Nobody can remember 80 unique passwords — so stop trying. How password managers work, their hidden anti-phishing power, and how to adopt one without a heroic weekend.
Password Managers in Practice
You already know the rules: every account needs a unique, strong password. You may also have done the maths: with 80+ accounts in a typical working life, no human can hold up their end of that bargain from memory. Something has to give — and for most people, what gives is uniqueness. One favourite password, lightly seasoned (
Winter2024!, Winter2025!), reused everywhere.That reuse is exactly what attackers harvest. When any one website is breached, the stolen passwords are replayed against email, banking, and business systems within hours — an attack called credential stuffing. One weak site can unlock your strongest account.
The Fix: Stop Remembering Passwords
A password manager is an encrypted vault that generates, stores, and fills your passwords. You remember exactly one secret — a long master passphrase — and the manager handles the rest:
- Generates truly random passwords (
kX9$mQ2#vL8pWn4z) that never repeat - Stores them encrypted — even the vendor can’t read your vault
- Fills them automatically in the right place, on every device
The Anti-Phishing Superpower Nobody Mentions
Here’s an underrated benefit: a password manager fills your password only on the exact website it was saved for. Land on
rnicrosoft-login.com instead of microsoft.com and the autofill silently offers nothing.✓ Key Point
If the password manager won’t autofill on a login page, stop. Either you’re on a lookalike phishing site, or something else is wrong. That hesitation is your manager telling you the site’s identity doesn’t match — a check humans are terrible at and software is perfect at. Don’t “help” by pasting the password in manually; go to the site by its known address instead.
Doing It Right
Use the company-approved manager for work accounts. IT can recover access when someone leaves, enforce policy, and support you — none of which is true of a personal app quietly holding work credentials.
Make the master passphrase long and unique. Four or more random words (
paddock-lantern-quietly-birch) beats any short complex string. This one secret protects all the others: never reuse it anywhere, and never share it.Turn on MFA for the vault itself. The manager holds the keys to everything, so it deserves the strongest lock you have.
Migrate as you go. No need for a heroic weekend: each time you log in somewhere, save the account and let the manager replace the password with a generated one. Start with email and banking — the accounts that reset all the others.
⚠ Warning
What a password manager is not: a spreadsheet called
passwords.xlsx, a note on your phone, a Word doc in your drafts, or the same three passwords “but organised”. Those are plaintext lists — readable by any malware, any phone thief, and anyone who ever gets into that account. A real manager keeps the vault encrypted and locked behind your passphrase and MFA.What About the Browser’s Built-in Manager?
Browser password saving (Chrome, Edge, Firefox) is far better than reuse — genuinely. But dedicated managers are stronger for work use: proper vault encryption independent of your browser profile, secure sharing with your team instead of Slacking a password, breach alerts when a saved site is compromised, storage for more than just passwords (MFA codes, licence keys, notes), and IT-managed recovery. If the company provides one, use it. If your browser is currently saving work passwords into a personal profile synced to a personal account — that’s worth fixing this week.
Getting Started Checklist
- Install the company-approved password manager (ask IT which one).
- Create a long, unique master passphrase — four+ random words.
- Enable MFA on the vault.
- Move your email and banking logins in first; let each get a generated password.
- Save each further account as you naturally log in.
- Delete the spreadsheet/notes file afterwards — properly.
