A password manager is an app that creates, stores and fills in strong, unique passwords for every account you use, so you only need to remember one master password. It is one of the simplest ways to protect yourself from account takeovers, because a breach at one website no longer exposes your other accounts. This guide from the Glorvix.com team explains how password managers work, which features matter, and how to set one up.
Key takeaways
- A password manager lets you use a long, unique password for every account without memorizing them.
- Well-designed managers encrypt your vault so that the provider cannot read your passwords.
- Your master password and multi-factor authentication protect everything, so make both strong.
- Focus on features such as strong encryption, MFA support, autofill on all your devices and secure sharing.
- Risks exist, but for most people they are far smaller than the risk of reusing passwords.
Why reusing passwords is the real problem
Most people have dozens or even hundreds of online accounts. Remembering a different strong password for each one is close to impossible, so people reuse the same few passwords or make small variations of them.
That habit is risky. When a website suffers a data breach, criminals try the leaked email and password combinations on other sites, a technique often called credential stuffing. If you reuse passwords, one breach can unlock your email, banking and work accounts.
CISA advises people to use strong passwords that are long, random and unique for each account, and it points to a password manager as an easy way to do that.
What a password manager is and how it works
A password manager stores your login details in an encrypted “vault”. You unlock the vault with a single master password, often combined with a second factor or your device’s fingerprint or face unlock.
Encryption and the master password
Well-designed password managers encrypt your vault on your own device before anything is synced. This is often described as a zero-knowledge design, meaning the provider stores only scrambled data and cannot read your passwords. The trade-off is that if you forget your master password, the provider may not be able to recover your vault, so recovery options matter.
Generating and filling passwords
When you create a new account, the manager can generate a long random password and save it automatically. When you return to that site, it fills in the login for you. Many managers only autofill on the exact website the password was saved for, which also helps protect you from look-alike phishing sites.
Syncing across devices
Most password managers sync your vault between your phone, computer and browser. Some keep the vault only on your device instead, which gives you more control but means you handle syncing and backups yourself.
Features to look for
The Glorvix.com editorial team does not recommend specific brands, because the right choice depends on your devices, budget and whether you need it for a team. Instead, compare options on these features:
- Strong encryption and a zero-knowledge design, ideally backed by independent security audits that the provider publishes.
- Multi-factor authentication to protect the vault itself, including support for authenticator apps or security keys.
- Cross-platform support for every operating system and browser you actually use.
- A password generator with control over length and character types.
- Breach and weak password alerts that flag reused or exposed passwords.
- Secure sharing for family members or colleagues, with the ability to revoke access.
- Account recovery options such as a recovery code or trusted emergency contact.
- Passkey support, since more websites now offer passwordless sign-in.
Businesses should also look for admin controls, such as the ability to manage team members and remove access when someone leaves. That fits into the wider basics covered in our small business cybersecurity guide.
How to set up a password manager
Setting up a password manager takes an hour or two at first, then becomes part of your normal routine. The steps below work for most products.
| Step | What to do | Tip |
|---|---|---|
| 1. Choose a manager | Compare options against the features above | Check that it works on all your devices |
| 2. Create a master password | Use a long passphrase of several random words | Do not reuse it anywhere else |
| 3. Turn on MFA | Protect the vault with an authenticator app or security key | Store backup codes somewhere safe and offline |
| 4. Save recovery details | Set up the recovery code or emergency access option | Keep a printed copy in a secure place |
| 5. Install everywhere | Add the app and browser extension on each device | Turn off your browser’s separate password saving to avoid confusion |
| 6. Import or add passwords | Import saved browser passwords or add logins as you use them | Delete any exported files once the import is done |
| 7. Fix weak and reused passwords | Use the health report to change risky passwords | Start with email, banking and work accounts |
You do not need to change every password on day one. Updating your most important accounts first, then fixing others as you log in, is a realistic approach that still makes a big difference.
Creating a strong master password
Length matters more than complexity. US federal guidance in NIST Special Publication 800-63B favors longer passwords and discourages forced periodic changes and arbitrary composition rules. A passphrase of several unrelated words is long, hard to guess and still possible to remember.
Risks and how to reduce them
No tool is risk-free, and it is fair to ask whether putting all your passwords in one place is a good idea. For most people, the answer is yes, as long as you manage the main risks:
- Weak master password. Anyone who guesses it gains everything, so make it long and unique, and add MFA.
- Losing access. Forgetting the master password can lock you out permanently. Set up recovery options when you first create the account.
- Provider breaches. Encrypted vaults limit the damage, but a strong master password is what keeps stolen vault data useless.
- Infected devices. Malware on your computer could capture what you type. Keep devices updated and avoid unlocking your vault on shared or public computers.
- Phishing for the master password. Only enter it in the app or extension itself, never on a page reached through an email link.
Compared with reusing passwords or keeping them in a notebook, spreadsheet or unprotected file, a well-configured password manager is a significant improvement.
Password managers and the rest of your security
A password manager works best alongside other good habits: MFA on important accounts, automatic updates and a healthy suspicion of unexpected messages. Similar principles apply to digital assets, as covered in our guide to crypto wallet security, where recovery phrases need the same kind of care.
You can find more practical guides in our tech section, and our business articles cover the wider side of running a small company. At Glorvix.com we aim to keep these guides clear, current and brand-neutral.
Frequently asked questions
Are password managers safe to use?
For most people, yes. Reputable password managers encrypt your vault so that the provider cannot read it, and the overall risk is much lower than reusing passwords across sites. Safety depends heavily on your setup, so use a long, unique master password, turn on multi-factor authentication and keep your devices updated.
What happens if I forget my master password?
Because many password managers cannot read your vault, they may not be able to reset your master password for you. That is why recovery options matter. Set up a recovery code, emergency contact or similar feature when you create your account, and store any recovery information in a secure offline place.
Is the password manager built into my browser good enough?
Built-in browser password managers are far better than reusing passwords, and they can be a reasonable starting point. Dedicated password managers often add features such as cross-browser support, secure sharing, breach alerts and more detailed recovery options. Choose based on the devices and browsers you use and whether you share accounts.
Should a small business use a password manager?
Yes. A business password manager helps every team member use strong, unique passwords and lets you share logins securely without sending them by email or chat. Admin controls also make it easier to remove access when someone leaves, which is an important part of keeping company accounts and customer data protected.
