2.2 Password managers

Centralisation as both solution and risk

A password manager keeps your logins in one place, protected by a single master password.

That fixes a real problem. Asked to remember dozens of logins, people reuse passwords or pick weak ones. A manager lets you use long, unique passwords everywhere without memorising any of them.

The catch: if the manager is compromised, an attacker may get far more than one account. So the question is not whether to centralise, but how to get the everyday benefits while containing the downside.

What password managers protect against

The big one is credential stuffing. Criminals take email and password pairs from one breach and try them on other sites. With a manager, every password is unique, so if a shopping site leaks your details, that password will not unlock your bank or your email.

Managers also stop casual, low-effort attacks. A long, random password is not realistically guessable and has no pattern for attackers to lean on. And because the manager becomes the proper home for secrets, there is less temptation to write passwords on paper or keep them in insecure notes.

Myth: a manager protects you from all phishing. Reality: it helps, but it is no magic shield.

• Some managers warn you when the website address does not match the saved login. Useful, but only if you notice the warning and you have a saved entry for the real site.
• Phishing on a real-looking domain can still fool people, especially on small phone screens.

Local vs cloud-based managers

Local managers keep the encrypted vault on your own device.

• No automatic sync unless you set it up yourself.
• Less dependence on a third party; appealing if you are wary of data on other people's servers.
• The trade-off: if your laptop is lost or dies and you have no copy of the vault, you may lose every password.

Cloud-based managers keep a copy of the encrypted vault on their servers and sync it across your devices.

• The design usually assumes the provider cannot see your passwords, because it does not have your master password. This is end-to-end encryption: the vault is encrypted on your device before upload.
• The trade-off: the provider becomes a high-value target. If it is breached and your master password is weak, attackers can try to crack your vault offline.

In practice it often comes down to how many devices you use. Work laptop, personal laptop and phone? Cloud sync saves copying files around. One computer? A local vault plus a manual backup may suit you.

Master password failure modes

The master password unlocks everything. Three ways it can go wrong:

1. You forget it. Most managers cannot reset it, because that would mean they could read your vault. Forget it and there is usually no recovery. Not a punishment; a design choice.

2. It is too short or too guessable. This is the single biggest practical weakness. Anyone holding your encrypted vault can try billions of guesses offline. The longer and more unique your master password, the harder that gets. A phrase of several unrelated words can be both usable and strong.

3. Someone captures it as you type. If malware on your computer records keystrokes, a strong master password does not help. Not a common day-to-day risk for most people, but real. One more reason to keep devices updated, avoid untrusted downloads and stick to reputable app stores.

Sync convenience vs exposure

Sync is lovely: save a password on your phone and it is on your laptop seconds later. It also means the vault lives in more places, so you are trusting several devices plus a sync service instead of one computer. Not bad in itself, just worth knowing.

Picture losing your phone on the bus:

• Phone locked, and the manager needs its own password or unlock: limited risk.
• No screen lock, or the manager left open: your vault may be exposed.

The fix is mundane: strong device lock, automatic locking, and a manager set to ask for a password or biometrics every time.

At work, a UK-specific wrinkle: some employers prohibit storing corporate credentials in personal tools. Putting work logins in a consumer manager can breach policy, however secure it is. Check what your employer allows, and if needed use an approved manager for work and a separate one for personal accounts.

Backups and disaster recovery

Backups are the quiet, unglamorous bit. Do them anyway.

Local vault? Make encrypted backups on a schedule: a second device, an external drive, or a protected cloud storage account. What matters is that you can restore the vault if a device fails.

Cloud manager? You are less likely to lose the vault, but sync does not help if you forget the master password. Some managers offer emergency access or recovery codes. They only work if you set them up in advance and keep the recovery material somewhere safe.

A sensible habit: a printed recovery code in a sealed envelope at home, or in a safe. That is not relaxing about security. It stops you locking yourself out at the worst moment, like a lost phone or a crash just before a holiday.

Passkeys and the shift beyond passwords

Passkeys are the biggest change to how we log in for a generation, and password managers have quietly become where most people will keep them.

How they work:

• a private key stays on your device or in your manager;
• the website holds a matching public key;
• when you sign in, your device proves it holds the private key without ever sending a reusable secret.

So there is nothing to leak in a breach, nothing to phish and nothing to reuse. In effect, it is the security benefit of a hardware key (see 2.4) built into the login itself.

Passkeys fix the two things passwords never could: phishing and reuse. A passkey is bound to the genuine website's identity, so a convincing fake login page captures nothing useful. That closes the phishing gap described earlier on this page.

Keep them in a cross-platform password manager rather than locked inside one company's ecosystem. That way they follow you across devices, and switching phone or laptop brand does not lock you out.

The old disciplines still apply: your master password and your recovery plan now protect your passkeys too.

The transition will be gradual and occasionally awkward:

• many sites still offer only passwords;
• some offer passkeys alongside a password that stays as a weaker fallback;
• account recovery is still maturing, and a poorly designed "forgot passkey" process can reintroduce exactly the risks passkeys remove.

So: adopt passkeys where offered for accounts that matter, keep your manager as the single home for passwords and passkeys, and treat it as a steady improvement rather than an overnight replacement. The central lesson stands: you are still centralising your secrets, and how well you protect and back up that store is what decides things.

Situations where a password manager is inappropriate

Sometimes a manager is the wrong tool.

Shared computers (a library, an internet cafe). You do not control the device, so you cannot know it is free of monitoring software. Installing a manager or opening your vault there is risky. Better to avoid logging into sensitive accounts at all.

High-risk lives that need separation. Journalists, activists or people escaping domestic abuse may need some accounts kept completely apart. A single vault can create unintended links between identities. Multiple vaults, different managers, or even a paper-based method for a limited set of accounts may fit better.

Organisational or legal rules. Certain regulated UK sectors require corporate credential storage and auditing. A personal manager might be convenient but could expose you to disciplinary or compliance trouble. Keep personal and professional logins separate and follow the rules that apply to your role.