Password Managers: Principle, Choice and Migration

A password manager is a digital safe that creates, stores and fills in all of your passwords, so that you only need to remember one strong passphrase. It sounds like putting all your eggs in one basket, and that is the first question everyone asks. In this lesson you will see why it is nevertheless the recommended approach, how to choose one, and how to move your accounts over step by step.

Last lesson ended with a problem: you cannot memorize dozens of unique strong passwords. The password manager is the standard answer, recommended by security agencies in many countries, including the French agency ANSSI (cyber.gouv.fr).

How it works

A password manager keeps your credentials in an encrypted vault. Think of a hotel safe: the contents are locked, and only the code opens it. The code here is your master passphrase. When you unlock the vault, the manager can:

• Generate long, random, unique passwords for every new account.
• Store them, with the website address, your username and notes.
• Fill them in automatically, and only on the correct website. That last point is a surprisingly good anti-phishing feature: if you land on a fake site whose address does not match, the manager will not offer your password, which is a strong warning.
• Warn you about reused, weak or breached passwords.
• Sync across your devices, so your phone and your laptop share the same vault.

Most good managers use a "zero-knowledge" design: your vault is encrypted on your device before it is sent to the provider's servers, so even the provider cannot read it. This is also why a forgotten master passphrase may be unrecoverable. We will come back to this.

"But isn't it dangerous to put everything in one place?"

It is a legitimate worry, so let us compare real risks. The alternatives are reusing passwords, using weak passwords you can remember, or keeping them in an unprotected notebook or file. Those habits are the ones that lead to the vast majority of account takeovers. A well-built manager, protected by a long master passphrase and two-step verification, is dramatically safer than any of them.

It is not risk-free: if someone obtains your master passphrase and your second factor, they get everything. That is why you protect the manager more than any other account, and why it deserves its own strong passphrase (five or six random words) that is not used anywhere else.

Types of password managers

• Built into the browser or the operating system: convenient, free and often good enough for a first step. Make sure the vault is protected with a strong device password or biometric unlock, and that sync is protected by a strong account.
• Dedicated manager services: independent applications and browser extensions with extra features such as secure sharing, notes, and emergency access. Some are open source, which lets experts inspect the code.
• Local-only managers: the vault is a file stored on your own devices, with no cloud sync. This gives you full control, but you must handle your own backups and syncing.

How to choose

Rather than recommending a brand, here are criteria that apply to any product:

1. Zero-knowledge encryption: the provider cannot read your vault.
2. Reputation and transparency: a long track record, independent security audits, clear explanations of how it works, and a prompt, honest response to past incidents.
3. Two-step verification support to protect the vault itself, ideally with a hardware key or authenticator app.
4. Availability on all your devices (phone, computer, browsers).
5. Export and import: you should be able to take your data with you if you leave.
6. Useful extras: breach alerts, secure sharing for family members, emergency access.
7. Reasonable cost and ease of use: the best manager is the one you will actually use. Many people find that a family plan is worth it.

Migrating step by step

Do not try to move 100 accounts in an afternoon. A gradual approach works much better:

1. Install the manager on your computer and phone, and create the vault with your new master passphrase.
2. Turn on two-step verification for the manager account, and save its recovery information in a safe place (more on this in the next lesson).
3. Start with the critical accounts: main email, bank, cloud storage, shopping accounts holding a payment card. For each, log in, go to the security settings, and replace the old password with a long random one generated by the manager.
4. Let the manager learn as you go: each time you log in somewhere, accept its offer to save the credentials. Within a few weeks, the accounts you actually use will be in the vault.
5. Use the security report: most managers list reused or weak passwords. Fix them one at a time, starting with the most important.
6. Clean up: delete the passwords saved in the browser if you now use a dedicated manager, and remove any file or note where you wrote passwords in clear text.
7. Close forgotten accounts, as discovered during your attack surface mapping.

Planning for the worst day

Because the vault is encrypted for you alone, some providers cannot reset your master passphrase. Prepare for this:

• Write down your master passphrase once, on paper, and keep it in a safe place at home (a locked drawer or a safe), separate from your devices. A paper copy in a safe is not a weakness for a home user, because an attacker cannot reach it over the internet.
• Save recovery codes or an emergency kit, if your manager provides one.
• Consider emergency access for a trusted family member, so your accounts are not lost if something happens to you.

What to store besides passwords

The vault is also a good place for secure notes: recovery codes, software licence keys, the Wi-Fi password, and answers to security questions. Many managers also store the one-time codes of two-step verification, but that is a trade-off we will examine in the next lesson.

Your turn

Exercise. Install a password manager of your choice, create the vault with your new master passphrase, and migrate your five most critical accounts. For each, generate a new random password of at least 16 characters.

See a solution

A recommended order is:

1. Main email account (it resets everything else).
2. The password manager account itself (enable two-step verification).
3. Online banking (check the site's own rules on password length).
4. Cloud storage or the account that holds your photos and documents.
5. Your most used online shop or payment service.

For each account, verify that you can log in with the new password before closing the page, and that the manager has saved the entry. If a site refuses a very long password, lower the length gradually and note the limit in the entry.

Add to your Security Notebook

Under "2. Accounts and passwords", note the manager you chose, where your paper master passphrase and recovery information are kept, and the date by which you plan to have migrated your top 20 accounts.

A strong password can still be stolen by phishing. The next lesson adds a second lock on the door: two-factor authentication.