Why You Need a Password Manager (and a 30-Minute Setup)

You need a password manager because the alternative is reusing passwords, and reuse turns one company's data breach into access to your other accounts. Criminals take leaked email-and-password pairs and try them automatically on email, banking and shopping sites — a technique called credential stuffing. A password manager breaks that chain by generating a different strong password for every site and filling it in for you, so a leak at one service stays at that service. The UK's National Cyber Security Centre (NCSC) recommends exactly this: a manager lets you use unique passwords everywhere without having to remember them, and if you have never used one, "you should try it".

How reuse turns one leak into many

Picture a typical chain:

• A forum you joined years ago is breached; your email and password end up in a leaked file.
• That file is bought or shared, and a script tries the same pair on popular email providers.
• Your email password is the same, so the script gets in.
• From your inbox, the attacker resets your other passwords — bank, cloud storage, social media.

Nothing in that chain requires anyone to guess anything. Have I Been Pwned, the free breach-lookup service, listed 1,045 breached websites and more than 17.8 billion compromised addresses when we checked on 16 October 2026 — so the starting material for this attack is plentiful. Check your own addresses there before you start.

What a password manager changes

• Every password is unique and random, so a leak at one site is useless anywhere else.
• It fills logins only on the matching website, which also helps you notice a fake look-alike page — a manager that will not autofill is a warning sign.
• It warns you about reused, weak and breached passwords already in your vault.
• It syncs across devices, so strong passwords are no harder to use on your phone.

"But what if the password manager is hacked?"

It is the right question, and the 2022 LastPass incident gives a real answer. LastPass said an attacker copied a backup of customer vault data. Usernames, passwords, secure notes and form data in those vaults were fully encrypted; website URLs were not. The encrypted parts can only be unlocked with each user's master password, which LastPass never stores — so the risk fell on people whose master password was weak enough to guess offline. LastPass said it had required a 12-character minimum since 2018.

The lessons, which apply to any provider:

• Your master password is the real lock. Make it long and unique — see how to create a master password.
• Turn on two-step verification for the manager itself, as the NCSC advises, so a stolen master password alone is not enough.
• Choose a provider that encrypts on your device and publishes how its encryption works. Our explainer on what a password manager is walks through how the vault is protected.

Browser password saving or a dedicated manager?

The NCSC says saving passwords in your browser on your own devices is safe and "the easiest way to remember your passwords" — far better than reusing them. Never save them in a browser on a shared or public computer. A dedicated manager adds things a browser may not: sharing with family, secure notes, storing 2FA codes, breach alerts and use across different browsers and operating systems.

The 30-minute setup plan

Minutes 0–5: choose and install. Pick a manager (our best password managers guide compares them), install the app and the browser extension.

Minutes 5–10: create the master password and turn on 2FA for the manager account. Write the master password on paper and keep it somewhere safe at home until you have memorised it.

Minutes 10–15: import. Most managers import saved passwords from browsers. Afterwards, turn off the browser's own saving so you are not maintaining two lists.

Minutes 15–30: fix the most important accounts first — email, then banking and payment, then your mobile-phone account, then cloud storage. Replace each password with a generated one and turn on 2FA while you are there.

Over the next two weeks: whenever you log in somewhere, let the manager replace the old password. The weak-password report will shrink without a marathon session.

Frequently asked questions

Do I really need a password manager?

If you reuse any password, yes — reuse is what lets one breach spread to your other accounts. A manager makes unique passwords effortless. If you already use unique passwords saved in your browser on your own devices, the NCSC considers that safe; a manager adds sharing, cross-platform use and alerts.

Is it safe to keep all my passwords in one place?

With a strong, unique master password and two-step verification on the manager, yes for most people. The LastPass incident showed that vault contents stay encrypted in a provider breach; weak master passwords were the real exposure.

Is it safe to save passwords in my browser?

On your own devices, the NCSC says yes. Never save passwords in a browser on a shared or public computer, and keep your devices updated.

What should I change first after installing one?

Your email password, then banking and payment accounts, then your mobile-phone account and cloud storage — email first because it can reset everything else.

Why Reuse Is the Whole Problem

Credential stuffing works for one structural reason: attackers do not need to break your password, they need someone else to lose it. The chain is short and it does not require you to have made a mistake:

• A service you used is breached, and credentials are exposed.
• Those credentials appear in a compiled list, which is cheap and widely traded.
• The list is replayed automatically against many other services.
• Anywhere you reused that email and password, the attacker is now signed in.

Note what is absent from that chain: any attack on you, any weak password of yours, and any way for you to detect it. Password strength does not defend against it at all. Uniqueness does, completely, because a leaked credential then unlocks exactly one account.

Where to Start When Everything Feels Like a Priority

Doing all your accounts at once is what makes people abandon the project. Do them in this order and the exposure drops fastest:

Your email account is genuinely the master key, and it is the one people secure last. Anyone controlling it can reset most of the rest, which is why it is tier one on its own.

The Objections, Answered Briefly

• "One breach exposes everything." Vaults are encrypted with a key derived from

your master password, which the provider does not hold. A breach of the provider yields encrypted data. Reuse across dozens of sites, by contrast, exposes everything the moment any single one of them is breached — which happens routinely.

• "I'll be locked out." Set up recovery when you set up the vault, not later:

an emergency kit, a recovery code stored offline, and a second device already enrolled. This is the one setup step worth doing carefully.

• "My browser already does it." Browser storage is genuinely better than reuse.

Dedicated managers add cross-browser access, secure sharing, breach alerts and stronger recovery. Either beats what most people do now.

Then add a second factor on the tier-one and tier-two accounts, which is what actually stops a stolen password from being enough — two-factor authentication explained covers which type to choose.

Next steps

Ready to choose? Compare NordPass and Proton Pass in our NordPass review and Proton Pass review, or see the side-by-side 1Password vs Bitwarden.

Sources checked 16 October 2026: NCSC, "Top tips for staying secure online — password managers"; LastPass, "Notice of Recent Security Incident" (update of 22 December 2022); haveibeenpwned.com. Editorial content.