What is a password manager?

A password manager is an application that creates, stores and fills in your passwords. Every account can then have its own long password, and the only one you have to remember is the one that opens the manager. The Australian Signals Directorate (ASD) recommends one to small businesses for exactly this job.

The problem it solves

Nobody can remember a different strong password for every account, so people reuse a few. Then one website is breached, and the stolen password is tried on email, banking and everything else. A password manager takes memory out of it. The longer explanation is in Why reusing passwords is still one of the biggest security risks.

What it does

• Creates passwords. It generates a long, unpredictable password for each new account.
• Stores them. Your logins sit in one protected place, behind a master password.
• Fills them in. It enters the password for you, and only on the website the password belongs to. A look-alike site gets nothing, which is a useful warning in itself.
• Keeps devices in step. The same logins are available on your computer and your phone.
• Warns you. Many will tell you when a saved password has turned up in a breach.

Many also store passkeys, the newer way of signing in that does away with the password.

Built in, or separate

Browsers and phones come with a password manager, and the United Kingdom’s National Cyber Security Centre says it is safe to use one on your own devices. A separate, or third-party, manager is an app you install. Its main advantage is that it works across a mix of browsers and devices. Some also make it easier to share a login with a colleague, which is safer than sending it in an email.

Shared logins still need care. ASD’s advice is to give each person their own account where possible, keep a record of who has access to the shared ones, and change those passwords when someone leaves or changes role.

Protect the manager itself

A password manager holds the way into every account, so how you open it matters more than any single password inside. ASD compares a weak master password to putting your valuables in a safe and leaving the code beside the door. Use a long master password that you use nowhere else, and turn on multi-factor authentication for the manager. Set up its recovery option on the first day, because a forgotten master password can otherwise lock you out of everything.

How to start

1. Choose a password manager that works on every device and browser your staff use.
2. Give it a long, unique master password and turn on multi-factor authentication.
3. Add the most important accounts first: email, banking, accounting and anything with administrator rights.
4. As you add each account, replace a reused or short password with a generated one. ASD suggests at least 15 characters.
5. Work through the remaining accounts over the following weeks.