The Reused-Password Problem
The world's largest source of account compromise is not sophisticated hacking — it is credential stuffing. Attackers take a list of email + password combinations leaked from one site, and try them on hundreds of other sites. Anywhere the user reused the same password, the attacker now has access.
The only practical defence is a unique, random password for every account. No human can remember hundreds of unique passwords. That is what a password manager is for.
What a Password Manager Actually Does
A password manager:
- Generates strong random passwords (e.g.
v#7k2!QmZ9pL3aXr). - Stores them in an encrypted vault — protected by one strong master password and (ideally) MFA.
- Auto-fills them in your browser and apps.
- Audits your existing passwords for reuse and known breaches.
You stop remembering passwords. You only have to remember one — the master password.
"But Isn't That a Single Point of Failure?"
Yes. And it is still vastly better than the alternative.
A serious password-manager vendor:
- Encrypts your vault client-side with a key derived from your master password.
- Never stores your master password — not even hashed.
- Has been audited by independent security firms.
- Offers MFA on the vault itself.
The cost of one strong master password protecting hundreds of unique passwords is far lower than the cost of reusing a single password everywhere.
What to Look For in 2026
1. Open-Source or Independently Audited
Closed-source password managers can still be good, but transparency is increasingly important after several high-profile breaches in the past few years.
2. End-to-End Encryption
The vendor must be unable to read your vault, even if compelled.
3. Cross-Platform Sync
Native apps on every platform you use — desktop, mobile, browser — with reliable, conflict-free sync.
4. Hardware-Key MFA
The vault should support FIDO2/WebAuthn hardware keys (YubiKey, etc.), not just TOTP.
5. Secure Sharing
If you need to share credentials with a partner or team, the manager should support it without sending the password in plaintext.
6. Passkey Support
Passkeys are gradually replacing passwords on major sites. A modern password manager should store and sync passkeys too.
7. A Reasonable Threat Model
Self-hosting is great for technical users; cloud-hosted services are great for everyone else. Pick the model whose trust assumptions you actually understand.
Popular Options (Not an Endorsement)
- 1Password — polished, family-friendly, paid.
- Bitwarden — open source, free tier, self-host option.
- KeePassXC — fully offline, free, you handle sync yourself.
- Proton Pass — newer, integrated with Proton's privacy ecosystem.
Avoid storing passwords in your browser's built-in manager as your primary solution: it offers minimal protection if your machine is compromised by an infostealer.
Migration Without Pain
You do not have to rotate every password at once. Practical sequence:
- Install the manager.
- Pick a long, memorable master password — 4–5 random words is fine.
- As you log into sites over the next few weeks, save the password into the vault.
- For high-value accounts (email, bank, work) generate a new random password and update.
- Periodically use the vault's audit feature to find reused or breached passwords and rotate them.
In a few months you will have eliminated your single biggest source of account-takeover risk — and you will never type a password again.