Password manager

A password manager stores, generates and protects the credentials a person uses across many accounts, so that each one can be different and none of them has to be memorable.

That is the whole argument for it. The number of services that need a password has grown past what anyone can hold in their head, and the two things people do instead, reusing one password everywhere or building small variations of it, are precisely the two behaviours attackers count on.

What one does

Generates credentials nobody would choose. Long, random, different for every site, and never needing to be typed by hand.

Keeps them encrypted. The vault is protected by one master secret. Everything else is derived from it, which is why that one secret is the entire security of the arrangement.

Fills them in. Autofill is a security feature as much as a convenience one: a manager fills a credential only on the site it belongs to, so a lookalike domain gets nothing.

Syncs across devices. Which is what makes it usable, and which is also the part that has to be examined, because the vault is now somewhere other than the machine.

Holds the second factor, or does not. Some managers also store one-time codes. It is worth deciding deliberately whether both factors should live behind the same master secret.

What it is protecting against

The reuse problem, mostly. When credentials leak from one service, they get tried automatically against every other service, which is what credential stuffing is. A unique password per account turns that from a breach into a nuisance.

It also defeats the opposite technique, password spraying, where one predictable password is tried against many accounts, because generated credentials are not guessable in that way.

What it does not do on its own is stop somebody who already has a valid credential from using it. That is the job of multi-factor authentication, and the two are complementary rather than alternatives.

The honest limits

The master secret is a single point of failure. It has to be strong, it has to be protected by a second factor, and it is the one credential that genuinely has to be memorable.

The vault is a target. A store of everybody’s credentials is worth attacking, and vendors of these products have been attacked. What matters when reviewing one is where the vault is decrypted, what the provider can and cannot read, and what happens to the data if the account is lost.

Passwordless is the direction of travel. A passkey removes the shared secret entirely rather than managing it better, and where a service supports one it is the stronger option.

Where this shows up in an audit

The finding that keeps appearing is not that staff have weak passwords. It is that there is no sanctioned place to put a shared credential, so shared credentials end up in spreadsheets, in chat history and in code. Providing a managed vault is a control, and the absence of one is what pushes people towards the alternatives.