Password Manager.

What is a password manager?

A password manager is a program that creates, stores and fills in passwords for you. CISA describes it as a tool that generates, stores and even fills in all your passwords. The NCSC describes it as a way to store passwords securely, so you do not need to memorize many complex passwords.

How does a password manager work?

The NCSC describes two kinds. Built-in managers come with your browser or system. Third-party managers offer broader compatibility across different devices and operating systems.

CISA says a password manager can also alert you to weak or reused passwords.

Why do security bodies recommend password managers?

CISA says most people cannot remember many long, random and unique passwords. With a password manager you only need to remember one strong password, the one that protects the manager itself. CISA calls this one of the easiest ways to protect yourself from someone logging into your accounts.

The NCSC lists these benefits: automatic creation of strong and unique passwords, autofill that works only on legitimate websites, which reduces exposure to phishing, syncing across devices, and alerts about breaches.

NIST SP 800-63B, the US technical guidance on digital identity, says services must allow the use of password managers and autofill. It also says services should let people paste a password when autofill is not available, so that password managers can be used.

How should you protect your password manager?

• CISA says a strong password can be a passphrase of four to seven unrelated words.
• The NCSC advises using two-step verification to help protect you if your password gets phished or otherwise compromised.
• The NCSC says not to save passwords on public computers, such as in libraries or colleges.
• The NCSC says passwords stored in a browser are only as secure as your devices and accounts, so security updates matter.

What should you look for when choosing one?

CISA says to choose a reputable option, and notes that free and paid versions exist. The NCSC says to compare options by device and operating system support, password generation settings, cost and extra features.

Is a password manager the same as multi-factor authentication?

No. A password manager looks after your passwords. Multi-factor authentication asks for a second proof of identity on top of a password. The NCSC advises using two-step verification alongside a password manager.

Does a password manager stop credential theft?

It does not remove the risk. Credential theft is the stealing of login details, and a password manager is one way to keep those details strong, unique and stored in one protected place. The NCSC points to autofill on legitimate websites as a way to reduce phishing exposure.

Do passkeys replace password managers?

The NCSC recommends prioritizing passkeys as login alternatives, which use biometric or device-based authentication rather than typed passwords. See the passkeys term for more.