Password Managers Explained: Plain-English Guide

Most people have dozens of online accounts and reuse the same few passwords, so one leak can open many doors. A password manager is an app or built-in tool that creates and remembers a different strong password for every account, so you only have to remember one. This guide explains in plain English what a password manager does, how to pick one, how to set it up in an afternoon and what to do if something goes wrong. It is written for individuals, families, older people and very small businesses. For organisations choosing a product, see the Password Manager Buyer's Guide.

Key takeaways

Reused passwords are the real danger. When one website is hacked, criminals try the same email and password on other sites, so a unique password for every account stops one leak spreading.
The manager you already have may be enough. The UK National Cyber Security Centre (NCSC) says saving passwords in your browser or phone on your own devices is a safe and easy option.
Your main password is the key to everything. Make it long (three random words works well), never use it anywhere else and do not lose it.
Turn on two-step verification for the manager itself. Then a criminal who learns your main password still cannot get in.
Autofill is a quiet safety feature. A password manager only fills your password on the real website, which helps you notice fake login pages.

What a password manager is, in plain words

Think of a password manager as a locked notebook that lives on your phone or computer. Inside it are all your usernames and passwords. You open the notebook with one main password (often called the master password or primary password), or with your fingerprint or face on a phone. The notebook is scrambled (encrypted), which means anyone who steals the file sees only gibberish without your main password.

A good password manager does five jobs for you, all of which the NCSC lists in its advice:

Remembers: stores every password so you never have to recall them.
Creates: makes long, random passwords such as k7Rv-pq2M-zt9W when you sign up for something new.
Fills in: types your username and password into the login box for you.
Syncs: keeps the same list on your phone, tablet and computer.
Warns: tells you if a saved password is weak, reused, or has turned up in a known data leak.

Many managers now also store passkeys. A passkey is a newer way to sign in that uses your phone or computer instead of a password, and it cannot be typed into a fake website. The NCSC recommends using passkeys wherever a service offers them. Your password manager can hold both. For the technical detail, see the Passwordless and Passkeys Guide.

Why reusing passwords is so risky

Criminals collect lists of email addresses and passwords stolen from hacked websites. They then use computer programs to try those same pairs on banks, shops, email and social media. This is called credential stuffing. It works only because people reuse passwords.

A real example: in 2023 attackers used passwords leaked from other websites to break into more than 18,000 accounts at the DNA testing company 23andMe. Because of a feature that shared information between relatives, data about nearly 7 million people was exposed. The people whose accounts were opened had reused passwords. You can read the full story in the 23andMe Breach 2023 page.

If every one of your accounts has its own password, a leak at one website stays at that website. That single habit is the biggest benefit of a password manager.

Which kind of password manager should you use?

There are two broad kinds. Neither is "right" for everyone. The NCSC's view is that the best choice is the one that meets your needs and that you find easiest to use.

Type	Examples	Good for	Watch out for
Built into your phone, computer or browser	Apple Passwords (iPhone, iPad, Mac), Google Password Manager (Android and Chrome), Microsoft Edge's saved passwords	People who mostly use one family of devices, for example all Apple or all Android plus Chrome. Free and already installed.	May not sync well if you mix brands, for example an iPhone with a Windows laptop using Chrome. Only as safe as the device and the account it is tied to.
Separate (third-party) password manager app	Standalone apps you download and install on each device, free or paid	Households that mix Apple, Android and Windows, or very small businesses that need to share logins between staff.	Another account to protect. Check it works on all your devices, and turn on two-step verification for it straight away.

Questions to ask before you choose, taken from NCSC advice:

Devices: does it work on every phone, tablet, computer and browser you use?
Password control: can you choose how long the generated passwords are?
Cost: is the free version enough, or do you need paid features?
Extras: do you need to share passwords with family, or get alerts when a password leaks?
Recovery: what happens if you forget your main password? Look for recovery options such as an emergency contact.

We do not recommend any particular product. Download apps only from the official app store or the company's own website, never from a link in an email or advert.

Set it up in an afternoon

Menus change from time to time, so if a setting has moved, search for it by name in your device's Settings.

Pick your main password first. Use three random words joined together, as the NCSC suggests (its own example is applenemobiro). Avoid names of pets, family, football teams or important dates, which can often be found on social media. Swapping letters for numbers (o for 0) adds little. Write it on paper and keep it somewhere safe at home until you know it by heart.
Turn the manager on.
- iPhone, iPad or Mac: Apple's Passwords app comes with iOS 18 and macOS Sequoia. Go to Settings (System Settings on a Mac) > General > AutoFill & Passwords and turn on AutoFill Passwords and Passkeys. To sync between devices, go to Settings > [your name] > iCloud > Passwords and Keychain and turn on iCloud Keychain.
- Android or Chrome: Google Password Manager is built in. In Chrome on a computer, open the menu (three dots) > Passwords and autofill > Google Password Manager. You can also see your saved passwords at passwords.google.com. Make sure Offer to save passwords and passkeys is on.
- Separate app: install it from the official app store on each device, create the account and add the browser extension it offers.
Turn on two-step verification for the account that holds your passwords: your Apple Account, Google Account or the separate app's account. See the Two-Factor Authentication for Everyone Guide.
Start with your email. Your email can reset almost every other password, so change it first to a new, unique password created by the manager.
Then do money and shopping. Online banking, PayPal, Amazon and other shops that store your card.
Then social media and the rest. Do a few each day. You do not need to change everything at once: each time you log in somewhere, let the manager replace the old password.
Run the health check. In Apple Passwords, open the Security section to see weak, reused or leaked passwords. Other managers have a similar check. Fix the leaked ones first.

Using it safely every day

Situation	What to do
Signing up to a new website	Let the manager suggest a password and save it. Do not invent your own.
The manager does not offer to fill a password	Stop and check the web address. It may be a fake site. Type the address yourself or use a bookmark.
A shared family computer	Think about who else could open your accounts. If unsure, do not let the browser save passwords there.
A library, hotel or work-share computer	Never save passwords on public or shared devices.
Sharing the Wi-Fi or Netflix password with family	Use the manager's sharing feature (Apple calls it Shared Groups) instead of texting the password.
Updates keep popping up	Install them. Saved passwords are only as safe as your device, so keep automatic updates on.

If you really do not want an app, the NCSC says writing passwords in a notebook kept safely at home is reasonable, because a criminal would need to be in your home to read it. Keep the passwords unpredictable, keep your email password strong and separate, and check your bank allows it, as some banks' terms do not.

Signs something is wrong

Your password manager warns that a saved password has appeared in a data leak.
You get an email or text saying your password was changed, or a login from a new device, and it was not you.
You are suddenly locked out of an account.
Friends get odd messages from your email or social media.
Someone calls, emails or texts asking for your main password or a code "to fix your account". No genuine company will ever ask for your main password.
A pop-up says your password manager is "expired" and asks you to log in through a link. Open the app yourself instead.

What to do if it happens

These steps follow the NCSC's advice on recovering a hacked account.

Change the affected password using your manager, and any other account that used the same password.
Use the provider's own recovery process if you are locked out. Find it from the official website, not from a link in a message.
Sign out everywhere. Most accounts have a security page where you can log out all other devices.
Check your email settings for forwarding rules or filters you did not create. Criminals use them to read your emails quietly.
Check your bank and shopping accounts for payments you did not make, and call your bank on the number on the back of your card.
Warn your contacts to ignore recent messages from your account.
Report it if you lost money (see Where to get help below).

If the password manager company itself is hacked, follow its official advice. When LastPass was breached in 2022, criminals copied scrambled copies of customer password vaults, plus some unscrambled details such as website addresses. The main risk to customers was a weak master password that could be guessed, so the advice was to change important passwords, especially email and banking. See the LastPass Breach 2022 page. This is why a long, unique main password matters so much.

Where to get help

UK: the NCSC password manager advice and NCSC hacked account guidance. If you lost money, tell your bank and report it to Action Fraud, the UK's national fraud and cyber crime reporting centre (the NCSC now refers to the service as Report Fraud). In Scotland, call Police Scotland on 101.
US: report identity theft and get a recovery plan at IdentityTheft.gov (run by the Federal Trade Commission). Report online fraud to the FBI's Internet Crime Complaint Center (IC3).
Device help: Apple Support and Google Help have up-to-date steps for their built-in managers.

If your identity has been used to open accounts or take out credit, see the Identity Theft Recovery Guide.

Common failure patterns

A weak or reused main password. If your main password is short or used elsewhere, the whole notebook is at risk. Make it long and use it nowhere else.
No two-step verification on the manager account. This one setting protects everything inside. Turn it on first.
Saving every password, but never changing the old reused ones. Storing reused passwords in a manager does not fix reuse. Work through the health check until it is clear.
Forgetting the main password with no recovery plan. Set up any recovery option your manager offers, such as an emergency contact, and keep a paper copy somewhere safe at home.
Typing the main password into a link from an email. Criminals send fake "your vault is locked" messages. Always open the app directly. See the How to Spot a Phishing Email Guide.
Storing crypto wallet recovery phrases in the manager. These were a reported target after the LastPass breach. Keep them offline and separate.

Practitioner checklist

Your step-by-step checklist. Tick each one off.

Choose a main password made of three random words and use it nowhere else.
Turn on your built-in password manager, or install a separate one from the official app store.
Turn on two-step verification for the account that holds your passwords.
Change your email password to a new one created by the manager.
Change your banking, payment and shopping passwords next.
Run the password health check and fix every leaked or reused password.
Set up a recovery option and keep a paper note of your main password safely at home.
Use passkeys on sites that offer them.
Keep automatic updates switched on for your phone, computer and browser.
Never give your main password or a security code to anyone who contacts you.

Password Managers Explained for Everyone Guide: Plain-English Steps to Stay Safe