The advice is universal and the adoption is not. Everyone in security says use a password manager; most people still do not. The gap is not ignorance. It is that the objections feel reasonable and are rarely answered properly.
So here they are, taken seriously.
"Putting all my passwords in one place is a single point of failure"
This is the real objection, and it is not silly. Concentrating every credential in one vault does create a target.
But compare it with the alternative honestly. Without a manager, people reuse passwords — surveys consistently put reuse above two thirds of users. That means you already have a single point of failure: any one of the hundreds of sites holding your password. The difference is that you chose neither which sites those are, nor how well they protect it.
Credential stuffing exists because of this. Attackers take usernames and passwords from one breach and try them everywhere else, automatically, at scale. It works often enough to be an industry.
A password manager replaces many weak points you do not control with one strong point you do — encrypted with a key derived from a password only you know, protected by a second factor you choose.
"What if the password manager gets breached?"
Some have been. The important question is what an attacker actually obtains.
Reputable managers use zero-knowledge encryption: your vault is encrypted on your device with a key derived from your master password, and the provider never receives that password or that key. A breach of their servers yields encrypted blobs.
Those blobs are only as strong as the master password protecting them. A long, unique master password means the encrypted vault is not usefully attackable. A short or reused one means it eventually is. This is why the master password is the one you should spend real effort on.
The LastPass breach in 2022 is the instructive case. Encrypted vaults were taken, and users with strong master passwords were fine, while users with weak ones were at genuine risk. It also revealed that some metadata — the URLs of stored sites — was not encrypted, which is a legitimate criticism of that implementation rather than of the concept.
"What if I forget the master password?"
You lose the vault. Zero-knowledge means the provider genuinely cannot recover it.
This is a real risk and it has real mitigations. Write the master password down and store the paper somewhere physically secure — a safe, a locked drawer, with important documents. The threat model for most people is remote attackers, not burglars going through their filing cabinet, and paper is immune to everything on the internet.
Most managers also provide an emergency access feature that grants a trusted person entry after a waiting period. Set it up. And export an encrypted backup occasionally.
"My browser already saves passwords"
Browser managers have improved considerably and are far better than nothing. They generate passwords, sync across devices and warn about breached credentials.
Where they fall short: they are tied to one browser, so switching means migrating. They generally do not store the other things you accumulate — recovery codes, software licences, secure notes, passport numbers. Sharing a credential with a family member or a colleague is awkward. And on a shared computer, whoever is signed into the browser profile has the passwords.
If browser storage is what you will actually use, use it. It beats reuse by a wide margin. A dedicated manager is better, and the gap is smaller than it once was.
"It is one more thing to learn"
The setup is genuinely tedious. Changing two hundred passwords is nobody's idea of an evening.
Do not do that. Install it, let it capture credentials as you log in over the following weeks, and change passwords only where it matters: email first, then financial accounts, then anything flagged as reused or breached. The rest can migrate as you encounter them.
After the first fortnight it saves time rather than costing it, because you stop resetting forgotten passwords.
What actually matters in the setup
The master password should be a passphrase. Four or five genuinely random words — not a quotation, not a phrase you like. Random word selection produces something both strong and memorable, which is exactly what this one password needs to be. You can sanity-check a candidate with our Password Strength Checker, which measures entropy rather than counting character types.
Turn on two-factor authentication for the vault itself. A hardware key or passkey if the manager supports it.
Let it generate the passwords. The point is that you never see or remember them. Sixteen random characters per site, all different. If you are generating them outside the manager for any reason, our Password Generator uses your browser's cryptographic randomness rather than a predictable one.
Store recovery codes in it too. The backup codes from every 2FA setup have to live somewhere, and an encrypted vault is a better place than a screenshot in your photo library.
The honest summary
A password manager does not eliminate risk. It concentrates it somewhere you can defend, and replaces a problem you cannot solve — remembering hundreds of unique strings — with one you can, remembering a single strong passphrase.
That trade is favourable for essentially everyone. The objections are reasonable; the alternative is worse.
