# Password manager

> An encrypted vault that remembers a different strong password for every site.

- Level: Basic
- Topics: Security
- URL: https://tidbit.legios.com.ar/password-manager/
- In Spanish: [Gestor de contraseñas](https://tidbit.legios.com.ar/es/password-manager/)

A **password manager** is an app that creates, stores and types your passwords for you. You remember one long **master password**; the app remembers the hundreds of others, each one different, random and long (`v9!Qm#2kLp...`), and fills them in when you log in. The vault is protected with encryption, so in a well-designed manager the company that runs it cannot read your passwords either.

The problem it solves is reuse. Sites get breached, and when one leaks its list of emails and passwords, attackers try those same pairs on every other service, automatically. If your email password is also your bank password, one leak opens both. With a manager, each site has its own key, so a leak stays contained to that site.

It also helps against phishing: the manager fills a password only on the exact site it was saved for. If a fake page imitates your bank on a look-alike address, the autofill does nothing, and that silence is a warning. Popular options are the built-in ones from Apple, Google and browsers, and dedicated apps like Bitwarden (open source) or 1Password.

Practical takeaway: start with the one already on your phone or browser. Make the master password a long passphrase of four or five random words, turn on two-factor authentication for the manager itself, and let it replace your reused passwords one site at a time.

## An analogy

A keyring inside a safe. You memorize one combination; inside are a hundred different keys, one per door, and you never have to carry them in your head.

## Keep in mind

- Reused passwords are the real risk: one leak opens every account that shares it.
- You memorize one long master passphrase; everything else is generated and random.
- Autofill refuses to work on a look-alike site, which blocks a lot of phishing.
- The built-in managers from Apple, Google and browsers are a fine place to start.

## Go deeper

- [Password manager on Wikipedia](https://en.wikipedia.org/wiki/Password_manager)
- [OWASP Authentication Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html)

## Related terms

- [Encryption](https://tidbit.legios.com.ar/encryption/): Scrambling data so that only someone with the key can read it.
- [Phishing](https://tidbit.legios.com.ar/phishing/): A fake message that tricks you into handing over a password or a payment.
- [Apple](https://tidbit.legios.com.ar/apple/): The company that sells the iPhone and the Mac, plus the services that run on them.
- [Google](https://tidbit.legios.com.ar/google/): The search company that gives most products away and makes its money on ads.
- [Web browser](https://tidbit.legios.com.ar/web-browser/): The app that fetches web pages from the internet and draws them on your screen.
- [Open source](https://tidbit.legios.com.ar/open-source/): Software whose code anyone can read, use, change and share.
- [Two-factor authentication](https://tidbit.legios.com.ar/two-factor-authentication/): A second proof that you are you, so a stolen password alone is not enough.