How do password managers work?

Signing up for online accounts is annoying, and creating strong passwords for each one makes it even worse. That’s why so many people reuse the same password across different accounts. But this can be dangerous. If a password gets leaked, all your other accounts could be at risk too.

Luckily, there’s an easy fix. Password managers can create strong and unique passwords for you and store them safely so you don’t have to remember them. Many password managers even offer free trials, so you can try them out without risk.

One of the best options, in my opinion, is NordPass. It’s simple to use, packed with useful features, and helps keep your accounts secure. Plus, most password managers offer 30-day money-back guarantee.

How to create a strong password?

1. Create a password of at least 12 characters
2. Combine lowercase and uppercase letters, as well as symbols and numbers
3. Avoid common passwords: pick something entirely unpredictableGet a reliable password manager – I recommend NordPass, now 52% OFF

Keep reading to find out how password managers work and how you can use them to make yourself safer on the web.

What is a password manager?

A password manager is a program that allows you to generate complex passwords and store them in a safe location. Most of them let you keep credit card information, as well as secure notes.

For even more security and convenience, the best password managers also support biometric data (fingerprint or face) instead of your master password. You can also share selected information with your family and friends without copy-pasting it into an email or instant message.

Check out the Best password managers in 2025

Therefore, instead of memorizing all the login information you use for each site, you only have to remember 1 master password when using a password manager. Thanks to the autosave and autofill features, you can connect to all your accounts in just a few clicks.

Try NordPass 30-day Premium trial

Forget about using one easy-to-remember password for all accounts or noting down your logins on a sticky note. With NordPass, you can make sure that every password is unique and reliably protected against data breaches and sneaky spies.

cybernews® score

4.9 /5

• 30-day Premium trial included
• Autosave and autofill
• Data Breach Scanner

Try NordPass FREE

How do password managers secure your passwords?

There are multiple ways to categorize password managers. However, this time, I want to present 3 technologies and explain how they work. Keep in mind that some providers offer multiple methods to keep your data safe. Most of them require you to use a master password to protect your vault.

Here are the 3 types of password managers:

• Locally installed or offline password managers
• Web-based or online password managers
• Stateless or token-based password managers

Let's explore each of them more thoroughly.

Locally installed or offline password managers

As the name implies, locally installed password managers, also known as offline password managers, store your data on your device. It can be your computer or a smartphone, depending on your preference. You can find your passwords in an encrypted file, separately from the password manager itself. Some managers also allow storing each password in a separate file, greatly increasing overall security.

As always, you need a master password to access your offline vault. If it’s a strong one, there’s minimal chance that either the government or some malicious hackers will break into your local database. That’s because brute-forcing new-gen encryption requires a significant amount of time. What’s more, if you keep that device with all passwords offline, there’s no way to access it without seizing it.

Naturally, offline password managers have some inherent flaws. For starters, using them on multiple devices might prove challenging. There’s only 1 location, and other devices somehow have to sync with the one that has the vault. It usually means having your device with the locally installed password manager online, which can become accessible to third parties. Finally, if the device with your offline password manager breaks down and you have no backup, be ready for some tedious manual labor.

If you have an offline or locally installed password manager, then your passwords are stored locally. To be more precise, it’s the device that you’ve chosen for your vault. However, there’s a possibility to synchronize the passwords between multiple devices, which means all of them must be online. If you want even more security, you can save your passwords on different files, requiring a unique key for each.

Web-based or online password manager services

The most popular type is the web-based password manager. It stores your passwords on a cloud, which is usually the provider’s server. Such a setup means that you can access your passwords from anywhere, anytime, without the need to install the online password manager software. If accessing your vault via a web application is not possible, you would only need a browser extension or a mobile app.

How can you know if your passwords are not accessible to the provider? Well, all reputable online password managers use zero-knowledge technology. It means that they encrypt your data on your device before sending it to the server. However, all security measures mean nothing if there’s keylogger malware on your device and you’re not using 2-factor authentication.

Finally, you should expect to pay for a web-based password manager. There are great free versions to choose from, but some features like device limit or dark web scanning will most likely be a premium feature. That said, most paid online password managers aren’t expensive, especially if you commit long-term.

Needless to say, if you choose an online (or web-based) password manager, your passwords are stored online. Your vault is on the provider’s server, available 24/7 to you from anywhere, as long as you have the master password. Most of the time, you don’t even need to install the password manager client and a browser extension is enough. Sometimes, you can access the vault via a web application available on the provider’s website.

Stateless or token-based password managers

Last on the list are token-based or stateless password managers. In this scenario, a local piece of hardware, such as a flash USB device, contains a key to unlock your particular account. There’s also no such thing as a password vault because the password manager generates them anew every time you log in. For additional safety, use the token and your master password at the same time. This way, you are implementing 2-factor authentication.

Stateless password managers don’t require synchronization between your devices because there’s no database in the first place. In a way, that’s also safer because there’s no place where a hacker can find all your passwords. Although, someone can hack token-based passwords if they know the master password.

Contrary to online password managers, these are usually free and open-source. That’s why they are not particularly recommended for amateur users because all the support they can get are forums and knowledge bases. On top of that, you need a smart card reader or a USB stick to generate tokens.

Moreover, if you find yourself using a token-based password manager, that means your passwords are not stored anywhere. As the name implies, there’s no password vault, only token generation, whenever you access a specific account. You can generate a token on an external device, such as a USB stick.

How to manage passwords with a password manager: video review

Want to know more about password managers? Watch this comprehensive video explanation about password managers and how they work.

How do password managers encrypt passwords?

256-bit AES encryption is a new-gen cipher used to encrypt and decrypt data so only authorized parties can access it. The NSA and major corporations adopted it in 2005, and it soon became the standard for VPNs, firewalls, and password managers.

While AES is the encryption standard, 256-bit is the key. Encryption keys are random strings of zeroes and ones. In this case, it means there are 2^256 combinations available. The more combinations, the harder it is to brute-force the right one.

AES 256-bit is a so-called symmetric or private key encryption algorithm. The key is used both for encrypting and decrypting data, so both parties must know it. In contrast, asymmetric or public-key encryption uses a public key for encryption and a private key for decryption. In contrast, the private key doesn’t have to leave your device, increasing security.

Not all password managers use AES-256 encryption. Some use the less secure, although still extremely hard to brute-force, AES 128-bit standard. Usually, these are free and open-source password managers that get less-frequent updates.

However, there's already better encryption than AES 256-bit that goes by the name of XChaCha20. So far, only NordPass has implemented this next-gen cipher among all premium password managers. It comes with Argon2 for key derivation, while XChaCha20 encrypts your password vault.

Why use a password manager?

Here are the reasons why you should use a password manager:

1. Password generators. You don’t need to spend 15 minutes to come up with a new and unique password. Most password managers allow you to generate a safe password with varying complexity. Not only does this save you time, but it also comes up with better passwords.
2. Easy password management. Password managers not only help create safe passwords but also allow you to administrate all your logins from 1 application. A lifesaver for those using a multitude of websites and platforms.
3. Automated autofilling. Most password managers have a built-in feature that allows you to auto-fill passwords and other recurring information. It extends to your payment information or addresses. It saves you the hassle of needing to remember every single one of your passwords.
4. Secure password sharing. Many people are sharing accounts with their friends and family. Netflix even allows different users to log in with the same password. The password manager allows users to securely share passwords with other users.
5. Cross-platform support. As applications, password managers are not at all complicated and do not require a lot of resources. It means that it’s much easier to develop them for a variety of platforms like web browsers or smartphone apps. For the end-user, this means an ability to get the same password vault no matter what’s your preferred method of connection.
6. Multi-factor authentication. Even if a malicious hacker installed a keylogger and got your master password, this wouldn’t mean the end of the world if you have 2FA enabled. The master password is useless without it, and the vault would stay locked.

Password manager setup

The setup depends on what type of password manager you are planning to use. If it’s token-based, first you need to decide what kind of device you want to use for key generation. In case you’ve decided on an offline password manager, you should also choose the primary device that will store your database. However, if you’re leaning towards an online service, narrowing down your selection to a free or paid option can save you plenty of time.

7-step password manager setup

Since the web-based password managers are the most user-friendly, I use them as an example. Below are the key steps in setting up a password manager:

1. Decide which devices you want to use your password manager on. It can be a personal phone, shared home devices, such as tablets and smart TVs, or a work computer. This is one of the most important questions to ask yourself before setting up your vault.
2. Install your chosen password manager. There are plenty of free and paid versions to choose from, but I recommend using 1Password. You should check what features are available on the free version (if any) and whether the added perks justify the price. Afterward, make sure it supports your OS and browser. If you're planning to import your current vault, check if it's possible first. Finally, paying a bit more for 24/7 customer support often pays off.
3. Create a secure master password. Even if your selected password manager allows master password recovery, you should still choose one that's memorable but hard to guess. To fulfill the last requirement, it may be a good idea to use a passphrase containing 4-5 randomly chosen words. Lastly, while this may sound odd, consider sharing your master password with the person you trust the most so they can access your vault if something happens to you.
4. Enable two-factor authentication (2FA). Adding 2FA to the mix greatly improves your password security. While the second factor can be something that you have, which is probably your smartphone, I recommend using biometrics. Depending on your device, it can either be a fingerprint or also a face scan. What's more, you can use 2FA instead of the master password, which significantly improves usability on touchscreen devices.
5. Start entering passwords. Before you get used to your new password manager, and while you still cannot remember your master password that well, you may want to enter less important passwords first. A good idea is to generate a strong password for the email that you use to recover the master password. Otherwise, a threat actor can easily get a hold of your database after breaking into your mailbox.
6. Consider adding other data. The majority of password managers let you save credit card details and secure notes as well. If you shop online often, having the payment info in autofill can save quite some time. Moreover, you can store important files there.
7. Share your logins. Copy-pasting the username and password is not the best idea, so that's why most password managers allow you to share logins with others. Some services even allow you to create folders where you can store the least-sensitive and often-shared passwords.

Can password managers work on multiple devices and phone apps?

Not all password managers can work on multiple devices, including smartphones. A stateless password manager is based on the idea that only 1 device can generate passwords for your accounts. What's more, there's no such thing as a password vault that you could check.

Locally installed password managers are also not suited for use on a bunch of devices. That's because you are saving your database on 1 computer or smartphone. While syncing between all devices is possible, it is not convenient. Of course, if you decide to use multi-factor authentication, you will probably need two compatible devices.

Web-based password managers do work on multiple devices, mobile apps, and even browser extensions. Some also offer web applications accessible from the provider's website. Your vault is stored in the cloud, meaning that the password manager is as device-agnostic as it can be to guarantee maximum usability. The actual scope entirely depends on the particular service that you’re using.

Such industry-standard password managers as NordPass, RoboForm, and 1Password enable you to protect your passwords on an unlimited number of devices at once. They synchronize data to keep everything up-to-date too.

FAQ