By J. Mesa
You have more than a hundred online accounts. You can’t remember a hundred strong passwords, so you reuse five or six. Criminals know this. They take passwords stolen from one breached website and try them on your email, your bank, and your payroll system. A password manager ends that problem for a few dollars a month.
What is a password manager?
A password manager is an app that creates, stores, and fills in a different password for each of your accounts. It keeps them in an encrypted vault. You unlock the vault with one master password, and the app handles the rest.
You install it on your computer and phone and add its extension to your browser. When you sign up for a new account, the manager generates a long random password and saves it. When you return to that site, the manager fills it in. You never type the password, and you never need to know it.
Is a password manager safe?
Yes, and it is far safer than the alternatives most people use: reused passwords, a spreadsheet, sticky notes, or the same base word with a different number on the end.
Reputable password managers use a zero-knowledge design. The app encrypts your vault on your own device with a key derived from your master password. The company stores only the scrambled result. Its employees can’t read your passwords, and a thief who steals the company’s servers gets encrypted data.
Putting every password in one place sounds risky. Compare the real risks. With reuse, one breach at any website you ever joined exposes the password to all your accounts. With a manager, an attacker needs your encrypted vault, your master password, and your second factor.
What happens if the password manager gets hacked?
It has happened. In 2022, attackers stole encrypted customer vaults from LastPass. Customers with long, unique master passwords stayed protected by the encryption. Customers with short or reused master passwords faced real exposure, because attackers could guess at those vaults offline for as long as they liked.
Three lessons came out of that breach:
- Your master password carries the weight. Make it long.
- Turn on multi-factor authentication for the vault.
- Choose a vendor that publishes independent security audits and tells customers the truth after an incident.
How do I choose a password manager?
Look for these features:
- Zero-knowledge encryption, described in public documentation
- Independent security audits, published each year
- Multi-factor authentication for the vault, including support for security keys
- Apps for every device you use
- Breach monitoring that flags weak, reused, and exposed passwords
- Secure sharing, so you stop sending passwords by text and email
- For a business: an admin console, shared team vaults, and the ability to remove a departing employee’s access
Well-regarded choices include 1Password, Bitwarden, Dashlane, and Keeper. Bitwarden offers a capable free tier for individuals. Business plans from these vendors run about $4 to $8 per user per month.
Are browser password managers good enough?
The password managers built into Chrome, Edge, Safari, and Firefox beat reuse, and they improved a lot over the last few years. For a household, they do the job.
For a business they fall short. They tie passwords to an employee’s personal browser profile. They offer weak controls for sharing a login among three people, no central view of weak passwords across the company, and no clean way to take access back on an employee’s last day. A dedicated business password manager gives you those controls.
How do I create a strong master password?
Use a passphrase: four or five random words. Roll dice against a word list or let the manager generate one. Length beats complexity, so a 25-character passphrase of unrelated words beats an 8-character jumble of symbols.
Follow three rules.
- Use the master password nowhere else.
- Do not store it in the vault it unlocks, in an email, or in a phone note.
- Write it on paper along with your recovery code, and keep that paper in a safe or a locked drawer. Most vendors can’t reset a forgotten master password, because they never knew it.
What if I forget my master password?
Plan for this before it happens. Most managers provide an emergency kit or recovery code at signup. Print it. Family and business plans let an administrator or a trusted contact recover an account. Set that up on day one. A business should keep at least two administrators, so one person’s vacation or resignation does not lock the company out of its own accounts.
How do I roll out a password manager at work?
Roll it out in an afternoon and finish the cleanup over a month.
- Pick the product and buy a business plan.
- Create shared vaults by team: finance, operations, social media, IT.
- Require multi-factor authentication for every user.
- Hold a 30-minute session. Show the staff how to install the app, save a login, and share one. Cover it again in your security awareness training.
- Import saved passwords from browsers, then turn off the browsers’ built-in password saving.
- Start with the accounts that matter most: email, banking, payroll, accounting, and the domain registrar. Replace each password with a generated one.
- Use the manager’s report to find reused and weak passwords, and fix ten a week.
- Add vault removal to your offboarding checklist, and change the shared passwords a departing employee knew.
Write the expectation into your password policy: staff store work credentials in the company password manager and nowhere else.
What should I never do with a password manager?
- Do not leave the vault unlocked on a shared or unattended computer. Set it to lock after a few minutes of inactivity.
- Do not approve a login prompt you did not start.
- Do not type your master password into a page you reached from an email link. Open the app yourself.
- Do not skip the recovery setup.
- Do not keep the old spreadsheet “just in case.” Delete it and empty the trash.
Does a password manager stop phishing?
It helps more than most people expect. The manager matches each saved login to the exact web address where you created it. When a phishing email sends you to a look-alike site, the manager finds no match and offers nothing to fill. That silence is your warning. If the manager does not offer your password on a page that looks like your bank, stop and check the address bar.
A password manager does not stop every attack. A criminal who tricks you into reading a code over the phone can still get in. Pair the manager with multi-factor authentication and trained people.
Should I store my authenticator codes in the password manager?
Many managers can generate the six-digit codes too. For most accounts, that convenience is fine and still far better than no second factor. For your most important accounts, such as email, banking, and the password manager itself, keep the second factor separate: an authenticator app on your phone or a hardware security key.
Your next step
Pick a password manager this week and move your email, banking, and payroll logins into it first. Cerberus Cybersecurity writes password and access policies and trains staff to follow them. See our services or contact us to get started.