Password Managers Explained Simply

A password manager makes long, random passwords for you and remembers them, so you do not have to. That is the whole idea.

Here is what one is, the free ones already sitting on your devices, and how to start without locking yourself out of anything. Every point below comes from CISA, NIST, the FTC, or the official support pages for Apple, Google, Microsoft and Firefox. This page carries no affiliate links and recommends no product.

Before you start

You do not have to buy anything. Apple, Google, Microsoft and Firefox each include a password tool at no extra cost. CISA recommends using a password manager, and NIST’s standard requires websites to let you use one.

1. What a password manager is

NIST puts it as plainly as anyone has.

The definition. NIST: password managers are apps that make the process of creating and using passwords easier by generating long, complex passwords and storing them securely so you do not have to remember or write them down.
CISA recommends one. Using strong passwords and a password manager, CISA says, are some easy ways to protect ourselves from someone logging into an account and stealing data or money.
CISA also says to protect the manager itself. Make sure your master password is strong and memorable, and secure your password manager account with multi-factor authentication.
Websites have to let you use one. NIST’s standard requires services to allow password managers and autofill, and says they should let you paste a password into the box.

2. The password rules changed, and most of us never got the memo

The advice many of us learned — a capital, a number, a symbol, and change it every ninety days — is no longer what the standards say. One thing to keep straight: these rules are written for the banks and websites that check your password, not for you. What they mean in practice is that those services are no longer supposed to make you jump through the old hoops.

Length matters more than tricks. NIST’s standard requires services to accept passwords of at least 15 characters where a password is the only thing protecting an account, and says they should allow at least 64.
Mixed character types are out. NIST tells services not to impose composition rules such as requiring mixtures of different character types. Its reasoning is that people respond to those rules in very predictable ways, which helps the attacker more than it helps you.
Scheduled password changes are out. NIST tells services not to require you to change passwords periodically. That is not the same as never changing a password — change it when there is a reason, such as a breach or a suspicion, rather than on a calendar.
Security questions are out. NIST tells services not to use questions like the name of your first pet.
Reuse is the real danger. CISA: reusing a password, even a strong one, endangers your accounts just as much as using a weak password. The FTC explains why — stolen username and password pairs get fed automatically into popular websites to see which ones work.

A note on the numbers. The official sources give different minimums: NIST says 15, one CISA page says at least 16, the FTC says at least 12 on one page and at least 15 on another. All are official and all are recent. Anything a password manager generates will comfortably exceed every one of them, which is one reason to let it do the choosing.

3. The free ones already on your devices

Each of these is included, and each of them will also warn you when a saved password has turned up in a breach. They are described here, not ranked.

Apple — the Passwords app and iCloud Keychain

On iOS 18, iPadOS 18, macOS Sequoia and later there is a Passwords app that holds account passwords, passkeys, Wi-Fi passwords and verification codes in one place, and alerts you to passwords that might not be secure.
On iOS 17 or earlier, the same list lives at Settings, then Passwords. You can also ask Siri to show your passwords.
To sync across devices, turn on iCloud Keychain: Settings, your name, iCloud, then Passwords. On a Mac: Apple menu, System Settings, your name, iCloud, then Passwords. It requires two-factor authentication on your Apple Account.

Google — Google Password Manager

In Chrome on a computer: the three-dot menu, then Passwords and autofill, then Google Password Manager. On the web it is at passwords.google.com. There is also an app on Android.
Under Settings you can turn Offer to save passwords and passkeys on or off.
Checkup will tell you which saved passwords are exposed, weak, or used on more than one account.

Microsoft — Microsoft Password Manager in Edge

In Edge: Settings, then Passwords and autofill, then Microsoft Password Manager. To see a password, select the arrow and then the eye icon. You may need your device PIN or password.
Password Monitor checks whether your saved passwords have appeared in a data breach. Turn it on under Password security check.
One warning worth repeating: Microsoft notes that changing a password inside Edge does not change the password on the website. You still have to change it at the website itself.

Firefox

The menu button, then Passwords, which opens a page listing everything saved. The eye icon reveals a password.
Saving can be turned off under Settings, Privacy and Security, Passwords, and you can add exceptions for particular sites.
Firefox offers an optional Primary Password, which is a second lock on the list. Read the next section before you turn that on.

4. Starting without locking yourself out

This is the part that worries people most, and it is a fair worry. Two of the optional settings are genuinely unforgiving.

For most of the built-in tools there is no separate master password to forget. What unlocks the list is your device passcode or fingerprint, plus the account you already sign in with.
Firefox’s Primary Password cannot be recovered. Mozilla’s own page says that resetting your Primary Password will remove all of your saved usernames and passwords. There is no recovery route. If you turn it on, you must not forget it.
Google’s optional on-device encryption cannot be recovered either. Google’s wording is that you take the key with you, and that if you lose the key, you could lose your data too. It is off unless you turn it on, and there is no reason to turn it on unless you understand that.
Exported files are plain readable text. Apple states it outright: passwords you export are not encrypted and are visible to anyone who has access to the file. Chrome and Firefox can also export to a file. Export exists for moving to another app, not as a backup you keep.

A practical suggestion from us, not from any agency: do not try to move every password in one sitting. Turn on saving, then let the tool collect your passwords over the next few weeks as you sign in to things normally. Nothing is lost while you do that, because your existing passwords still work. No government source recommends or discourages this — it is simply what we would tell a friend.

5. Writing them down, and the second step

Two questions come up every time, and one of them has a shorter answer than people expect.

On paper. The only official statement I could find is CISA’s, and it is conditional: do not write it down and leave it someplace where others can find it. That is a rule about where the paper ends up, not a ban on paper. NIST’s standard does not address paper at all.
Turn on the second step. CISA: turn on multi-factor authentication for each account or app.
Not all second steps are equal, and the FTC ranks them plainly. A code sent by text can be defeated if someone takes over your phone number in a SIM swap. An authenticator app is safer because the code is not exposed to that. A security key is the strongest, because there is no code for anyone to steal.
But use whatever your bank offers. CISA’s own line is that any multi-factor authentication is better than none. If a texted code is the only option, a texted code is far better than nothing.

If one of your passwords turns up in a breach

The FTC: if a company or website tells you it lost your password in a data breach, change your password right away. And if you reused the same password, or a similar one, on other services, change it there too.

The built-in checkers are free. Google’s Checkup, Microsoft’s Password Monitor and Apple’s alerts will each flag saved passwords that have appeared in a breach.
Do not install a password tool from an advertisement. The FTC’s advice on software ads generally: do not click on ads to download software — go to the website by typing in the address.
Report phishing. Forward a phishing email to reportphishing@apwg.org, forward a phishing text to 7726, and report it to the FTC at ReportFraud.ftc.gov.

Where to report it

Scams and fraud: ReportFraud.ftc.gov
Identity theft: IdentityTheft.gov
Phishing emails: reportphishing@apwg.org
Phishing texts: forward the message to 7726
Crime committed online: ic3.gov
If you would rather talk to a person: National Elder Fraud Hotline, 833-372-8311

Remember this

Long. Different everywhere. Let the manager remember it.

← Back to the Digital Safety Center

Sources

Checked against these official sources on September 22, 2026:

This page is general information, not legal or financial advice.