Unique passphrases for every account are the goal. A password manager is how most people actually manage it.
Quick summary
- A password manager stores your passwords in an encrypted vault unlocked by one master passphrase.
- The ACSC suggests using a password manager if you struggle to remember all your passphrases.
- Protect the manager with a strong, unique passphrase and multi-factor authentication.
- Choose a reputable manager that’s regularly updated, and keep its app current.
- Switch gradually, starting with your most important accounts.
The safest approach to passwords is a different, strong passphrase for every account. That’s dozens of passphrases for most people, which no one can remember. A password manager solves this by remembering them for you.
How a password manager works
- It stores your usernames and passwords in an encrypted vault.
- You open the vault with one master passphrase, the only one you need to remember.
- It can generate strong, random passwords or passphrases for new accounts.
- It fills in logins on websites and apps, often across your phone and computer.
The Australian Cyber Security Centre (ACSC) suggests using a password manager if you struggle to remember all your passphrases, and protecting it with a strong passphrase of its own.
What to look for
- A good reputation and a long track record.
- Regular updates. The ACSC suggests checking that the manager’s developer keeps releasing updates.
- Multi-factor authentication for unlocking or signing in to the vault.
- Support for your devices, such as phone, computer and browser.
- Clear recovery options in case you forget your master passphrase.
Many browsers and phone operating systems include a built-in password manager. That’s a big improvement over reusing passwords, and fine for many people. Dedicated password managers usually offer more features and work across more browsers and platforms.
Setting it up
- Choose your master passphrase carefully: four or more random words, unique and memorable. Our guide to passphrases explains how.
- Turn on multi-factor authentication for the manager. See our guide to MFA.
- Set up recovery options and store any recovery kit or codes somewhere safe and offline.
- Install the apps or browser extensions on the devices you use.
Handy tip
Don’t try to change every password in one evening. Start with your email, banking and social media accounts, then update others as you log in to them over the following weeks.
Getting the most out of it
- Let the manager generate new passwords whenever you create an account or change a password.
- Use its security check feature, if it has one, to find weak or reused passwords.
- Store recovery codes and secure notes, such as Wi-Fi passwords, in the vault.
A built-in scam check
A password manager only offers to fill in your password on the website it was saved for. If you land on a convincing fake banking page and autofill doesn’t appear, that’s a warning sign. Our guide to spotting and reporting scams covers other red flags.
Your questions answered
Isn’t it risky to keep all my passwords in one place?
There’s some risk, but for most people it’s far lower than reusing passwords or writing them on sticky notes. A good manager encrypts your vault, and a strong master passphrase plus MFA protects access.
What happens if I forget my master passphrase?
Many password managers can’t recover it, because they can’t read your vault. Set up the recovery options the manager offers, and store any recovery kit somewhere safe.
Should I use my browser’s built-in password manager?
It’s much better than reusing passwords, and convenient if you use one browser across your devices. Dedicated managers often work across more browsers and apps and have extra features like secure sharing.
Can a password manager help me spot fake websites?
Often, yes. Most managers only offer to fill in a password on the website it was saved for, so if autofill doesn’t appear on a page that looks like your bank, check the web address carefully.
This guide is general information, not technical or legal advice. If you’ve lost money or personal information, contact your bank, IDCARE on 1800 595 160, or report it through ReportCyber at cyber.gov.au.