Password Managers Explained: How They Work and Why You Should Use One
How a password manager keeps your logins private, what the LastPass breach taught us, and which to pick: Bitwarden, 1Password, Proton Pass or a built-in one.
A password manager is an app that remembers a different, long, random password for every account you have, and types it in for you. You remember a single master password. If you reuse passwords today, installing one is the most useful security change you can make in an afternoon.
What a password manager actually does
Most people know they shouldn't reuse passwords. Most people do it anyway, because nobody can remember eighty strings of random characters. Criminals rely on that. When one site leaks its password database, they try the same email and password on banks, shops and email providers. Stolen or guessed credentials were used at some point in 39% of the breaches Verizon analyzed for its 2026 Data Breach Investigations Report, more than any other technique.
A password manager breaks that chain. It does four things:
- It generates a new random password whenever you sign up somewhere.
- It stores every login in an encrypted vault.
- It fills in the right password on the right site, and only on the right site. A fake login page on a look-alike domain gets nothing, which quietly protects you from a lot of phishing.
- It syncs the vault between your phone, laptop and browser.
Most also warn you when a saved password shows up in a known breach, and store passkeys, the password replacement we cover further down.
How your passwords stay private
The obvious worry is that you're putting every password in one place. The good managers deal with that by never being able to read the place themselves.
It works like this. Your vault is encrypted on your own device before it's uploaded, using a key derived from your master password. The company stores only the scrambled result. Bitwarden's security documentation puts it plainly: the company never stores and cannot access your master password or your encryption keys. This design is usually called "zero-knowledge" or end-to-end encryption.
Turning a human password into an encryption key is deliberately slow, so that anyone who steals a vault can only make a limited number of guesses per second. Bitwarden runs your master password through PBKDF2 600,000 times by default, and lets you switch to Argon2id, a newer method that also demands a lot of memory from anyone trying to guess. 1Password adds a second ingredient: a 34-character Secret Key with 128 bits of entropy that is generated on your device and never sent to the company. Without it, a stolen vault can't be attacked by guessing the password alone.
None of this helps if your master password is "Summer2024!". Make it long. A string of four or five unrelated words is easier to remember than a jumble of symbols and much harder to crack.
What the LastPass breach teaches
In 2022, attackers stole a backup of LastPass customer vaults. According to the company's own incident notice, the usernames, passwords and notes inside were still encrypted, but the website addresses were not, and neither were names, email addresses and billing details.
The encryption held for people with strong master passwords. It didn't for everyone. Blockchain analysts at TRM Labs have traced more than $35 million in cryptocurrency stolen from users whose vaults were cracked, most of it moved in late 2024 and 2025. In November 2025 the UK data protection regulator fined LastPass £1,228,283 over the security failures behind the breach.
We take three lessons from it. A password manager is only as strong as your master password. The best designs encrypt everything, including the list of sites you use. And a breach at your provider is a reason to change your most valuable passwords even if the vault "stayed encrypted".
It isn't a reason to go back to reusing passwords. A single leaked password reused everywhere does more damage, more often, than a well-encrypted vault.
The password rules have changed
If your office still makes you add a symbol and change your password every 90 days, it's following advice the US standards body has abandoned. NIST's digital identity guidelines, revised in August 2025, say that a password used on its own must be at least 15 characters, that services shouldn't impose composition rules like "one uppercase letter and one number", and that they shouldn't force periodic changes unless there's evidence of a compromise. The same document says services must allow password managers and autofill.
In other words: length beats complexity, and the right tool for length is a password manager.
Browser, phone or a dedicated app?
You may already have a password manager without having chosen one. Apple's Passwords app has been built in since iOS 18 and macOS Sequoia and syncs through iCloud Keychain; on a Windows PC it works in Chrome and Edge through iCloud for Windows. Google Password Manager is built into Chrome and Android, flags compromised passwords and offers optional on-device encryption.
These hold up well in practice. The UK's National Cyber Security Centre says saving passwords in your browser is safe on your own devices and the easiest option for most people, as long as you don't do it on shared computers.
A dedicated manager earns its place when you mix platforms. An iPhone with a Windows laptop and Firefox, say, or a family where half the phones are Android. It also helps if you want to share a few logins with a partner, or keep things like passport numbers and Wi-Fi codes in the same encrypted place.
The options compared
We compared the free and paid plans, the security design each company documents, and whether independent audits are public. The table shows the practical differences.
| Password manager | Paid plan | Free option | Passkeys | Where your vault is kept |
|---|---|---|---|---|
| BitwardenEditors' pick | $19.80 a year (Premium) | Unlimited passwords and devices | Yes, free plan included | Bitwarden's servers, encrypted |
| 1Password | $3.99 a month, billed yearly | No, 14-day trial | Yes | 1Password's servers, encrypted |
| Proton Pass | $35.88 a year (Pass Plus) | Unlimited logins and devices | Yes, free plan included | Proton's servers, encrypted |
| Apple Passwords | None, it's free | Built into iOS 18 and macOS Sequoia | Yes | iCloud Keychain |
| Google Password Manager | None, it's free | Built into Chrome and Android | Yes | Your Google Account |
| KeePassXC | None, it's free | Open source desktop app | Yes | A file on your own computer |
Prices are US list prices for one person, before tax, as shown on each vendor's site on September 24, 2026. 1Password charges $2.99 a month for the first year to new customers.
One name you might expect is missing. Dashlane ended its free plan on September 16, 2025, and now sells paid plans only, after a 14-day trial. If you're on it and happy, there's no reason to move. If you're starting fresh, the options above cover the same ground.
Which one we'd pick
Bitwarden gets our pick because it removes the usual reasons not to start. The free plan has no limit on passwords or devices, the code is public, and the company lists audits from several outside firms in 2025, including a cryptography review by a team at ETH Zurich. It isn't the most polished app. 1Password is nicer to use, and its Secret Key design is a real security advantage, but it has no free plan.
What we like
- Free plan with unlimited passwords and devices
- Code is public and was audited by several outside firms in 2025
- Lets you switch to Argon2id, a stronger way of protecting your master password
- Premium is $19.80 a year, one of the cheapest paid plans
What to know
- Default settings are fine but not the strongest available; it's worth two minutes in the security settings
- Like every zero-knowledge service, it can't recover your vault if you forget the master password
Setting one up without locking yourself out
Moving to a password manager takes an evening, not a weekend, if you don't try to fix everything at once.
- Pick the master password first. Four or five random words, written on paper and kept at home until you know it by heart.
- Turn on two-step verification for the password manager account itself, and set up whatever recovery option it offers.
- Import what your browser already knows. Every major manager can import saved browser passwords. Then turn off saving in the browser so you don't end up with two lists.
- Fix the important accounts first: email, bank, phone carrier, and anything that can reset other passwords. Give each a new generated password.
- Change the rest as you go. Each time you sign in somewhere with an old password, let the manager generate a new one.
Passkeys fit into the same routine. A passkey replaces the password with a cryptographic key that stays on your device and is unlocked with your fingerprint, face or PIN, and it can't be phished the way a password can. The FIDO Alliance estimated in May 2026 that there were about 5 billion passkeys in use. When a site offers one, accept it and let your manager store it.
Questions readers ask
What happens if my password manager company gets hacked?
With a zero-knowledge manager, the attackers get encrypted vaults they can't open without each user's master password. That's why a long, unique master password matters: it's the only thing standing between a stolen vault and your accounts. Change your most important passwords anyway if your provider reports a breach.
Is it safe to save passwords in my browser?
On your own devices, yes. The UK's National Cyber Security Centre says it's a safe and easy option. Don't do it on shared or public computers, and protect the account that syncs them (your Google or Apple account) with two-step verification.
What if I forget my master password?
Usually the company can't reset it, because it never had it. Set up whatever recovery option your manager offers on day one, and keep a written copy of the master password somewhere physically safe at home.
Do passkeys make password managers pointless?
No. Passkeys have to be stored somewhere too, and password managers are where most of them live. For the many sites that still only take passwords, you still need a manager.
Should I pay for a password manager?
Only if a free option is missing something you need, such as sharing with family or support for every device you own. Bitwarden, Proton Pass and the built-in managers are all free for one person.