Short answer
Reused passwords are how one breach turns into many hacked accounts. A password manager creates and remembers a different strong password for every account and fills it in only on the right website, which also helps against fake login pages. The UK’s NCSC says saving passwords in your browser or phone is fine on your own devices. The free built-in options — Google Password Manager and Apple’s Passwords app — also warn you about leaked and reused passwords. Protect the manager itself with a strong main password and two-step verification, and keep its recovery options up to date.
What a password manager does
- Generates long, random, unique passwords, so a leak on one site can’t open your other accounts.
- Autofills only on the site a password was saved for — if it doesn’t offer to fill, you may be on a look-alike phishing page.
- Syncs across your devices; many also store passkeys and two-step codes.
- Flags passwords that appeared in breaches, are reused or are weak.
Built-in or a separate app?
| Option | Good for | Watch out for |
|---|---|---|
| Google Password Manager | Chrome and Android users; Password Checkup is built in | Everything depends on your Google Account — protect it with 2-Step Verification |
| Apple Passwords | iPhone, iPad and Mac users; Security recommendations flag leaked passwords | Less convenient if you also use Android |
| Separate password manager | Mixed devices (Windows, Android, iPhone) and sharing with family | Pick a well-known provider; strong main password and 2FA are essential |
Set it up safely
- Protect the manager with a strong, unique main password — the NCSC’s “three random words” approach works well.
- Turn on two-step verification for the manager or for the account behind it (Google Account, Apple Account).
- Start with your most important accounts — email, banking, social media — and change each one to a new generated password.
- Save the recovery details: recovery email and phone, and any recovery key or emergency kit the manager offers.
- Keep breach alerts on and act on them when they appear.
Where not to keep passwords
- In the browser of a shared or public computer — the NCSC says never save your password there.
- In notes apps, screenshots or chats: they aren’t built to protect secrets and are often synced or shared.
- In a spreadsheet you email to yourself.
Password manager, 2FA and passkeys together
A password manager fixes reuse; two-step verification protects you if a password still leaks; a passkey replaces the password wherever a site supports it. Use all three. To add the second step, see two-factor authentication on 12 platforms; if a password has already leaked, see data breach: the first hour.
Frequently asked questions
Is it safe to save passwords in my browser?
On your own devices, yes — the UK NCSC says so. Never save passwords on shared or public computers, and protect the account behind the browser with two-step verification.
What if my password manager is hacked?
That is why the main password must be strong and unique and two-step verification must be on. Reputable managers encrypt the vault, so a stolen copy is of little use without the main password.
Do I still need a password manager if I use passkeys?
Yes, for now. Many sites don’t support passkeys yet, and most managers store both passwords and passkeys.
Google Password Manager or Apple Passwords — which is better?
Use the one that matches your devices. If you mix Android, Windows and iPhone, a separate cross-platform manager may be easier.
Sources: NCSC — password managers, Google Account Help — change compromised passwords (Password Checkup), Apple iPhone User Guide — change weak or compromised passwords, Google Account Help — sign in with a passkey