Password managers: a plain-English guide to staying safe online

Most account takeovers do not involve clever hacking. They start with a password that was leaked somewhere else and then tried, automatically, on hundreds of other sites. If you reuse passwords, one breach can unlock your email, your bank and your social media.

What a password manager actually does

A password manager is an encrypted vault. You remember one strong master password; the app creates and stores a long, random, unique password for every site and fills it in for you. Because each password is different, a leak at one service stays at that service.

How to choose one

• End-to-end encryption: the company should not be able to read your vault, even if its servers are breached.
• Works everywhere you do: phone, laptop and the browsers you actually use.
• Supports passkeys and two-factor codes: the newest sign-in methods are replacing passwords altogether.
• An independent security audit: reputable providers publish them.

Setting it up without the pain

Do not try to change every password in one evening. Start with the accounts that matter most — email first, because it can reset everything else — then banking, then anything with a saved card. Update the rest as you log in over the following weeks.

Your email account is the master key to your digital life. Protect it first, and protect it best.

Finally, turn on two-factor authentication for the password manager itself, and store your recovery code somewhere offline. A good vault is only as safe as the way back into it.