What Is a Password Manager and Should I Use One?

Most people either use the same password for everything, or have a notebook full of them. Both approaches have serious problems. A password manager solves this, but a lot of people aren’t sure what one is or whether they can trust it.

Here’s a plain English explanation.

What is a password manager?

A password manager is an app that stores all your passwords securely in one place. You only need to remember one password: the master password to open the manager. It handles everything else.

When you visit a website you’ve saved, the manager automatically fills in your username and password. When you create a new account, it can generate a long, random, secure password for you and save it automatically.

Why bother?

The problem with reusing passwords is that if one site gets hacked (and sites get hacked all the time), hackers will try your email and password combination on every other major site. Banks, email, Amazon, everything. This is called credential stuffing and it’s extremely common.

A password manager means every site gets a different password. A breach on one site doesn’t affect any other.

It also means you can have genuinely strong passwords: long, random strings of characters, without having to remember any of them. Xk9#mP2qL8vR is a much stronger password than Falkirk1975, and with a manager you never have to type it yourself.

Which password manager should I use?

There are several good options. Here are the most widely recommended:

Built-in options (free, easiest to start with)

Apple Keychain: if you use an iPhone and a Mac, this is built into both and syncs automatically via iCloud. It generates strong passwords, stores them, and fills them in automatically in Safari. The downside is it works less well with non-Apple browsers and devices.

Google Password Manager: built into Chrome and Android. Works well if you use Google Chrome and an Android phone. Less useful if you use a mix of devices and browsers.

Both of these are free and require no setup beyond using them. If you’re already in one ecosystem, start here.

Dedicated apps (more control, work across everything)

Bitwarden: free for personal use, works on all devices and browsers, open-source (meaning its security has been independently reviewed). Good choice if you want something more capable or use a mix of Apple and non-Apple devices.

1Password: around £30 per year, very well regarded, works across all devices and browsers, has good family sharing options.

NordPass: similar to 1Password, slightly cheaper, also well regarded.

For most people, starting with the built-in option on their phone is the right call. Only switch to a dedicated app if you need it to work across multiple different types of device.

Is it safe to put all your passwords in one place?

This is the most common concern, and it’s a fair question. The answer is yes, when you use a reputable password manager, for a few reasons:

1. Your passwords are encrypted before they leave your device. The company can’t read them even if they wanted to.
2. A single strong master password plus two-factor authentication on the manager itself is far more secure than weak, reused passwords across dozens of sites.
3. Reputable managers (especially open-source ones like Bitwarden) have been independently audited.

The risk of reusing passwords across sites is much greater than the risk of using a well-regarded password manager.

How to start

1. Choose a manager (Apple Keychain or Google Password Manager are the easiest starting points)
2. Set a strong master password. A phrase of four or five random words is easier to remember than a complex string and just as secure (e.g. “correct-horse-battery-staple”)
3. Start saving passwords as you log in to things. Don’t try to change everything at once
4. Gradually update old, weak, or reused passwords to generated ones as you go

You don’t need to sort all your passwords in one afternoon. Building the habit gradually works fine.

What about two-factor authentication?

A password manager is most effective combined with two-factor authentication (2FA) on your most important accounts: email, banking, and any account with payment details saved. Two-factor authentication means that even if someone gets your password, they still can’t log in without a code from your phone.

Most major services offer this under Settings > Security > Two-factor authentication or similar. Worth enabling on your email account first, as email is the key to resetting everything else.

---

If you’d like help setting up a password manager or getting your online accounts properly secured, I help with online safety and password setup across Falkirk and Central Scotland.

Find out more about password help in Falkirk, or call 07944 156 453. No fix, no fee, 7 days a week.