Why a password manager beats a clever memory
Reuse is the breach. Unique logins, a vault, and a way to move without a heroic weekend.
A password manager is a database of unique logins with a lock in front of it. You remember one strong master password (or a passkey). The manager remembers the rest, including strings you would never type twice. For home cyber security it beats memory, a notebook by the router, and the same phrase with a year stuck on the end.
Why reuse is the real failure
Breaches are normal. A forum you forgot dumps email and password pairs. Attackers try those pairs on mail, shopping, and banks. That is credential stuffing. If every site has a different password, one dump is one headache. If they share a password, one dump is a house fire.
Humans are bad at random. We are good at patterns: pet plus season plus “!”. Those patterns are in cracking lists. A manager’s generated password is long and dull. Dull is the goal.
The manager also shows you the real domain when it fills. A phishing page on a lookalike host often gets nothing, because the saved login belongs to the real site.
What to look for in a manager
Pick one you will actually open on your phone and your computer. Official apps from a known vendor. End-to-end encryption so the company stores a blob they cannot casually read. A way to export, so you are not trapped. Two-factor on the manager account itself — this vault is the prize.
Browser “save password” features are better than reuse. A dedicated manager is better than the browser when you want the same vault on several browsers and a phone, with a clearer security story.
Avoid random “password cleaners” from ads. They ask for the keys to the kingdom and sometimes are the opposite of security software.
How to move without a weekend of pain
Install the app. Create the vault. Turn on 2FA. Change the email password first and save it. Then change the Apple or Google account. Then banking. Then the rest as you log in over a few weeks. You do not need a heroic night.
Delete saved passwords from the browser after the manager has them, or you will drift back to two sources of truth.
Share a vault only with people who should have those logins. Family sharing exists in some products. Treat it like a spare house key.
When a manager is not enough
If the device is unlocked and malware is reading the screen, the manager can still fill a password into the wrong hands. Lock the screen. Keep the OS updated. Do not install mystery extensions that can read every field.
If you forget the master password and you skipped recovery, the vault is gone. Write the master password on paper and put it somewhere you would put a spare card — not in the same backpack as the laptop.
A password manager is not extra work. It is less work than remembering, and far less work than recovering ten accounts after one reused string leaks.