Updated September 2026. This guide replaces an older post on password managers versus writing passwords down. Plans and prices change — check each provider’s pricing page before you choose.
A password manager lets you use a different strong password for every account while remembering only one. It creates passwords for you, stores them in an encrypted vault and fills them in when you log in. This guide explains how password managers keep your data safe, compares good options for beginners — including free ones — and walks you through setting one up without locking yourself out.
Why reusing passwords is the real risk
When a website is breached, attackers try the leaked email and password combinations on other popular sites. If you reuse a password, one breach can unlock many of your accounts. Unique passwords stop that chain reaction — and a password manager is the practical way to have a unique password everywhere.
How a password manager keeps your passwords safe
- Encryption: your vault is encrypted before it’s stored. Reputable managers are designed so the company itself can’t read your passwords.
- One master password: it unlocks the vault. Make it long and don’t use it anywhere else.
- Password generator: creates long random passwords you never need to remember.
- Autofill that checks the website: the manager offers your saved login only on the site where you saved it. If it doesn’t offer to fill on a login page you expected, check the address — you might be on a fake site.
- Security alerts: many warn you about weak, reused or leaked passwords.
“Isn’t it risky to keep everything in one place?”
It’s a fair question. The vault becomes valuable, so you protect it with a strong master password and two-factor authentication. For most people that’s far safer than the alternative: reused passwords that an attacker can try everywhere after a single breach.
Password manager or a written list?
| Method | Protects against online attackers? | Main risks |
|---|---|---|
| Password manager | Yes, with unique passwords and 2FA | A weak or reused master password; malware on your device; forgetting the master password |
| Notebook kept at home | Yes, if every password is unique | Anyone in your home can read it; loss, fire or theft; no autofill, so no help spotting fake sites |
| Sticky notes or an unprotected file | Poorly | Visible to others; a file can be stolen by malware or synced somewhere unexpected |
| Memorising a few passwords | Only if they aren’t reused | People end up reusing or slightly changing the same password |
The verdict: a reputable password manager is the better choice for most people. A private notebook with unique passwords is still much better than reusing passwords. Paper is also the right place for one thing: your master password and recovery codes, stored somewhere safe.
Good password managers for beginners
| Option | Free plan (at time of writing) | Good fit if… |
|---|---|---|
| Bitwarden | Unlimited passwords on unlimited devices; low-cost Premium adds extras like emergency access and file attachments | You want a strong free plan that works on every device |
| Proton Pass | Unlimited logins and devices, plus a limited number of hide-my-email aliases | You like privacy features such as email aliases |
| 1Password | No free plan; a free trial | You’re happy to pay for a very polished app, including family sharing |
| Built-in: Apple Passwords or Google Password Manager | Free with your Apple or Google account | You mostly stay within one ecosystem and want the simplest start |
Built-in managers are much better than reusing passwords. A dedicated manager is more flexible if you use a mix of devices, such as an iPhone with a Windows PC.
Choosing any provider: pick an established company that publishes independent security audits, supports two-factor authentication and lets you export your data. Check its security history too — for example, LastPass disclosed a serious breach in 2022 in which encrypted vault backups were stolen.
Set one up in about 15 minutes
- Create your account on the provider’s official website or app store listing.
- Choose a master password. Use a long passphrase of several random words, for example four or five unrelated words. Length matters more than symbols. Don’t use song lyrics, quotes or personal details.
- Write it down and store it safely — at home, somewhere private — along with any recovery kit or recovery code the service gives you.
- Turn on two-factor authentication for the password manager account. See our two-factor authentication setup guide.
- Install the browser extension and phone app, and sign in on each.
- Import passwords saved in your browser using the manager’s import tool, then delete them from the browser so they aren’t stored in two places.
- Let it save new logins as you sign in to sites over the next few days.
What if you forget your master password?
With many password managers, the company can’t reset your master password for you, because it can’t decrypt your vault. Some offer recovery options such as a recovery code, a recovery kit or trusted emergency contacts. Set up whatever your provider offers on day one, and test your master password a few times in the first week.
Upgrade your most important accounts first
- Your main email account — it can reset every other password.
- Banking and payment accounts.
- Your Apple, Google or Microsoft account.
- Social media and work accounts.
- Shopping sites that store your card.
For each, use the generator to create a new password, save it, and turn on two-factor authentication where available. Your password manager’s security report can show which reused or weak passwords to fix next.
Best practices
- Never reuse your master password anywhere else.
- Keep devices and apps updated, and don’t install unknown software — malware on your device is a risk for any method.
- Lock the vault automatically after a short period of inactivity.
- Use passkeys where websites offer them. Most major password managers can store them.
- Be careful with urgent login emails. Our guide to spotting phishing attacks explains the warning signs.
Frequently asked questions
Are free password managers safe?
Reputable free plans, such as Bitwarden’s or Proton Pass’s, use the same encryption as their paid plans. The paid versions add extras rather than basic security. Avoid unknown apps without a security track record.
Are browser password managers good enough?
They’re a big improvement over reusing passwords, and they’re free. A dedicated manager works better across different browsers and operating systems and usually has more sharing and security features.
Is it safe to keep passwords on my phone?
Yes, in a reputable password manager app with a screen lock, two-factor authentication and up-to-date software.
How long should my master password be?
Long. A passphrase of several random words is both strong and memorable. Current US government guidance (NIST) favours length over forced complexity rules. See our guide to creating a strong password.
What happens if my password manager company is breached?
Well-designed vaults are encrypted so stolen data is useless without your master password — which is why a long, unique master password matters. If your provider announces a breach, follow its advice and change the passwords for your most important accounts.
Related guides
- How to create a strong password
- Two-factor authentication setup guide
- What to do when your data is exposed in a breach
- Cybersecurity essentials for beginners
