Here’s how most accounts get “hacked”: the specific service you use was never breached at all. What happened is that some other site — a forum you joined in 2016, a pizza delivery app, a shopping site you used once — got breached. Attackers took the leaked email and password combination from that breach and ran it automatically against Gmail, your bank, Amazon, PayPal, and hundreds of other sites. One of those matched. That attack has a name: credential stuffing. It works because most people reuse passwords.
The average person uses 3 to 7 passwords across more than 100 accounts. When any one of those accounts is breached, every other account sharing that password is now at risk. And breaches happen constantly — Have I Been Pwned, the public breach database, contains over 14 billion compromised accounts.
The solution is not a stronger version of the same password. The solution is a unique password for every site, which no human can actually remember without help.
The password reuse problem
Attackers don’t manually try stolen passwords. They run automated tools that test credential pairs across thousands of sites per second. After a major breach, leaked lists circulate within hours. By the time the breached company notifies users, the credential stuffing attacks are already underway.
Your banking password is the same as your email password is the same as your Netflix password. So when a breach hits any of those sites — even one you consider unimportant — every account tied to that password is exposed. This isn’t a theoretical risk. It’s how the majority of account takeovers actually happen.
Consider what happened after the RockYou2021 compilation was posted online: over 8.4 billion password entries aggregated from years of breaches, all in a single searchable file. Any password you’ve ever used that appeared in any breach is now in that list. Attackers use these compiled lists to test credentials across banks, email providers, and shopping sites automatically and at scale.
Making your password longer or more complex doesn’t solve the problem if you’re reusing it. A 20-character password reused across 10 sites is still 10 accounts waiting to fall when one site gets breached. The math only works in your favor when every password is unique.
A unique, random password for every site means a breach at any one site exposes exactly that site. Nothing else. That’s the entire goal.
What a password manager actually does
A password manager stores your passwords in an encrypted vault. You remember one master password; the manager remembers everything else.
It generates strong random passwords for every new account — passwords like xK9#mP2!qR7@vL that no attacker can guess or brute-force in any reasonable timeframe. It auto-fills those passwords on websites and apps so you never need to type or remember them. Most managers also include breach monitoring, which alerts you when a site you have a saved account for is reported as compromised.
The vault syncs across your devices. Log in from your laptop, your phone, your tablet — your passwords are there, encrypted, without you having to think about it. Some managers also store additional information alongside passwords: credit card numbers, secure notes, software license keys, passport details. The vault becomes a general-purpose secure document store, not just a password list.
The generator is the feature that makes the whole system work. You don’t need to think of a strong password. You click “generate,” get something like mR4!xQ9#kL2@nP7, and save it. You’ll never type it by hand — the manager fills it for you. The password being unmemorable is a feature, not a bug.
The result: 100 accounts, 100 completely unique passwords, and you only remember one thing.
The “what if it gets hacked” question
This is the objection almost everyone raises. It deserves a direct answer.
Zero-knowledge encryption is how reputable password managers protect your data. Your master password never leaves your device. The company stores only an encrypted blob — a scrambled version of your vault that is mathematically useless without your master password. Even the company running the service cannot read your passwords. Even if their servers are breached, attackers get encrypted data they cannot use.
LastPass is the real-world test case here. In 2022, LastPass was breached. Attackers accessed encrypted user vaults. Users with strong master passwords were safe — their vaults were encrypted with something uncrackable. Users with weak master passwords (short, common, or reused) were at genuine risk, because weak master passwords can be attacked offline once the encrypted vault is obtained.
The lesson is not “password managers are dangerous.” The lesson is this: your master password is the one password that actually has to be strong. Everything else the manager handles.
Choosing your master password
This is the one password you’ll ever need to remember, and it has to be good.
A passphrase — four or more random unrelated words — is more secure and easier to remember than a complex short password. “correct-horse-battery-staple” is 28 characters and has more entropy than “P@ssw0rd!” (which attackers try first anyway, because everyone thinks punctuation-substitution is clever). Pick words that are genuinely random, not a sentence you know.
Never reuse your master password anywhere. Never use your name, birthday, pet’s name, or anything guessable. Write it down and store it somewhere physically secure if needed — a piece of paper in your home is far less risky than a weak or reused password.
After setting your master password, enable two-factor authentication on your password manager account. This is the single highest-priority account you own. Protecting it with 2FA means that even if someone learns your master password, they still need your phone to get in.
The main password managers compared
Bitwarden is the recommendation for most people. It’s open source, so the code is publicly audited. The free tier covers all essential features most users need, and premium costs $10 per year, less than one streaming service. It has passed independent security audits and supports self-hosting for users who want complete control over where their data lives. Cross-platform: Windows, macOS, Linux, iOS, Android, and every major browser.
1Password costs $36 per year for individuals, $60 for families. The user experience is excellent — arguably the most polished in the category. It includes Travel Mode, which hides specific vaults when you cross a border, useful if you’re concerned about device searches. No free tier. Best choice for families or teams that want to pay for a better experience and collaborative features.
Proton Pass is built by the same team behind ProtonMail, a well-regarded privacy-focused email provider. Open source, free tier available, and $4.99 per month for premium. A natural fit for users already using ProtonMail or Proton VPN.
Dashlane costs $60 per year and includes a bundled VPN. The VPN adds cost without meaningfully improving password security. Better alternatives exist at lower prices unless you specifically want the bundle.
Apple iCloud Keychain is free and deeply integrated into Safari, iOS, and macOS. If you only use Apple devices and have no plans to leave, it’s a reasonable option. It has no Android client and no meaningful path out if you ever switch platforms. Passkey support is solid.
Google Password Manager is free and built into Chrome and Android. It’s convenient. It also ties your credentials directly to your Google account, which means a compromised Google account compromises everything. Cross-platform coverage only works within Google’s ecosystem.
LastPass was the dominant password manager for years. The 2022 breach, and particularly how the company handled the disclosure (slowly, with minimal transparency), eroded the trust the product depends on. Avoid it. The alternatives are better.
The short version: Bitwarden for most people. 1Password for families or teams who want to pay for superior UX.
Getting started: the migration that takes one evening
You don’t need to migrate every password at once. Focus on the accounts that matter most and work outward.
- Download Bitwarden (or your chosen manager) and install the browser extension for Chrome, Firefox, Safari, or Edge.
- Create your account with a strong master passphrase. Write it down somewhere safe.
- Enable two-factor authentication on the manager account before doing anything else. Use an authenticator app (Google Authenticator, Authy) rather than SMS if possible.
- Start with your most critical accounts — your primary email address, your bank, and any account that can be used to reset other accounts. These are the highest-value targets.
- For each account: log in normally, let the manager save the existing password, then use the manager’s built-in generator to create a new unique random password and update the account.
- Install the mobile app on your phone. Most managers offer biometric unlock (Face ID, fingerprint) so you’re not typing your master password every time.
- Add accounts as you use them over the following weeks. You don’t need a single marathon session.
After one week of normal internet use, your most important accounts will have unique passwords. After a month, most of your accounts will be covered without a dedicated effort.
Passwords vs passkeys
Passkeys are the newer authentication standard that major technology companies are pushing as a replacement for passwords. Instead of a password you type, a passkey is a cryptographic key pair — a private key that never leaves your device and a public key stored by the service. There’s nothing to steal, nothing to phish, and nothing to breach from the service’s side.
How do you authenticate? With your device’s biometric sensor or PIN — the same way you unlock your phone. The service verifies you by confirming that your device holds the correct private key, without you ever transmitting a password. Phishing attacks that trick you into entering credentials on a fake site don’t work against passkeys, because there’s no credential to enter.
Apple, Google, and Microsoft all support passkeys. Major sites — Google, Apple, GitHub, PayPal — already let you sign in with a passkey instead of a password. Both Bitwarden and 1Password support storing and syncing passkeys across devices, which solves the “what if I lose my phone” problem that made passkeys awkward in their early rollout.
Passkeys are the future of authentication. They’re also not universal yet, and passwords will remain the dominant standard for years, because most sites still don’t support them. A password manager handles both. It manages your existing passwords today and stores passkeys as adoption grows. You don’t need to choose between them, and adopting a password manager now sets you up for the transition when it fully arrives. Our passkeys guide explains how they work in detail.
The browser-saved passwords question
Chrome, Firefox, and Safari all offer to save your passwords when you log in. This is better than nothing. But it falls short of a dedicated manager in ways that matter.
Chrome passwords sync to your Google account. If your Google account is compromised — by a phishing attack, a SIM swap, or a breach at Google’s level — your stored passwords go with it. Safari passwords sync to iCloud under the same logic. Browser-stored passwords also typically rely on your device being unlocked for protection. Say someone has access to your unlocked laptop. On most systems they can open a browser, navigate to the saved passwords section, and read your credentials with no extra authentication required.
There’s also a portability problem. Chrome’s passwords don’t travel cleanly to Firefox. Safari’s passwords live inside the Apple ecosystem. If you switch browsers or platforms, your password history becomes difficult to move. A dedicated manager is browser-agnostic and platform-agnostic — your vault works everywhere because it’s yours, not tied to a browser vendor.
A dedicated password manager adds a separate encryption layer gated by your master password, independent of your device login and independent of any single tech company’s account. It also gives you an organized, auditable view of every credential you own. You can see which accounts use weak passwords, which use duplicates, and which are connected to sites that have been breached. Browser password managers don’t offer that level of visibility.
The security improvement is real, not theoretical. Browser saving is a convenience feature. A dedicated manager is a security tool.
What you can do right now
Want to see what data brokers expose about you? See what a scan finds → shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist to get in early.