What a password manager does and what it cannot do

A password manager is an app that stores your login details in an encrypted vault, creates a unique password for each account and fills those passwords into sign-in forms when you need them. It takes over the tedious part of good password habits, so you can use different passwords everywhere without memorizing them. What it does not do is make your devices safe, judge whether a website is trustworthy or protect you from every kind of attack. Understanding both halves is what makes the tool useful.

A helpful way to think about it is as a locked box with one key, the master password. The box is only as secure as that key and the room where you keep it. A strong master password, a locked device and a plan for recovery matter as much as the vault's encryption.

How the vault keeps your logins protected

The vault is a file of encrypted entries. Its contents are encrypted with a key derived from your master password, so the data cannot be read without it. Most managers store the encrypted vault in the cloud so it can sync between your phone, computer and browser. Many are designed so the provider stores the data without being able to read it, a model sometimes called zero-knowledge. Check how a manager describes its design and whether its sync uses end-to-end encryption before you commit to it.

When you enter your master password on a device, the manager decrypts the vault in that device's memory, and it locks again after a timeout or when you close it. Review the auto-lock setting, especially on shared computers. A shorter timeout reduces the chance that someone else can open your logins while you step away from the screen.

If you later move to a different manager, check how the old one exports your data. An export file usually contains your logins in readable form, so keep it only briefly. Import it into the new manager, then delete the file rather than leaving it in a shared folder or an email attachment.

How autofill and generated passwords work

Autofill is where a password manager adds value beyond storage. When you open a site, the manager compares the address in the browser with the address saved for each login and offers only the matching credentials. A lookalike site with a different domain name usually does not match, so no suggestion appears there. That silence is a useful warning sign, though not a guarantee. If a site you expect to recognize offers no suggestion, check the address before you type anything.

The generator creates long random passwords for new accounts, and you can usually set the length and character types. Use the longest length the site accepts. If a site rejects a long or unusual password, the field may be restricted, and you should consider whether the service is worth using. When you must copy a password manually, use the manager's copy function and clear the clipboard afterward where the app supports it, because other programs may read whatever is copied.

The master password and recovery options

The master password is the single point of access to everything in the vault, which makes it the most important password you own. Choose a long passphrase that you will remember but that no one else can guess, and do not reuse it anywhere. In designs that protect the vault end to end, the provider cannot reset a forgotten master password, because it cannot read the vault in the first place. Losing it can mean losing access to the stored logins.

Set up recovery before you need it. Many managers provide an emergency kit, a recovery code or an account recovery option. Store that material separately from your everyday devices, such as in a secure place at home, and make sure a trusted person knows how to reach it if your plan allows that. Where the service offers two-factor sign-in for the manager account itself, turn it on, so a stolen password alone does not open the vault.

What a password manager cannot protect against

A password manager cannot protect a device that is already compromised. If malicious software runs on your computer or phone, it may be able to read what you type, watch the clipboard or access the manager while it is unlocked. Keeping the operating system, browser and manager updated, and avoiding unknown downloads, lowers that risk without eliminating it. A locked vault on a lost device still needs the master password, but an unlocked device left unattended offers no protection at all.

A manager also cannot stop you from typing your password into a fake page if you bypass autofill and enter it yourself. It does not verify whether a message asking you to sign in is genuine, and it cannot change how a website stores passwords. If a service is breached, the manager limits the damage by keeping your passwords unique, but it cannot repair the service's own weak security. Two-factor sign-in on important accounts adds a layer that a manager alone does not provide.

Used alongside updated devices, unique passwords and two-factor sign-in on key accounts, a password manager is one of the most practical improvements most people can make. Knowing its limits keeps your expectations realistic and tells you where else to put your effort.