What is a password manager?
A password manager stores a user's credentials in a vault, an encrypted database that opens only with a master password or passphrase, ideally backed by multifactor authentication (MFA). Because the user memorizes only that one secret, every other account can have a long, random password that nobody needs to remember. Most managers also hold secure notes, recovery codes, card details and, in newer products, passkeys.
Problems it solves
- Password reuse. In credential stuffing, attackers replay username and password pairs leaked from one site against many other sites. A unique password per site stops a breach in one place from unlocking another, and a password manager is what makes unique passwords practical.
- Weak passwords. The built-in generator creates long random strings, so users stop inventing short, predictable ones.
- Some phishing. Autofill is tied to the saved site address, so the manager does not offer to fill a look-alike domain. That is a useful warning sign, not full protection: a user can still copy and paste a password into a fake page.
- Unsafe storage. It replaces sticky notes, spreadsheets and text files.
- Sharing. Business editions offer shared vaults with role-based access, so a team can use a vendor portal or service account login without emailing the password around.
How it works
- The user sets a strong master password and turns on MFA for the manager account.
- The vault is encrypted before it is stored or synced. With a reputable cloud-synced product, the provider holds only encrypted data.
- When the user visits a saved site, the browser extension or mobile app offers to fill the matching login.
- When the user creates a new account, the generator proposes a random password and saves it to the vault.
Browser-saved passwords vs. a dedicated manager
| Feature | Browser's built-in password storage | Dedicated password manager |
|---|---|---|
| Unlock | Usually available whenever the browser profile is signed in | Separate master password, with optional MFA on the vault |
| Reach | Tied to one browser vendor's ecosystem | Works across browsers, operating systems and phones |
| Extras | Basic sync and breach warnings in some browsers | Secure sharing, admin controls, breach monitoring |
| Main risk | Infostealer malware targets saved browser logins | Everything depends on the master password |
Either option beats reusing one password everywhere. For users who need the stronger option, a dedicated manager is the usual recommendation.
Risks and good practice
- Single point of failure. Whoever gets the master password and can pass any MFA gets every stored credential. Make the master password a long passphrase used nowhere else.
- Lockout. With many products, a forgotten master password and no recovery method means the vault cannot be opened. Set up the recovery option the product offers and keep recovery codes somewhere safe.
- Malware on the device. A keylogger or infostealer on an unlocked device can capture the master password or vault contents. Keep the device patched and set the vault to lock when idle.
- Exports. A CSV export of the vault is plain text. Protect it or avoid creating it.
- Untrusted computers. Do not open the vault on public kiosks or borrowed machines.
Password manager on the CompTIA A+ exam
Password managers fall under Core 2 (220-1202) objective 2.11, browser security settings and safe browsing. Know what a manager does (encrypted vault, master password, generator, autofill, sync), why it is the standard fix for password reuse, and that MFA should protect the vault itself. If a scenario says a user reuses one password on every site, keeps passwords on a sticky note or cannot remember many complex passwords, think password manager. If a question asks what an attacker gains from the master password, the answer is access to every credential in the vault, which is why that one password must be long, unique and backed by MFA.