Password managers: why you need one and how to choose
Reusing passwords is the single biggest account-security risk. A password manager fixes that. Here is why, how to choose one, and how to migrate safely.
Why you need a password manager
Most people reuse a handful of passwords across dozens of sites. When one site is breached, attackers try those credentials everywhere. This is credential stuffing, and it is the most common account takeover method.
A password manager generates a unique, long, random password for every account and stores them encrypted. You remember one strong master password; the manager handles the rest.
This eliminates reuse and makes phishing less effective, since the manager only fills credentials on the correct domain.
How to choose
Look for: strong encryption (AES-256 or XChaCha20), zero-knowledge architecture, independent security audits, and open-source code if possible.
Consider where passwords are stored: cloud-synced (convenient, requires trust in the provider) vs local (more control, manual sync).
Check platform support: desktop, mobile, browser extension, and CLI if you need it.
Avoid browser-built-in managers for high-value accounts; they are convenient but tied to the browser's security model.
- Bitwarden: open source, audited, generous free tier
- KeePassXC: local, open source, no cloud
- 1Password: polished, family plans, audited
- Proton Pass: privacy-focused, from Proton
- Avoid: unknown or unaudited services
Migrating safely
Export your existing passwords (from browser or old manager) and import them. Delete the export file immediately after.
Change passwords for your most important accounts first: email, banking, primary social, password manager itself.
Enable 2FA on the password manager account using an authenticator app or hardware key.
Store the master password somewhere safe offline, such as a written copy in a secure location.
Daily use
Use the browser extension to fill credentials. Verify the domain before filling, especially on login pages reached via email links.
Generate new passwords for every new account; never reuse.
Run the manager's security audit to find reused, weak, or breached passwords, and fix them.
Keep the manager and extensions updated.
What this site offers
Our tutorials cover password manager setup and two-factor authentication with actionable checklists. The privacy checkup and score tools help you track improvements.
No passwords or account data are collected by this site. All analysis runs locally in your browser.