Quick answer
One protected vault, different password for every account.
A password manager stores encrypted login records and unlocks them with a master password, device authentication, or both. It can create random passwords, fill the correct credential only on the matching website, flag reuse, and increasingly store passkeys and MFA-related data.
Why password managers exist
People have more accounts than they can reasonably secure from memory. Without a manager, the common fallback is reuse: one or a few memorable passwords protect email, shopping, work, banking, and social accounts. When one service is breached, attackers test the exposed username and password elsewhere in a credential-stuffing attack.
A manager changes the task. You remember one strong vault secret and let the software create distinct credentials for the rest. NIST notes that managers improve security principally by generating unique, long passwords and storing them in an encrypted vault.
What happens inside the vault
Exact designs differ, but a modern manager typically derives an encryption key from your master password and other account or device secrets. The vault is encrypted before or as it is synchronized. Providers describe this with terms such as end-to-end or zero- knowledge encryption, but those labels are not enough by themselves: evaluate the published design, recovery model, audits, incident history, and what metadata remains visible.
Core features worth evaluating
- Generator: long random passwords with adjustable site compatibility
- Autofill: domain-aware filling that reduces typing and some phishing risk
- Cross-device access: supported browsers, operating systems, and offline behavior
- Import and export: a practical migration path in and out
- Recovery: a documented process that balances access and security
- Sharing: controlled family or team access without copying secrets into chat
- Health alerts: duplicate, weak, old, or breached credential reports
- Passkeys: creation, storage, synchronization, and portability
Does putting everything in one place create risk?
Yes. A vault is valuable, and compromise of its master secret, recovery channel, device, browser extension, or provider can have a large impact. The alternative—reused credentials scattered across accounts—also creates concentrated risk, but with fewer controls and little visibility.
Reduce vault risk with a long, unique master passphrase; strong MFA or a security key; current apps and extensions; protected recovery material; device encryption; and a tested export or emergency-access plan. Never reuse the vault password anywhere else.
A careful setup sequence
- Choose a provider and plan. Confirm platform support, export, recovery, and sharing before importing.
- Create the master passphrase. Make it long, unique, and memorable without using a familiar quote.
- Enable strong MFA. Save backup codes outside the vault in a protected location.
- Import carefully. Delete unencrypted export files after verifying the migration.
- Replace reused credentials. Start with email, financial, identity, work, and cloud accounts.
- Practice recovery. Understand what happens if you lose a device, forget the master password, or leave a family or team.
What should you compare?
Avoid choosing on feature count or commission alone. Our password-manager comparison looks at security design, device support, sharing, recovery, migration, breach tools, and fit for individuals, families, and small teams. Current 1Password and NordPass coverage is explicitly documentation-based until hands-on tests are added.