Passwords protect almost every part of our digital lives: email, banking, social media, shopping and work systems.
The problem is that most of us now have far more passwords than we can realistically remember. That often leads to people choosing simple passwords, reusing the same password across several accounts, or keeping passwords somewhere insecure.
A password manager offers a much safer and easier way to manage them. It is something I recommend to my clients because it removes much of the hassle while significantly improving security.
What is a password manager?
A password manager is a secure digital vault that stores your usernames, passwords and other sensitive information.
Instead of remembering a separate password for every website, you normally only need to remember one strong master password. The password manager takes care of the rest.
Your stored information is encrypted. In simple terms, this means it is converted into unreadable data that can only be unlocked with the correct credentials.
Password managers are usually available as:
- An application on your computer, tablet or phone
- An extension in your web browser
- A combination of apps and browser extensions that synchronise between your devices
Why I recommend using one
You can use a different password everywhere
Reusing passwords is one of the biggest risks I regularly come across.
If one website suffers a data breach and your password is exposed, criminals may try the same email address and password on Microsoft 365, banking, shopping and social media accounts.
A password manager lets you create a completely different password for every account without needing to remember each one.
It creates genuinely strong passwords
Passwords based on names, birthdays, pets or familiar words can be easier to guess than people realise.
A password manager can generate long, random passwords for you. These are far more difficult to crack and you do not need to type or memorise them yourself.
Where a website supports passkeys, a good password manager may also help you store and use them. Passkeys can provide an easier and more phishing-resistant way to sign in than traditional passwords.
It saves time
Most password managers can automatically enter your login details when you visit a recognised website or open an app.
This reduces typing, avoids forgotten-password resets and makes it practical to use strong, unique credentials for every account.
Auto-fill can also provide some protection against phishing. If you land on an imitation website rather than the genuine one, the password manager should not recognise the address or automatically fill in your credentials. That unexpected behaviour should be treated as a warning to stop and check the website carefully.
You should never approve a login simply because a page looks convincing.
Useful features to look for
Different password managers provide different features, but the most useful commonly include:
Password generation
The manager creates long and unique passwords, removing the temptation to reuse something memorable.
Auto-fill
Your login details can be entered automatically on recognised websites and apps.
Secure notes
Many password managers can securely store recovery codes, software licence details and other important information.
Be selective about what you keep in the vault, and avoid storing more sensitive information than you genuinely need.
Secure sharing
Business and family plans may allow selected credentials to be shared without sending passwords through email, Teams, text messages or WhatsApp.
For a business, this is much better than several people knowing and manually sharing the same password. Access can usually be removed when it is no longer required.
Breach and password-health alerts
Some password managers can warn you about:
- Passwords that appear in known data breaches
- Reused passwords
- Weak passwords
- Old or unsecured accounts
An alert does not necessarily mean that your password manager has been compromised. It may mean that another website on which you used those credentials has suffered a breach.
Are password managers safe?
A reputable password manager, configured properly, is generally far safer than reusing passwords or keeping them in an unprotected spreadsheet, notebook or document.
However, no product can remove every risk.
Your password vault is particularly valuable, so it needs to be protected carefully. The most important steps are:
- Choose a strong and unique master password.
- Enable multi-factor authentication on the password-manager account.
- Never reuse the master password anywhere else.
- Keep the application, browser extension and your devices updated.
- Review recovery options before you need them.
- Be suspicious of unexpected sign-in or MFA prompts.
- Only install password-manager software from the provider’s official website or app store.
- Protect your computer and phone with a PIN, password or biometric sign-in.
Where available, I recommend using a security key or a properly protected authenticator app for multi-factor authentication rather than relying solely on text messages.
What happens if I forget my master password?
This is something you should understand before placing important information in a password manager.
Many providers are deliberately unable to see or recover your master password. That protects your vault from unauthorised access, but it can also mean that forgetting the password could lock you out.
Depending on the provider and type of account, recovery might involve:
- A recovery code
- A trusted emergency contact
- Another authorised family or business administrator
- A previously approved device
- A provider-specific account recovery process
Set up the available recovery options carefully and store any recovery code somewhere physically secure. Do not keep the only copy inside the vault it is intended to recover.
For a business, recovery arrangements should not depend entirely on one person.
Can a password manager be hacked?
Any online service or piece of software could potentially be targeted. Password-manager providers are no exception.
The important point is that a well-designed password manager encrypts the vault so that the provider should not have access to its readable contents. The precise protection varies between products, which is why reputation, transparency, security design and independent assessment matter.
Some of the more likely risks are still:
- A weak or reused master password
- Approving a fraudulent MFA request
- Entering the master password into a phishing page
- Malware or remote access on the device
- An unlocked computer being used by someone else
- An insecure or poorly managed recovery process
A password manager is therefore an important part of your security, but it does not replace device protection, updates, multi-factor authentication and sensible checks.
What about passwords saved in a browser or phone?
The built-in password managers provided by Microsoft, Apple, Google and others have improved considerably. For some individuals, particularly those who remain within one device ecosystem, they may provide a practical improvement over reused or written-down passwords.
A dedicated password manager can still be the better choice where you need:
- Consistent access across different browsers and devices
- Controlled password sharing
- Separate business and personal vaults
- Emergency access or account recovery
- Administration for several users
- More detailed security and password-health reporting
- Clear processes when someone joins or leaves a business
The right choice depends on the devices you use and whether the passwords are personal, shared or business-critical.
Is a free password manager sufficient?
A reputable free password manager can be a good starting point. The important thing is not simply whether it is free, but whether it supplies the security and recovery features you need.
Paid plans may add features such as:
- Family or business sharing
- Administrative controls
- Emergency access
- Encrypted file storage
- Additional security reports
- Priority support
- More advanced multi-factor authentication options
Before choosing one, check what happens if you stop paying and whether you can export your information if you later decide to move to another provider.
Do I need to change my passwords regularly?
A strong, unique password does not normally need to be changed simply because it has reached a certain age.
You should change a password when:
- You know or suspect that it has been exposed
- The service reports a security incident
- You accidentally entered it on a suspicious website
- It has been shared with someone who no longer requires access
- It is weak or reused elsewhere
- An account shows activity you do not recognise
For business accounts, password changes should also follow any security, compliance or contractual requirements that apply to the organisation.
My practical recommendation
If you are currently reusing passwords, saving them in an unprotected document or keeping them on notes around your desk, moving to a reputable password manager is a worthwhile improvement.
Start with your most important accounts:
- Your main email account
- Your password manager itself
- Banking and payment services
- Microsoft 365 or other business systems
- Social media accounts
- Website and domain-management accounts
Give each account a strong, unique password and enable multi-factor authentication wherever it is available.
You do not have to change every account in one sitting. Begin with the accounts that could cause the greatest damage if someone gained access, then work through the others gradually.
Need help choosing or setting one up?
The right password manager should make security simpler, not introduce another source of worry.
If you are unsure which product is suitable, how to protect the master account or how to introduce password management into your business, please speak to me. I can help you choose an appropriate approach and make sure it is configured sensibly.
Your passwords are often the keys to your business. It is worth looking after them properly.
Mark Skiba
Edge Technical Services — Your Trusted IT Partner