The advice “use a unique password on every site” is unachievable without a tool. An ordinary person has thirty to forty accounts; remembering forty random strings is impossible, and any scheme like “a base word plus the site name” collapses the moment one password surfaces in a leak — the scheme is visible in it.
A password manager removes that impossibility: you remember one password and it remembers the rest.
What you get
Uniqueness without effort. Every site gets its own random password that you never see or type. A breach of one service stops affecting the others.
Protection against fake sites. An underrated feature: the manager fills a password only on the domain it was saved for. On a page that looks genuine but sits at a different address the field stays empty — a warning more reliable than your own attention.
Shared access. A shared account password is passed through the vault rather than a message that stays in the chat forever.
- Available to anyone at an unlocked computer
- Tied to one browser on one device
- No sharing: the password has to be sent
- No check against breach databases
- The vault is closed by a master password and a second factor
- Synced across every device
- Sharing is granted and revoked in one action
- Warns about reuse and leaks
Cloud or local
Cloud synchronises the vault between devices through a server. Data is encrypted before it leaves, and the service does not know your master password. Upside: works everywhere with no setup. Downside: you rely on someone else’s infrastructure and its availability.
Local keeps an encrypted file with you. Synchronisation is your job — a cloud drive or manual copying. Upside: full control. Downside: backups and syncing are on you, and that is where data is usually lost.
A practical rule: if you are not confident you make regular backups, take the cloud one. A lost vault is worse than a theoretical risk.
The master password
It is the only password you keep in your head, and everything else rests on it. Its requirements differ from ordinary ones.
It must be typeable. You enter it several times a day, so a random twenty-character string is inconvenient here. Take a passphrase of seven words: about 77 bits, typed without mistakes.
It cannot be recovered. That is not a flaw but a consequence of encryption: the service does not hold your key and physically cannot decrypt the vault. Forget the master password and the contents are gone. Write it on paper and keep it where you keep documents.
The vault needs a second factor. The master password protects the contents; the second factor protects account access.
Moving from a browser
A browser vault is already better than a text file, but it has two weaknesses: passwords are available to anyone who reaches an unlocked computer, and they are tied to one browser.
The move looks like this. Export passwords from the browser to a file and import them into the manager. Then delete the exported file — it sits unencrypted in your downloads folder and will outlive the computer. After that turn off password saving in the browser, or you will maintain two databases at once.
Change the passwords gradually afterwards, as you log into sites rather than all at once. Start with email, banking and government services, and check the old ones against breach databases to see what to change first.