How a password manager keeps you safe

Most account break-ins do not involve clever hacking. They happen because someone reused a password, a site leaked it, and attackers tried the same email and password everywhere else. This is called credential stuffing, and a password manager is the most practical defence against it.

What it actually does

A password manager is an encrypted vault. You remember one master password; the app generates, stores and fills a different long random password for every account. The vault is encrypted on your device before it is synced, so the company storing it cannot read your passwords.

• Generation: random passwords like t7#Qm9!vLx2@pR4w that nobody can guess.
• Autofill: it only fills on the real domain, which quietly protects you from look-alike phishing sites.
• Breach alerts: many managers flag passwords that appear in known leaks.

Choosing a master password

Use a passphrase of four to six unrelated words, such as copper lantern orbit pickle meadow. Length matters more than symbols. Write it on paper and keep it somewhere safe at home until it becomes muscle memory.

Getting started in an afternoon

1. Install a reputable manager on your phone and computer. Your browser’s built-in one is a fine start.
2. Turn on two-factor authentication for the vault itself.
3. Change your email password first, then banking, then anything with a saved card.
4. Update the rest as you log in over the following weeks.

Takeaway: Reused passwords are the weak link. A manager makes every password unique without asking you to remember any of them.