If Pentester flagged a password of yours that leaked in several slightly different spellings, like Summer2021!, Summer2022! and Summer2023!, this article is for you. It explains why changing one character doesn't protect you, what a password manager does about it, whether it's safe to keep everything in one place, and how to choose one.

Why a small change isn't a change

When a password leaks, attackers don't just try it as-is. They try the obvious next versions: a different year, an extra "!", a capital letter moved around. This is called credential tweaking, and it works. Researchers at Cornell found that about 15% of user accounts are still vulnerable to credential tweaking in 1,000 guesses, even when the user's new password is different from the one that leaked (Pal et al., IEEE Symposium on Security and Privacy, 2019). A thousand guesses takes a computer almost no time.

So the fix isn't a new version of your password. It's a password that has nothing to do with the old one, and a different one for every account. Few people can remember dozens of random passwords, and that's the problem a password manager solves.

This is also why you don't need to change passwords on a schedule. The US standard for digital identity, NIST SP 800-63B-4 (2025), says services shall not force periodic password changes, but shall force a change when there's evidence a password has been compromised. In other words, change a password when it leaks, not every 90 days.

What a password manager does

A password manager is an app that creates, stores and fills in your passwords for you. The US Cybersecurity and Infrastructure Security Agency (CISA) describes it as "an easy-to-use program that generates, stores and even fills in all your passwords," and notes that it can warn you about weak or reused passwords. You remember one strong password, the one that unlocks the manager, and it handles the rest.

In practice, that means:

  • Every account gets its own long, random password that you never have to type or remember.
  • When one site leaks, that password is useless everywhere else.
  • Your passwords sync across your phone, laptop and browser.
  • Because it only fills passwords on the site they belong to, it won't fill on a look-alike phishing domain. If autofill doesn't appear where you expect it to, check the address before you type anything.

Is it safe to keep every password in one place?

It's a fair question, and the honest answer is: it's much safer than reusing passwords, but no product is perfect, so it's worth choosing carefully.

The best-known failure is LastPass. In 2022, an attacker stole a backup of customer vaults. The UK's data protection regulator, the ICO, fined LastPass £1.2 million in December 2025, finding that the stolen data included customer names, email addresses, phone numbers and the website addresses stored in vaults. The ICO also found no evidence that the attackers were able to decrypt customer passwords, and stated that "password managers are a safe and effective tool for businesses and the public." The lesson: the vault's encryption held up, but how much it protects you still depends on how strong your master password is.

In 2026, researchers from ETH Zurich and Università della Svizzera italiana published a study of what could happen if a password manager's own servers were taken over ("Zero Knowledge (About) Encryption", USENIX Security 2026). They described 12 attacks against Bitwarden, 7 against LastPass, 6 against Dashlane and 6 against 1Password. The findings were disclosed to the vendors and remediation is underway. These attacks assume a compromised server, not something an everyday attacker can do, and one of the authors, Matilda Backendal, was clear: "My recommendation is still to use a password manager, and I don't think users should be afraid of cloud-based ones."

What makes the real difference is on your side: a strong, unique master password and two-step sign-in on the manager itself.

How to pick one: what to look for

  • It works on every device you use. If it doesn't fill on your phone, you'll fall back to old habits.
  • End-to-end encryption, on by default. Your vault should be encrypted on your device before it's synced, so the company can't read it.
  • Independent security audits, and openness about problems. Look for published third-party audits and a track record of disclosing and fixing issues. This is what the ETH Zurich researchers recommend checking.
  • Two-step sign-in for the manager account. Use an authenticator app or a security key.
  • Passkey support. Passkeys are replacing passwords on more and more sites, and you'll want them stored in the same place.
  • Breach and reuse alerts. Most managers flag passwords that are reused, weak or known to have leaked.
  • A way out. Make sure you can export your data if you ever want to switch.
  • A recovery plan you understand. Some managers can't recover your vault if you forget your master password. That's a security feature, but you need to know it upfront.

Your options

Already on your devices

If you're not ready to install anything new, the password manager you already have is a good start, and far better than reusing passwords.

  • Apple Passwords: a standalone app on iOS 18, iPadOS 18, macOS Sequoia and later that stores passwords, passkeys and verification codes. It works on Windows through iCloud for Windows, but there is no Android app.
  • Google Password Manager: built into Chrome and Android. Passkeys saved there are end-to-end encrypted, and you can turn on on-device encryption for your passwords too. If you do, keep your recovery method safe, because losing it can mean losing your saved passwords.
  • Microsoft: the Microsoft Authenticator app stopped storing and autofilling passwords in 2025. Microsoft's password manager now lives in the Edge browser. If you still have passwords in Authenticator, check that they made it to Edge or to the manager you choose.

The catch with built-in managers is that they work best inside one company's world. If you use an iPhone and a Windows PC with Chrome, or an Android phone and a Mac, a dedicated manager is usually easier.

Dedicated password managers

These work across Apple, Android, Windows and every major browser. Here are four well-established choices that take different approaches. This isn't a ranking, and plans change, so check the vendor's site before you sign up.

  • Bitwarden: open source, with a free plan that includes unlimited passwords on unlimited devices and passkey support. Built-in authenticator codes need the Premium plan.
  • Proton Pass: from the company behind Proton Mail. The free plan includes unlimited logins on unlimited devices, passkeys and up to 10 email aliases that hide your real address. Built-in 2FA codes need a paid plan.
  • 1Password: a paid subscription. In addition to your account password, it protects your vault with a 128-bit Secret Key that is created on your device. Keep your Emergency Kit somewhere safe, because you need it to sign in on a new device.
  • KeePassXC: free, open source and offline. Your vault is a file on your own computer, and nothing goes to anyone's cloud. You're responsible for backups and syncing, and it's a desktop app, so on your phone you'll need a separate KeePass-compatible app.

Not sure? Pick the one that works on every device you own and that you'll actually use. The best password manager is the one you keep using.

Getting started in about 15 minutes

  1. Install it on your computer, your phone and your browser.
  2. Create a master password you've never used anywhere else. CISA suggests at least 16 characters, or a passphrase of 4 to 7 unrelated words. This is the one password you need to remember, so make it long rather than complicated.
  3. Turn on two-step sign-in for the password manager account.
  4. Save your recovery details (recovery code, Emergency Kit or similar) somewhere offline and safe.
  5. Import the passwords your browser has saved. Most managers can do this for you. Once you've checked that everything arrived, turn off saving in the browser so you don't end up with two copies.
  6. Fix the important accounts first: your email (it can reset everything else), your bank and any accounts Pentester flagged. Let the manager generate a brand-new password for each one. Don't edit the old one.
  7. Deal with the rest as you go. Each time you log in somewhere, let the manager replace the old password. Within a few weeks most of your accounts will be covered.

Once you're set up, go back to your Pentester dashboard and tick off "Start using a password manager". We'll keep watching breach data, and if a password of yours turns up again, you'll know exactly which account to change.