Password managers store and generate credentials, helping reduce password reuse while creating security risks if a vault or master key is compromised.
Search across headline titles and summaries.
Background for this topic.
Password managers are applications or services that generate, store, and fill credentials from an encrypted vault. Access typically depends on a master password, sometimes supplemented by multi-factor authentication (MFA); this lets each account use a long, unique secret without requiring users to memorize it. Some also store passkeys, recovery codes, or other sensitive notes, making the vault a high-value asset.
Security depends on both cryptography and surrounding software: a compromised desktop client, browser extension, synchronization service, or malicious update could expose secrets, while a weak master password or unsafe recovery process can undermine the vault. Origin-aware autofill can reduce phishing exposure, but users should verify login domains and avoid importing or sharing credentials unnecessarily. Practitioners should examine encryption and key handling, MFA and recovery controls, update history, breach disclosure, logging, and enterprise offboarding and credential-rotation features.
Be aware: a rash of phishing campaigns are leveraging the anxiety and trust employees have in password vaults securing all of their credentials.