords first on your email, banking and other sensitive accounts.
  • Keep your devices, browser and manager app updated automatically.
  • Do not save passwords on public or shared computers.

Start with email. The FTC explains that password reset links often go to your inbox, so a hacker who takes over your email can reset the passwords on your other accounts. Stolen and reused passwords are also a common entry point for other attacks, as our explainer on how ransomware infections begin describes.

Do you still need two-factor authentication?

Yes. A password manager makes your passwords stronger, but the FTC notes that even strong passwords are vulnerable to cyberattacks. Two-factor authentication requires a second credential from a different category: something you know, something you have or something you are. A thief with your password alone cannot get in.

Methods differ in strength. CISA ranks a physical security key as the most secure option, followed by authenticator apps, with text or email codes the weakest. The FTC explains that criminals can hijack a phone number through a SIM card swap and receive text message codes, and it calls security keys the strongest method because they do not use credentials that hackers can steal. A text code is still better than nothing if it is the only choice. CISA’s guide to strong passwords and password managers recommends pairing the two.

What about passkeys?

Many websites and apps now offer passkeys, a sign-in method that does not involve typing a password. The NCSC describes a passkey as a digital key protected by your device’s existing unlock method, such as a fingerprint, face check or passcode. It recommends making passkeys your first choice wherever they are offered and continuing to use strong, unique passwords with two-step verification everywhere else.

NIST’s guidelines describe a related class of sign-in keys it calls syncable authenticators, whose keys can be copied to other devices through a cloud service. NIST says properly configured syncable authenticators create a key pair tied to one specific website, which prevents a fake page from capturing and reusing the login. Since many services still rely on passwords, a password manager remains useful in the meantime.

The bottom line

A password manager replaces dozens of weak or reused passwords with strong, unique ones, and you only have to remember one. CISA, the FTC and the NCSC recommend them, and NIST requires the password systems it covers to allow them. Safety depends on the primary password, the security of your devices and the second factor that guards the manager, so get those right first. Then move your most important accounts over, and switch to passkeys where they are available. For the latest major U.S. developments, including significant cyber incidents, follow the U.S. News Live center.

Sources