Password managers, explained
One strong master password unlocks a vault that remembers every other password — so each account gets a unique, uncrackable one. It's the highest-impact security upgrade a normal person can make.
The problem it solves
Reused passwords are how accounts actually get hacked: one site leaks, and attackers try that email-password pair everywhere. A manager gives every site its own random password, so a leak at one site is contained to that site.
- You remember one master password; it remembers hundreds.
- Autofill means logging in gets easier, not harder.
- Built-in generators create passwords no human would.
Is putting them all in one place safe?
Good managers use end-to-end encryption: your vault is scrambled with your master password before it leaves your device, so even the company can't read it. The real risk isn't the vault — it's a weak master password.
- Choose a long passphrase: four random words beat 'P@ssw0rd1'.
- Turn on two-factor authentication for the vault itself.
- Open-source, audited options (Bitwarden, KeePassXC) can be independently verified.
Picking yours
Bitwarden's free tier makes the choice easy for most people. Pay for 1Password if polish and family features matter; go KeePassXC if you want the vault as a local file you fully control.
- First manager / best value → Bitwarden (free, open source).
- Families & design-lovers → 1Password.
- No-cloud purists → KeePassXC.
- Already in the Proton ecosystem → Proton Pass.