Password Manager

Reusing a password across accounts means that if one account is compromised, an attacker can try the same password on the others. Long, random, and unique passwords are hard to remember across many accounts, and storing them as plain text in a notes app is unsafe if a threat actor gains access to the device. A password manager stores them so the user does not have to remember them.

Common features include generation of a strong, unique password for each account; autofill, which also helps against phishing because the password fills in only on the correct website; synchronization across devices; and warnings when a password has been breached or leaked. NIST SP 800-63B requires verifiers to allow password managers and autofill, and notes that password managers make users more likely to choose stronger passwords, particularly when they include password generators.

A password manager may be built into a web browser or device operating system, or installed from a third party as an app or browser extension. A third-party manager can synchronize passwords across a mix of browsers and devices. CISA notes that cloud-based storage adds convenience but carries a higher risk of compromise than a locally maintained database, which in turn has a greater chance of failure through user error and needs regular backups.

The primary password is the key to the manager, so the account should also be protected with two-step verification, which keeps out a criminal who knows the primary password. Passwords saved in a browser are only as secure as the devices and accounts that hold them, and they should never be saved in a browser on a shared public computer. NIST lists exploitation of a vulnerability in an insufficiently secure password manager as one way authenticators can be duplicated.