Contents
In short
A password manager makes sense for almost everyone. The one built into your operating system or browser is enough for many people; a standalone product is mainly worth it across several platforms or for sharing in a family.
What is it?
A password manager generates random passwords, stores them encrypted and fills them in automatically on the correct website. You only remember one strong master password or unlock with your device.
Who is it useful for?
Anyone with more than a handful of online accounts – practically everyone.
What does it protect against?
- Reused passwords that open other accounts after a data breach
- Weak, guessable passwords
- Partly phishing: autofill only works on the genuine address
What does it not protect against?
- Malware on a device that is already compromised
- Typing a password manually into a fake site
- Losing the master password without a recovery route
What you can do for free
- 01Use the password manager built into your OS or browser
- 02Turn on reused/breached password checks in the settings
- 03Set up a recovery route for the manager's account
Setting up a password manager: a sensible start
- Choose a long, unique master password – for example a passphrase of several words
- Turn on MFA or a passkey for the vault
- Move your most important accounts first: email, platform account, banking
- Replace weak and reused passwords step by step
- Set up a recovery option and store it safely and separately
- Connect your other devices
- Include family only through the dedicated sharing or family feature
When is an extra product worth it?
A standalone manager can make sense if you switch between operating systems, want to share logins in a family or set up emergency access for relatives.
What to check when choosing
- End-to-end encryption and clear security documentation
- The vault itself protected with MFA or a passkey
- Export option so you are not locked in
- Emergency or legacy access if you want it
We deliberately name no products and publish no rankings.
Common mistakes
- Reusing the master password elsewhere
- Running the vault without a second factor
- Leaving old, weak passwords in the manager unchanged
Checklist
- I use a password manager – built-in or standalone.
- My email account has a unique password.
- The vault is protected with MFA or a passkey.
- I have written down a recovery route.
Frequently asked questions
Isn't it risky to keep everything in one place?
The risk is lower than with reused or written-down passwords – provided the vault is well protected and the device is up to date.
Is the browser's password store enough?
For many people, yes, as long as it syncs encrypted with your device account and that account has MFA.
Sources
Checked on 6 Oct 2026.