How do password managers work?

Remembering all our logins and passwords is becoming virtually impossible, especially if you want to keep your accounts secure by using a different, strong password for every service. Reusing the same password may seem convenient, but if one account is compromised, attackers could use those credentials to access others.

Fortunately, password managers can help you keep track of your accounts. They generate unique passwords, store them securely, and autofill your credentials when needed. Many also offer free plans, although these typically come with feature or usage limits.

NordPass is my personal pick for its straightforward interface, useful features, and strong security.

How to create a strong password?

1. Use long, unique passwords
2. Prefer randomly generated passwords or passphrases
3. Avoid common or compromised passwords
4. Use a password manager to generate and store unique passwords – I recommend NordPass, now 61% OFF

What is a password manager?

A password manager is a program that stores your passwords in a secure vault and automatically fills in your login details when you have to log in. It means you don't have to remember any of your passwords, allowing you to use complex and unique passwords for all of your accounts. Password managers also include password generators to help with that. Most of them also let you store credit card information, personal details and even attach files.

For even more security and convenience, the best password managers also support biometric data (fingerprint or face) instead of your master password. You can also share selected information with your family and friends without copy-pasting it into an email or instant message.

Therefore, instead of memorizing all the login information you use for each site, you typically only have to remember one master password to unlock your vault. Thanks to the autosave and autofill features, you can connect to all your accounts in just a few clicks.

How do password managers secure your passwords?

There are multiple ways to categorize password managers. However, this time, I want to present 3 technologies and explain how they work. Keep in mind that some providers offer multiple methods to keep your data safe. Most of them require you to use a master password to protect your vault.

Here are the 3 types of password managers:

• Locally installed or offline password managers
• Web-based or online password managers
• Stateless or token-based password managers

Let's explore each of them more thoroughly.

Locally installed or offline password managers

As the name implies, locally installed password managers, also known as offline password managers, store your data on your device. It can be your computer or a smartphone, depending on your preference. You can find your passwords in an encrypted file, separately from the password manager itself. Some managers also allow storing each password in a separate file, greatly increasing overall security.

As always, you need a master password to access your offline vault. If it’s protected with strong encryption and a strong master password, an attacker would generally have a very difficult time accessing the contents of the database through brute-force attacks. That’s because brute-forcing new-gen encryption requires a significant amount of time.

Keeping the device offline reduces its exposure to remote attacks, although physical access isn't the only way an attacker could potentially compromise a device or its data.

Naturally, offline password managers have some inherent flaws. For starters, using them on multiple devices might prove challenging. There’s only one location, and other devices somehow have to sync with the one that has the vault. It usually means having your device with the locally installed password manager online, which can become accessible to third parties. Finally, if the device with your offline password manager breaks down and you have no backup, be ready for some manual labor.

If you have an offline or locally installed password manager, then your passwords are stored locally. To be more precise, it’s the device that you’ve chosen for your vault. However, there’s a possibility to synchronize the passwords between multiple devices, which means all of them must be online. If you want even more security, you can save your passwords on different files, requiring a unique key for each.

Web-based or online password manager services

The most popular type is the web-based password manager. It stores an encrypted copy of your vault on cloud infrastructure, allowing you to synchronize it across devices. This type of setup means that you can access your passwords from anywhere, anytime, without the need to install the online password manager software.

Since most reputable online password managers use zero-knowledge technology, they can't access your password themselves. It means that they encrypt your data on your device before sending it to the server.

Many web-based password managers offer both free and paid plans, with premium tiers typically adding features such as expanded device support, sharing, monitoring, or advanced security tools. That said, most paid online password managers aren’t expensive, especially if you commit long-term.

Needless to say, if you choose an online (or web-based) password manager, your passwords are stored online. Your vault is on the provider’s server, available 24/7 to you from anywhere, as long as you have the master password. Most of the time, you don’t even need to install the password manager client and a browser extension is enough. Sometimes, you can access the vault via a web application available on the provider’s website.

Stateless or token-based password managers

Stateless or token-based password managers work differently from traditional password managers. Instead of storing your passwords in a vault, they generate passwords or credentials when you need them, often using a secret key, hardware token, or another authentication method.

Because there is no traditional password database to store and synchronize, these solutions can reduce the risk associated with a centralized vault. However, they can also be less convenient than conventional password managers, particularly if you use multiple devices.

Some stateless solutions use a USB device or hardware token to store the key needed to generate or access your credentials. Depending on the system, you may also need a master password or PIN. Using both a physical token and a password can provide an additional layer of protection, although this setup is not automatically the same as standard 2FA.

The main drawback is that losing the required token or key can make it difficult to recover your accounts. These solutions are also less common than cloud-based or locally stored password managers and may require specialized hardware or software.

How to manage passwords with a password manager: video review

Want to know more about password managers? Watch this comprehensive video explanation about password managers and how they work.

How do password managers encrypt passwords?

AES-256 is a widely used symmetric encryption standard for encrypting and decrypting data, ensuring that only authorized parties can access it. While AES is the encryption standard, 256-bit is the key. Encryption keys are random strings of zeroes and ones. In this case, it means there are 2^256 combinations available. The more combinations, the harder it is to brute-force the right one.

AES 256-bit is a so-called symmetric or private key encryption algorithm. The key is used both for encrypting and decrypting data, so both parties must know it. In contrast, asymmetric or public-key encryption uses a public key for encryption and a private key for decryption.

Some password managers use XChaCha20 instead of AES-256. Both are modern cryptographic algorithms designed to provide strong protection when implemented correctly. For instance, NordPass uses XChaCha20 to encrypt vault data and Argon2id for key derivation.

Why use a password manager?

Here are the reasons why you should use a password manager:

1. Password generators. You don’t need to spend 15 minutes to come up with a new and unique password. Most password managers allow you to generate a safe password with varying complexity. Not only does this save you time, but it also comes up with randomly generated passwords that are much harder to guess or crack through brute-force attacks.
2. Easy password management. Password managers not only help create safe passwords but also allow you to administrate all your logins from one application. A lifesaver for those using a multitude of websites and platforms.
3. Autosave and autofill. Most password managers have a built-in feature that allows you to autofill passwords and other recurring information. It extends to your payment details or personal information.
4. Secure password sharing. Many people are sharing accounts with their friends and family. A password manager allows users to securely share passwords with other users without revealing the actual password itself.
5. Cross-platform support. Many password managers offer apps and browser extensions for Windows, macOS, Linux, Android, and iOS, allowing you to access and autofill credentials across your devices.

Password manager setup

Since the web-based password managers are the most user-friendly, I will use them as an example. Below are the key steps in setting up a password manager

1. Install your chosen password manager. There are plenty of free and paid versions to choose from, but I recommend using NordPass. You should check what features are available on the free version (if any) and whether the added perks justify the price. Afterward, make sure it supports your OS and browser. If you're planning to import your current vault, check if it's possible first; however most password managers provide support password importing.
2. Create a secure master password. Choose a long, unique password or passphrase that you can remember. Check how your provider handles account recovery before you start, as recovery options vary between password managers.
3. Enable two-factor authentication (2FA). Where available, use an authenticator app, security key, or another supported second factor to protect your password manager account. Biometrics can make unlocking the app more convenient, but biometric unlocking and MFA aren't necessarily the same thing.
4. Add your passwords. Before you get used to your new password manager, and while you still cannot remember your master password that well, you may want to enter less important passwords first. Make sure the email account associated with your password manager is protected with a strong, unique password and MFA.
5. Consider adding other data. The majority of password managers let you save credit card details and secure notes as well. If you shop online often, having the payment info in autofill can save quite some time. Moreover, you can securely store important files there, such as a copy of your ID or driver's license.

Can password managers work on multiple devices and phone apps?

Not all password managers can work on multiple devices. Stateless password managers can generate credentials on multiple devices because they don't rely on synchronizing a traditional vault. Local password managers can work across multiple devices, but synchronization may require manual file transfers or a separate sync method. That's because you are saving your database on a single device. While syncing between all devices is possible, it's quite a hassle.

Online password managers support cross-sync and work on multiple devices. Many also offer web applications accessible from the provider's website. Your vault is stored in the cloud, meaning your data can be easily accessed on any device you install the password manager to.

FAQ