In plain words
Using the same password everywhere is like having a single key for your house, your car, your office and your letterbox: if one burglar copies it, everything is open. A password manager is a double-locked key ring holding a different key for every door. You only have to remember one thing: the key ring's combination.
Most hacked accounts are not broken by a computer genius who "guesses" a password. They are hacked because the same password was used on several sites, and one of those sites had its database stolen.
The real danger: reuse
When a site is breached, lists of e-mail addresses and passwords start circulating. Programs automatically try them on thousands of other sites: e-mail, bank, social networks, online shops. This is called credential stuffing.
As a result, a complex but reused password is less safe than an average but unique one.
Important
The golden rule: a different password for every account. Nobody can remember a hundred different passwords, and that is exactly what a password manager is for.
How a password manager works
A password manager is an encrypted vault that:
- generates a long, random password for each site;
- remembers it for you;
- fills it in automatically on the right site, and only on that site, which also protects you against fake phishing sites.
You only have one password left to remember: the vault's, called the master password.
Which password manager?
| Type | Examples | For whom |
|---|---|---|
| Built into the browser or phone | Firefox or Chrome password manager, iCloud Keychain, Google Password Manager | To get started right away, if you stay within one ecosystem |
| Synced across devices | Bitwarden, Proton Pass, 1Password | For use on computer and phone from different brands, and family sharing |
| Local software, no cloud | KeePassXC (computer), KeePassDX (Android) | To keep full control of the file, which you sync yourself. Requires a bit more discipline: see the box below |
Open-source solutions (Bitwarden, KeePassXC) have public code, reviewed by experts. All reputable password managers encrypt the vault on your device: the provider does not know your master password.
With KeePassXC, the vault is a file
Bitwarden or Proton Pass sync on their own. KeePassXC, on the other hand, stores all your passwords in a single file (.kdbx extension) and does not sync it. Three traps catch beginners:
- Creating two vaults without realizing it: when you install KeePassXC on the computer and KeePassDX on the phone, each creates its own file; passwords added on one side do not appear on the other. You must open the same file on both devices.
- Opening the wrong copy: keep the file in a single known place (not in Downloads) and always open that one.
- Creating a conflicted copy: if the file is synced by Nextcloud, Syncthing or an online service and changed on two devices before syncing, the service keeps two versions. Nothing is lost: the Merge From Database function in KeePassXC's Database menu brings the two files together, keeping the most recent version of each entry.
Back up this file like your other important documents. If you also use a key file, back it up too: without it, the vault no longer opens. To start simply, Bitwarden avoids all these traps.
A good master password: the passphrase
The master password must be long, unique and memorable. The best method is a passphrase: four to six words picked at random, for example with dice or your password manager's generator.
giraffe-blotter-tropic-lantern-fifteen
It is much longer than a classic password, so much harder to crack, and yet easy to remember. Avoid quotes, song lyrics or well-known phrases: they are in attackers' dictionaries.
Warning
If you forget the master password, the provider usually cannot recover it. Write it down on paper and keep it somewhere safe, along with the emergency kit most password managers offer.
Add two-factor authentication
Two-factor authentication (2FA) asks for a second proof on top of the password: a code in an app, a notification on your phone, a physical security key. Even if your password leaks, the account stays protected.
Enable it first on:
- your main e-mail address: it is the one that can reset all your other accounts;
- your password manager;
- your bank, tax account, social networks and shops with a saved card.
Prefer an authenticator app or a security key over SMS, which is easier to hijack. When a site offers passkeys, you can use them: they replace the password and resist phishing.
Your plan for one evening
- Install a password manager on your computer and phone, with the same account (Bitwarden, Proton Pass) or the same file (KeePassXC and KeePassDX).
- Choose a master passphrase and write it down on paper.
- Change the password of your main e-mail address first, and enable two-factor authentication.
- Do the same for your bank and important accounts.
- For the rest, change each password as you go, whenever you log in to the site.
Tip
Check whether your address has already been exposed in a data breach on Have I Been Pwned. If so, start with the accounts concerned.