What is a password manager and how does it work?

What is a password manager?

A password manager is software that stores the usernames and passwords for your email, banking, shopping and social media accounts in an encrypted “vault”. You open the vault with a single master password (and, if you like, Face ID, a fingerprint or a passkey), and the app remembers every other password for you.

Today’s password managers do far more than store passwords. Most of them generate strong passwords, autofill forms in your browser and on your phone, store passkeys and two-factor authentication (2FA) codes, keep secure notes and card details, and sync everything across your devices in encrypted form.

Why do you need a password manager?

The average internet user has dozens of accounts. Giving each one its own long, random password and memorizing all of them simply isn’t realistic. That’s why most people reuse the same password in several places or pick passwords that are easy to guess.

Reuse is the real danger. When a site’s database leaks, the email and password pairs in it are automatically tried on other sites. Every account where you used that same password is exposed to these attempts. You can find out whether a password has already appeared in a breach with our breach check tool.

A password manager tackles the problem at its root:

• It generates a unique, strong password for every account, so you never have to remember it.
• It only suggests a password on the site it was saved for. Because autofill doesn’t kick in on a fake login page, it becomes much easier to spot phishing attempts.
• It flags passwords that are weak, reused or have shown up in breaches.
• It gives you the same vault on all of your devices.

How does a password manager work?

The way a modern password manager works comes down to three steps:

• Key derivation: On your device, your master password is run through a deliberately slow, memory-hungry algorithm (such as Argon2id) that turns it into an encryption key. That slowness makes guessing the master password by brute force extremely expensive.
• On-device encryption: The items in your vault are encrypted with that key before any data leaves your device. In a well-designed product, the server only ever sees unreadable data. This is called end-to-end or “zero-knowledge” encryption; the details are in our guide to end-to-end encryption.
• Sync and autofill: The encrypted vault syncs between your devices. When you land on a login page, the browser extension or your phone’s autofill suggests the item saved for that site and fills it in with a single tap.

This model has one important consequence: because your master password isn’t stored on the server, the company can’t reset it. Forgetting your master password means losing access to your vault. That’s why it pays to choose a long but memorable passphrase and write it down somewhere safe. Our password generator can create passphrases too.

Is a password manager safe?

The first question most people ask is: “Isn’t it risky to put all my passwords in one place?” The short answer: a well-designed password manager is far safer than reusing passwords, writing them in a notebook or leaving them unprotected in your browser.

With a product that uses end-to-end encryption, even an attacker who takes over the server only gets encrypted data, and unlocking that data depends on knowing your master password. Most of the remaining risk sits on your side, and it’s manageable:

• Choose a long master password that you don’t use anywhere else. You can see how strong it is with our password strength test.
• Turn on two-factor authentication for your password manager account (see our 2FA guide).
• Keep your devices up to date. No app can fully protect you on a device infected with malware.

When you evaluate a product, look at how openly the company explains its encryption design: which algorithms it uses, what the server can and can’t see, and how much of the source code can be reviewed. KeyZula lists all of this on its How it works and Security pages.

Isn’t the browser’s built-in password saving enough?

The built-in password saving in browsers such as Chrome, Safari, Edge and Firefox is better than nothing, and it has improved a lot in recent years. Still, a dedicated password manager has some advantages:

• Platform independence: You use the same vault across different browsers and operating systems (for example, an iPhone and Chrome on Windows).
• More item types: 2FA codes, secure notes, card details, documents and SSH keys all live in the same place.
• Sharing: You can share selected items with your family or team and control who gets access.
• Emergency access and export: You can plan for someone you trust to reach your vault, and you can move your data to another product whenever you want.

What should you look for in a password manager?

The right product depends on how you work, but these criteria matter in almost every case:

• End-to-end encryption: Encryption should happen on your device, and your master password should never be sent to the server.
• Transparency: Is the security design documented? Can the encryption code be reviewed? Has there been an independent audit?
• Platform support: Is there an app for the phone, computer and browsers you use?
• Passkey and 2FA support: Can it store passkeys and generate 2FA codes?
• Free plan limits: Are there limits on the number of devices, the type of device or the features you get?
• Easy switching: Can you import from your current browser or password manager, and export again when you need to?

To compare popular products, take a look at our comparison table and our alternative guides.

How do you get started with KeyZula?

KeyZula is an end-to-end encrypted password manager with every feature free. Getting started takes a few minutes:

• Create a free account and choose a long master password.
• Install the apps on the devices you use: the web vault, iPhone, iPad and Mac, Android, and the browser extension for Chrome, Edge, Brave, Firefox and Safari.
• Import the passwords from your browser or your previous password manager. The file is never sent to the server; it’s read and encrypted in your browser.
• Use the security report to change weak and reused passwords, starting with your most important accounts.
• Turn on two-factor authentication for your account and start using passkeys on sites that support them.

Frequently asked questions