Somewhere in your browser right now there is a saved password. Maybe it's for the pharmacy loyalty card. Maybe it's something worse. The reason I'm fairly sure about this is that I keep finding the same thing when people hand me their phone and say "just fix it": a list of fifty-something accounts, and maybe six different passwords doing all the work.
That's the situation a password manager is supposed to solve. And it does. Mostly. But "mostly" is doing a lot of lifting in that sentence, and the people who sell you these tools tend to skate past the part where you have to trust somebody else with everything. So let's actually go through it. Password managers explained, honestly, including the parts that make me uncomfortable.
Key Takeaways
- A password manager stores your login credentials in an encrypted vault, unlocked by one master password that only you know.
- The vault is protected with strong encryption, so a breach typically exposes encrypted blobs and metadata, not your actual passwords in readable form.
- The real weakest point isn't the encryption. It's you, your master password, and the login page you trust.
- Downsides are genuine: lose your master password and you're locked out, and some banks block the copy-paste these tools rely on.
- Open-source tools with published security audits let you verify the code. Proprietary ones ask you to take their word for it.
Password managers explained: what they actually do
A password manager is a locked box with two jobs. It remembers credentials you'd otherwise reuse, and it generates credentials you'd never think of yourself.
The second job matters more than most people realize. When I first started using one, I set it to produce sixteen-character passwords with no recognizable words. Six months later I checked what I'd accumulated: over 140 distinct passwords, none of which I could possibly memorize, all of which were different. That number is the whole point. Reuse is the thing attackers count on, because one leaked database from a forgotten forum becomes a key to your email.
How do password managers work?
Here's the mechanism, stripped down. Your passwords get encrypted on your own device using a key derived from your master password. What leaves your machine is ciphertext. The vendor stores that ciphertext, syncs it across your devices, and hands it back when you unlock the vault.
The design most reputable tools aim for is called zero-knowledge. The idea: the company cannot decrypt your data even if it wanted to, because it never sees the key. In theory. Whether that promise holds depends entirely on how the software was built, and that's where things get interesting.
How do you access a password manager?
Three ways, and you'll use all of them within a week:
- An extension inside your browser that fills fields automatically
- A phone app that prompts you with your face or fingerprint
- A desktop application with a search box that finds any entry in under a second
The friction is real at first. I'll admit I abandoned my first attempt after four days because typing a long master password every time felt absurd. Then I turned on biometric unlock and the whole thing clicked. Setup effort is front-loaded, and it drops off a cliff once configured.
Do password managers ever get hacked?
Yes. And anyone who tells you otherwise is selling something.
The distinction that matters is what leaked. Encrypted vault data is not the same as readable passwords, and a company's internal systems being breached is not the same as your credentials walking out the door. When I've gone back through the public incidents of the last several years, the pattern holds: stolen backups, exposed metadata, and encrypted blobs that attackers could not open at scale.
Metadata is not nothing. It can include which websites you have accounts on, when you last logged in, and roughly how many entries you store. That's a behavioral profile. It is not your bank password.
Which password managers have never been hacked?
I'd be lying if I gave you a list. Nobody can credibly guarantee a service has never been compromised, and absence of disclosure is not proof of safety.
What you can evaluate is architecture and transparency. Open-source tools like Bitwarden and KeePassXC publish their code, and independent auditors examine it. KeePassXC keeps the database as a local file you control rather than syncing it to someone's cloud. Cloud-synced services offer convenience and a larger attack surface. Neither position is automatically correct; they trade different risks.
| Model | Where your vault lives | Trade-off |
|---|---|---|
| Local file (KeePassXC) | On your machine only | Full control, but syncing is your problem |
| Open-source cloud (Bitwarden) | Encrypted on vendor servers | Convenient, code is publicly auditable |
| Proprietary cloud | Encrypted on vendor servers | Polished apps, you trust their claims |
| Browser built-in | Tied to your browser account | Zero setup, weaker cross-device features |
What are the real downsides of using a password manager?
Nobody in the marketing materials leads with these. So here they are, unsorted.
The master password is a single point of failure. Forget it, and with a properly built tool there is no recovery email, no support ticket, no reset link. Your vault is mathematically unopenable. I watched a colleague go through this two years ago and it cost him an entire weekend of account-by-account recovery. Everyone else in the office set up an emergency kit the following Monday.
Some financial institutions actively block the tooling. Plenty of banks disable paste functionality in their login fields, which defeats the copy-and-paste flow these managers rely on. I've encountered this myself and the workaround is ugly: type the generated password by hand, slowly, from a second screen. Annoying is not the same as broken, but it's worth knowing before you buy.
Vendor dependency is a real thing. If a company changes its pricing or gets acquired, your vault comes along for the ride. Export formats exist, but migrating hundreds of entries is not a pleasant afternoon.
And then there's the phishing angle, which I think is the most underrated risk.
The phishing problem
Password managers fill credentials based on the domain. That protection is genuinely good. But if you train yourself to type your master password into a login page reflexively, a convincing fake of that page can harvest it.
This is why I'd argue the single most dangerous habit is entering your master password on autopilot. If you've enabled biometric unlock and you're suddenly being asked to type the master password, stop and look at the address bar. That instinct is worth more than any feature in the brochure.
Why don't older adults use password managers?
I set my father up with one about eighteen months ago. He stopped using it within a week. His stated reason was "I don't trust it," but after a long conversation the real objections came out, and they were more specific than I expected.
- Perceived complexity. The install and import process took me twenty minutes; for him it looked like a lifetime of re-learning.
- Aversion to storing financial credentials somewhere unfamiliar, when the paper notebook had never failed him.
- Cost. The free tiers are limited, and paying an annual subscription for something invisible is a hard sell.
- Genuine confusion about what the tool can and cannot see. He thought it meant a company now had his bank password.
That last one is the killer, and it's a communication problem, not a capability problem. Zero-knowledge is a concept, and concepts need explaining. What worked in the end was a local-file tool with no cloud component, plus a printed emergency sheet in a drawer. Adoption went from zero to steady. It just required matching the tool to the fear instead of arguing with the fear.
So are they really secure?
More secure than what you're doing now. That's the honest comparison, and it isn't close.
Reusing one password across a dozen sites means a single leaked database unlocks your email, your cloud storage, and your shopping history. A manager eliminates that specific failure mode entirely. It does not eliminate every risk, and the ones it leaves behind, the master password, the phishing page, the vendor you've chosen to trust, are the ones that require your attention rather than a subscription.
If you're deciding today: pick a tool with a published audit, turn on two-factor authentication for the vault itself, write your master password somewhere physical that isn't your desk drawer at the office, and set up whatever emergency access the product offers. Then stop thinking about it.
The uncomfortable truth is that the question isn't whether you can trust a password manager. It's whether the alternative, your memory plus a bit of reuse, deserves more trust. I've seen the answer to that one play out, and it's never pretty.
