Why You Need a Password Manager (and Why It's Really a Backup)
Prices and product details checked October 2026. Apps change; if a menu doesn't match, tell me and I'll fix it.
Most people I talk to keep their passwords in one of three places: a notebook or a file called "passwords" on the desktop, the browser's "save this password?" box, or their own memory, which usually means one password with small variations.
All three work right up until the day they don't. This guide is about what happens on that day, why a password manager is the fix, and how to set one up without it taking over your life. It's long. The short version is at the end.
New Here? Start with what a backup actually is.
The real problem isn't weak passwords. It's reused ones.
Here's how most people actually get broken into. Some website you signed up for in 2019 gets hacked. Nobody remembers the site. The list of emails and passwords from it gets sold. Criminals feed that list into a program that tries every email and password combination at Amazon, Netflix, your bank, your email. If you used the same password there, they're in. It's called credential stuffing and it's automated; nobody is targeting you personally. You're just on a list.
The only defense is a different password for every account. Nobody can remember two hundred different passwords. So the question is where to keep them.
The three places, and what's wrong with two of them
A file or a notebook. A paper notebook in a drawer at home is better than most people think, as long as it never leaves the house. The problem is the file. A "passwords.txt" or a Word document is readable by any program on the computer, including the one a scammer talked you into installing. It gets copied into every backup in plain text. And when the computer dies, it dies with it.
The browser. Chrome, Edge, and Safari all offer to save your passwords, and it's convenient enough that most people say yes. Three things to know. First, those passwords are tied to your Google, Microsoft, or Apple account, so whoever gets into that account gets all of them. Second, they're the first thing malware goes for. There's a whole category of software called infostealers whose job is to grab the browser's saved passwords and cookies in the first seconds after it lands on a machine. Google added a protection for this in 2024; the people writing the malware had bypasses within months. Third, anyone who sits down at your unlocked computer can read them.
The browser isn't a terrible place. It's a lot better than reusing one password. But it's a place built for convenience, with security added afterward.
A password manager. This is an app whose only job is keeping passwords. It locks everything behind one password you remember, it fills in the right password on the right site (which also makes it hard to fool with a fake site), it makes up a long random password every time you create an account, and it works on your phone and your computer at the same time. It's built for security first.
Think of it the way you'd think of a backup
If you've read my backup guides, this part will sound familiar, because it's the same idea.
Your passwords are the keys to everything you own online. A password manager is where the keys live, and it's also the backup of the keys. The rules that make a backup worth having are the same rules that make a password manager worth having.
| In a backup | In a password manager |
|---|---|
| The backup drive holds a copy of everything | The vault holds every password |
| The recovery key for the drive | The one master password you remember |
| The recovery drive you made in advance | The emergency sheet (below), printed and put away |
| A second copy somewhere else | The vault synced to your phone and your computer, so losing one doesn't lose both |
| The restore test that proves it works | Signing in on a fresh device once, to prove you can get back in |
| A backup nobody has tested | A manager you set up, forgot the master password for, and can't open when the phone dies |
That last row is the one people hit. They set up a password manager, let it fill everything in for two years, never type the master password again, and then they get a new phone and can't remember it. The vault is still there. They can't get in. Same as a backup drive full of files that won't restore.
So the rule is the backup rule: set it up, then test that you can recover it, then put the recovery pieces somewhere safe. The rest of this guide is that, in order.
Which one
There are a lot of these. Three I'm comfortable recommending, and a note on the browser ones.
Bitwarden. Free, and the free plan isn't a trial: unlimited passwords, unlimited devices, syncs between them. The code is open for anyone to inspect. Premium is $19.80 a year as of January 2026 and adds things most people don't need. This is the one I point people to first.
1Password. Paid only, $4.99 a month or $47.88 a year for one person as of March 2026, and a family plan for $71.88 a year. It's the most polished of the three and the one I'd pick for a household that wants shared logins without fuss.
Proton Pass. From the people who make Proton Mail. Free plan is solid; the paid plan is bundled with their other products. A good choice if you already use Proton.
Apple Passwords or Google Password Manager. If every device you own is from one company and you keep it that way, these are fine. Apple's is a real app now and is well built. Google's can be set to keep the passwords encrypted on your device so Google can't read them, which is worth turning on. The reason I still point people to a dedicated manager is the day they buy a Windows laptop or an Android phone and half their passwords are stuck somewhere else.
One to avoid: keeping them in Microsoft Authenticator. Microsoft removed password storage from it in August 2025 and moved everything to Edge. If you had passwords in there and didn't export them, check Edge.
And a word on LastPass, since people ask: in 2022, criminals stole copies of customer vaults from LastPass. Vaults are encrypted, so what mattered was the strength of each person's master password. The ones with long master passwords were fine. That's the lesson, more than the brand: the master password is the whole game.
Set it up in an afternoon
1. Pick your master password first, before anything else. Not a word with numbers. A phrase. Four or five unrelated words you can picture, with spaces: something like copper giraffe tuesday lantern. Long beats clever. Don't use a line from a song or a quote; those are in the lists. Write it down on paper for now; you'll deal with the paper in step 6.
2. Install the manager on your phone and your computer. The app on the phone, the browser extension on the computer. Sign in to both with the master password. Turn on two-factor for the manager itself if it offers it, and save the recovery code it gives you.
3. Move your passwords in. Every browser can export its saved passwords to a file (look for Export in the browser's password settings), and every password manager can import that file. Do it, confirm the passwords showed up, then delete the export file. It's a plain text copy of everything.
4. Turn off the browser's own saving. Otherwise you'll have two places, and two places is how things get lost. The manager will fill in passwords from now on.
5. Fix the important ones. Don't try to change two hundred passwords. Change five: your email, your bank, your Apple or Google account, your phone carrier, and whatever you'd be most upset to lose. Let the manager make up the new password each time. Change the rest whenever you happen to log in.
6. Make the emergency sheet. One piece of paper. Your master password, the manager's recovery code, and the name of the app. Put it where you keep your passport or your will. Tell one person you trust where it is. This is your recovery drive. If you're hit by a bus, or just by a dead phone, this sheet is how you or your family get back in.
7. Test it. Within the week, sign out of the manager on one device and sign back in from scratch using only what's on the emergency sheet. If it works, you have a tested backup of your keys. If it doesn't, you've found out on a Tuesday afternoon instead of the day you needed it.
Then forget about it. The manager does the rest.
Questions I get
What if the password manager company gets hacked? The vault is encrypted on your device before it's sent anywhere. What the company stores is a locked box; your master password is the only key, and they don't have it. That's why step 1 matters more than which company you pick.
Isn't putting everything in one place dangerous? Everything is already in one place. It's your email account, because every password reset goes through it. The manager at least puts a strong lock on the door. Protect your email with the manager, two-factor, and a recovery phone and email you control, and the one-place problem is handled.
What about two-factor codes? Most managers can store those too. It's convenient. It also means one master password unlocks both the password and the code. For most people that trade is fine. For your bank and email, a separate authenticator app on your phone is a little safer.
My spouse needs to get in if something happens to me. Family plans handle this, and so does the emergency sheet. 1Password and Bitwarden both have an emergency access feature where a person you name can request access and get it after a waiting period you set.
Passkeys. Should I care? Passkeys are the thing that's slowly replacing passwords: you sign in with your face or fingerprint and there's no password to steal. More sites support them every month. The good news is a password manager stores passkeys too, so setting one up now is also how you'll handle passkeys later.
The short version
Use a different password everywhere. Keep them in a password manager, not the browser and not a file. Make the master password a long phrase. Print the emergency sheet and put it with your important papers. Test that you can get back in. Then stop thinking about it.
That's the same advice as the backup guides, because it's the same problem: the day you need it is the wrong day to find out it doesn't work.
David Martin
Information Security Kentucky
Hardin County, KY