Most people use a handful of passwords across dozens of accounts, with small variations. It feels manageable. It is also the single biggest weakness in ordinary digital life.
Why reuse is the real danger
Companies get breached regularly, and leaked databases circulate. If your email and password from a breached shopping site match what you use for your primary email, an attacker who gets one gets the other. Trying leaked credentials across many sites is automated and extremely common — it does not require anyone to target you personally. The defence is a different password for every account, which nobody can remember. That is exactly what a password manager solves.
How it works
It stores all your passwords in an encrypted vault. You remember one strong master password, and the manager fills in everything else. Good managers also generate long random passwords, sync across devices, and warn you when a saved password appears in a known breach.
The obvious worry, addressed
Putting everything in one place sounds risky, but reputable managers use end-to-end encryption — decryption happens on your device using your master password, so even if their servers were breached, attackers get unreadable data. The genuine risk is forgetting your master password, which most providers cannot recover, precisely because they cannot see it.
Choosing one
- Built into your browser or phone — free, convenient, and vastly better than reusing passwords. A perfectly reasonable starting point.
- Dedicated cloud managers — work across all platforms with breach monitoring, useful if you mix Android and Windows, or iPhone and PC.
- Offline managers — the vault stays under your control, at the cost of convenience.
Setting it up properly
- Create a strong master password — a long passphrase of unrelated words is both stronger and easier to remember.
- Write it down and store it physically somewhere safe; losing it means losing everything.
- Save the recovery code your provider gives you in the same place.
- Enable two-factor authentication on the manager itself.
- Change your critical passwords first — email, banking, anything holding payment details.
- Let it save the rest gradually as you log in over the following weeks.
The habit that matters most
Prioritise your email account. Whoever controls your email can reset passwords for nearly every other service, so it deserves a unique, strong password and two-factor authentication above everything else. Moving from reused passwords to unique ones eliminates the most common way ordinary people lose control of their accounts. It takes an hour and removes a risk you are otherwise carrying indefinitely.
