How a password manager actually helps

Everyone knows they should use a different strong password for each account. Almost nobody can do it from memory. So people reuse a few simple ones, and that is where the trouble starts.

Why reuse is risky#

When a website is breached, the stolen passwords often end up in lists that attackers try on other sites. If you used the same password on your email and a shop, a leak at the shop can open your email. And email controls the reset links for everything else.

A different password for every site means a leak in one place stays in that place.

What a password manager does#

A password manager is an app that stores all your passwords in an encrypted vault. You remember one strong master password, and it handles the rest.

• It creates long random passwords for each site.
• It fills them in for you, on your phone and computer.
• It can warn you if a password appears in a known breach.

You no longer need to remember anything except the master password, so the long random ones cost you nothing.

How to start#

1. Choose a well-regarded manager. Several built into phones and browsers are good enough to begin with.
2. Make a master password that is long. A few unrelated words strung together is easy to remember and hard to guess.
3. Turn on two-step verification for the manager and for your email.
4. Change your passwords gradually. Start with email, banking and anything that holds money or personal details.

A few cautions#

• Do not share your master password.
• Keep a recovery method somewhere safe, such as a written code in a drawer.
• Be wary of fake login pages. A manager helps here, because it only fills a password on the real site.

It takes an afternoon to set up. After that, the safe way and the easy way are the same way.