If you’ve ever been told to “just use a password manager”, you’ve probably had the same thought most people do. Isn’t putting every password you own in one place a bit like keeping all your house keys on one keyring and then leaving it in the pub? It’s a fair question, and the honest answer is a bit more interesting than a simple yes or no.
Why people use them in the first place
The problem password managers solve is a very human one. Most of us have dozens of accounts, sometimes hundreds, and nobody can remember a long, unique password for every one of them. So we cut corners. We reuse the same password with a number on the end, or we pick something memorable that also happens to be easy to guess.
Reuse is the real danger. When one website gets breached, criminals take the leaked email and password combinations and try them on other sites automatically. It’s called credential stuffing, and it works because so many people use the same password for their email, their shopping accounts and sometimes their bank. A password manager lets you have a different, properly random password for every site without needing to remember any of them.
How a decent password manager protects your data
Most reputable password managers use what’s known as “zero-knowledge” encryption. In plain English, your passwords are encrypted on your own device before they ever get sent to the company’s servers. The key that unlocks them is derived from your master password, which the company never sees or stores.
That means if the company’s servers were broken into, the attackers would get a pile of scrambled data rather than a neat list of your logins. Some providers publish detailed explanations of how this works, which is a good sign in itself. Bitwarden, for example, has a public security white paper that walks through its encryption and how your vault is protected at each stage.
So what happens if one actually gets hacked?
This isn’t purely hypothetical. In 2022, LastPass disclosed that attackers had got into its systems and stolen backups of customer vaults. The passwords inside those vaults were still encrypted, but the stolen copies were now sitting with the attackers, who could try to crack them offline for as long as they liked.
Whether an individual vault was at real risk came down mostly to one thing, which was the strength of the master password. A long, unique master password makes cracking the vault impractical. A short or reused one doesn’t. Some of the data, like website addresses, also wasn’t encrypted in older vaults, which gave attackers clues about which accounts might be worth targeting.
The lesson most security people took from it wasn’t “password managers are unsafe”. It was that the master password is doing a lot of heavy lifting, and that it’s worth paying attention to how a provider handles your data and how open they are when something goes wrong.
Is it still safer than the alternative?
For the vast majority of people, yes. Compare the realistic options:
- Reusing passwords means one breach on some forgotten forum can hand someone the keys to your email.
- A notebook at home is actually fine against online attackers, but it’s awkward, easy to lose and no help when you’re out.
- Saving passwords in your browser is better than reusing them, and modern browsers have got a lot better at this, but they usually offer fewer controls and are tied to that one browser.
- A good password manager gives you unique passwords everywhere, warns you about weak or reused ones, and works accross all your devices.
A password manager doesn’t remove risk completely. It swaps lots of small, likely risks for one bigger but much less likely one, and gives you the tools to make that one risk very small indeed.
How to use one safely
If you do decide to use one, a few habits make a big difference:
- Make your master password long and unique. A passphrase of four or five random words is easier to remember and much harder to crack than something like “Summer2026!”. Never use it anywhere else.
- Turn on two-factor authentication for the password manager account itself, ideally with an authenticator app or a hardware key rather than SMS.
- Pick a provider with a good track record. Look for independant security audits, clear documentation and a history of being upfront about incidents.
- Keep your devices up to date. A password manager can’t protect you if there’s malware on your laptop logging every key you press.
- Use passkeys where you can. More sites now support passkeys, which replace passwords altogether and can’t be phished in the same way. Most password managers can store them too.
What about if you forget your master password?
This is the bit people tend not to think about untill its too late. Because of the zero-knowledge setup, the provider usually can’t reset your master password and get your vault back for you. That’s the trade-off for them not being able to see your data. Some services offer recovery options or emergency access for a trusted contact, so it’s worth setting that up on day one rather than finding out the hard way.
The short answer
Password managers aren’t perfect, and a breach at a provider is a real thing that has happened. But the way they’re designed means a breach doesn’t automatically expose your passwords, especially if you’ve chosen a strong master password and switched on two-factor authentication. For most people, the everyday risk of reused and weak passwords is far bigger than the risk of the password manager itself being cracked. Pick a reputable one, set it up properly, and you’re in a much better position than you were before.
WordPress Theme: Lavoie
