Passwords protect nearly everything you do online: your email, your bank, your photos, and your social media. Most people use the same handful of passwords everywhere, because remembering dozens of different ones feels impossible.
That habit is exactly what scammers count on. If one site you use gets hacked and your password leaks, criminals try that same password on your email and bank accounts next.
A password manager fixes this problem without asking you to memorize anything more than you do today. This guide explains what one is, how it works, the real pros and cons, and how to turn one on this week.
What Is a Password Manager?
A password manager is an app that creates, remembers, and fills in strong, unique passwords for every account you have, so you only need to remember one master password.
Think of it as a locked digital filing cabinet for your passwords. You open the cabinet once, with one strong password (or your fingerprint or face), and the app fills in the right password for whichever website or app you are using.
Plain talk: password manager
An app that stores your passwords in an encrypted (scrambled and locked) file, then types them in for you when you need them.
Password managers come in two main types: ones already built into your iPhone, iPad, or Android phone, and standalone apps you download separately.
How a Password Manager Actually Works
When you sign up for a new account, the password manager offers to create a long, random password for you, something like H7pMz2qLwT9x. You never have to type or remember it.
The next time you visit that site, the app recognizes it and fills the password in for you, often after you confirm with your fingerprint, face, or device passcode.
Everything is protected by encryption, which scrambles your data so it cannot be read without your master password or device passcode. Only you, and in some cases the company running the app, can open it.
Plain talk: master password
The one password you still have to remember. It opens all the others, so it should be long and not used anywhere else.
The Pros and Cons
| Pros | Cons | |
|---|---|---|
| Security | Stops password reuse, a top cause of account takeovers | Your master password becomes the one to protect |
| Convenience | Fills in passwords for you, on your phone or computer | Takes a week or two to get used to |
| Cost | Many good options are free | Some standalone apps charge a yearly fee |
The biggest benefit is simple: a password manager lets every account have its own strong password, without you memorizing any of them. The FTC’s guidance on protecting your accounts points to using a different password for each account as one of the most effective ways to limit damage when one site is hacked.
The main downside is trust. You are storing sensitive information in one place, so that place needs to be reputable and well built. That is a fair concern, and it deserves a direct answer.
Are Password Managers Safe? What About the LastPass Breach?
Yes, reputable password managers are safe for most people, and safer than reusing passwords, even though no system is completely risk-free.
In December 2022, the company behind the popular password manager LastPass confirmed that hackers had stolen a copy of customers’ encrypted password vaults, according to TechCrunch’s reporting at the time. That is a serious incident, and feeling uneasy about it makes sense.
Two things are worth knowing. First, the stolen data was encrypted, so opening it required cracking each customer’s master password, which is much harder when that password is long and unique. Second, the incident is a useful reminder of why your master password matters so much, not a reason to avoid password managers altogether. Going back to reusing the same weak password everywhere is a bigger risk than using a well built password manager with a strong master password.
Safety tip
Never reuse your master password anywhere else, and never type it into a link that arrived by text or email. Only type it directly into the password manager app itself.
Built-In Options: The Easiest Place to Start
Your iPhone and Android phone already include a free password manager. For most older adults, this is the best place to start, since there is nothing new to download and it is already connected to the device you use every day.
iPhone and iPad (Passwords, built on iCloud Keychain)
- Open Settings.
- Scroll down and tap Passwords.
- Turn on AutoFill Passwords and Passkeys, if it is not already on.
- Make sure your iPhone has a passcode set, since that passcode also protects your saved passwords.
Android (Google Password Manager)
- Open the Chrome app, or go to your phone’s Settings.
- Tap your account photo, or go to Google, then Password Manager.
- Turn on Offer to save passwords.
- Make sure your Google Account password is strong, and turn on 2-Step Verification if you have not already.
Try this
Start with the password manager already on your phone for two weeks before deciding whether you need anything else. Most people never need a separate app.
Standalone Password Managers Worth Knowing
If you use more than one type of device, such as an iPhone and a Windows computer, or want extra features like sharing passwords safely with family, a standalone app can help.
- Bitwarden: free for most personal use, with its underlying code open for anyone to inspect, which many security experts see as a point in its favor.
- 1Password: a paid app with a clear, senior-friendly design and strong family sharing tools.
- Dashlane: offers a free plan for a single device and paid plans that add dark web monitoring, which alerts you if your email shows up in a known data leak.
None of these require you to give up the free option on your phone. Many people use the built-in one for everyday sites and add a standalone app later only if they need one across more devices.
Getting Started This Week
- Pick one option: the free one built into your phone, or a standalone app if you use several kinds of devices.
- Choose one strong, memorable master password you have never used anywhere else. A short, odd sentence works well, like PurpleTractor47Loud.
- Turn the password manager on and let it save passwords as you log into your usual sites over the next week.
- Update your most important passwords first: email, banking, and anything tied to money.
Say this
“Can you sit with me for fifteen minutes and help me turn on the password manager that is already on my phone?”
If typing new passwords feels slow at first, that is normal. It gets faster once the app has learned your accounts, and within a couple of weeks most people barely notice it running.
A password manager pairs well with the broader habits in our Scam-Stopper Kit (free when you join our email letter), which covers spotting scam messages before they ever ask for a password in the first place.
A Word About Passkeys
You may start seeing the word “passkey” instead of “password” on some sites. Apple and Google have both begun rolling this out, and Google announced passkey support for Google Accounts in May 2023.
Plain talk: passkey
A newer, more secure way to sign in using your face, fingerprint, or device passcode, instead of typing a password at all. Your password manager can often store these too.
Passkeys are not required yet, and most sites still use regular passwords. For now, a password manager remains the most useful tool for the accounts you already have.
What To Do If You Think a Password Was Stolen
If you clicked a suspicious link, or a site you use announced a breach, try not to panic. Our guide on what to do after clicking a scam link walks through calm, specific next steps, and our guide on freezing your credit after a scam explains when that extra step is worth taking.
If a family member wants to help set your password manager up, our guide on helping a parent with their phone remotely covers the easiest ways to do that over a video call.
Where to Go From Here
Setting up a password manager is one of the most useful things you can do to protect yourself online, and most of the work is just letting the app learn your accounts as you use them normally.
For more help getting a phone set up safely from the start, see our guide on how to set up a phone for an elderly parent. For a fuller plan to recognize and avoid scams before they ever reach your passwords, see our book Scam Proof.
