Password Managers: The Other Half of the System

A generator makes strong passwords possible; a password manager makes them practical. Without one, "a unique 16-character password for each of your 80 accounts" is a fantasy — nobody memorizes 80 random strings, so the passwords get reused, written down, or quietly weakened. With one, you memorize a single passphrase and the manager remembers everything else.

What a manager actually does for you

Remembers everything: every account gets its own generated password, stored encrypted under your master passphrase.
Fills only the real site: autofill checks the domain before offering a password, which quietly defeats most phishing pages — a fake site simply does not get the fill.
Syncs safely: the vault that travels between your phone and laptop is encrypted end-to-end; the provider stores ciphertext, not your passwords.
Flags trouble: most managers warn about reused passwords and passwords found in known breaches, which no amount of entropy can fix after the fact.

Choosing one

This site does not sell or rank managers, and you should be suspicious of "best password manager" lists that do. The criteria that matter are boring and checkable: a published, independent security audit; end-to-end encryption with a zero-knowledge design; apps for every device you use; account recovery options you have actually set up; and an export function, so you are never locked in. Well-known options exist at several price points, including solid free tiers and the managers built into major operating systems and browsers — a built-in one you actually use beats a perfect one you never installed.

Moving in, safely, in an afternoon

1. Pick the manager and set the master passphrase. Generate a 5–6 word passphrase here. Write it on paper and keep it somewhere physically safe until it is memorized — it is the one password that cannot be reset by email.
2. Import what your browser saved. Most managers import browser stores directly. Then, account by account, replace the old passwords with freshly generated ones — starting with email, banking, and anything that can reset other accounts.
3. Turn on two-factor authentication for the manager itself and for your important accounts while you are in their settings anyway.
4. Delete the old copies: the spreadsheet, the notebook photo, the browser's saved list once the vault is complete and backed up.

The single point of failure is real, and it is managed, not avoided: a strong master passphrase, two-factor on the manager, recovery codes kept offline, and a vault export stored somewhere safe. That combination is still far safer than the realistic alternative — the same human-made password, or a small rotation of them, across every account you own.

FAQ

What if the manager company gets breached?

Attackers get encrypted vaults. A vault locked with a 5–6 word passphrase (>50 bits) and a modern, slow key-derivation function is a hard target; that is precisely why the master passphrase must be generated, long, and used nowhere else.

Is the password manager in my browser enough?

For most people, yes — it is encrypted, syncs, and generates passwords. Dedicated managers add cross-platform reach, sharing controls and breach monitoring. Using either beats reusing passwords.

Should I let the manager generate passwords, or use PassGen?

Either — both draw from cryptographic randomness. PassGen exists for the cases a manager is not at hand (a work machine, a shared computer, setting up the manager itself) and to show the entropy math openly.