Password management software

How it works

You choose one master password you can actually remember. The software derives a key from it and uses that key to encrypt a vault of site names, usernames, and passwords. Unlock the vault on your phone or desktop, and the entries are readable there. Lock it, and they are not a plain list sitting in a text file. Browser extensions and apps can fill a saved login on a page that matches the saved address.

A generator sits next to the vault. When you register somewhere new, you let the software pick a long random string, save it, and stop trying to invent a clever variant of your old phrase. Reuse is the usual failure. A unique string per site contains a breach at that site. A reused phrase turns one leak into many. The software is a tool for that habit, not a personality upgrade.

Sync, if you turn it on, copies the encrypted vault between your devices through the vendor’s servers or through a file you control, depending on the product. The vendor’s claim is often that they cannot read the vault without the master password. That claim is only as good as the product’s design and your master password. A short master password with a name and a year is a weak key no matter how strong the file format is.

What belongs in the vault

Site logins belong there. Recovery codes for two-factor authentication belong there if you will otherwise lose them. Notes that are actually secrets belong there. Your grocery list does not. Treat the vault like a lockbox, not like a second email archive. Fill rules should match the real domain. A look-alike page with a slightly different host is how phishing still works even when the password itself is unique and long.

Pick a master password you can remember and that nobody else uses for you. Turn on the generator for new accounts; stop recycling old phrases. Save the login to the real domain, then let the filler type it.

Store the account’s recovery codes in the same vault, not in a screenshot album. Keep a recovery path the product documents — a printed key, a second device — and test it once. One password you can remember is a key. Twenty passwords you can remember are a reuse waiting for someone else’s breach.

What this software will not do

It will not make a leaked site whole. If that site stored your unique password badly, that one account can still be taken. You change that one entry. You do not have to change every other entry, which is the point. It will not survive a master password you typed into a fake unlock screen. It will not survive a computer that already has a keylogger. It will not replace two-factor authentication; many vaults can hold the extra codes, and that is still a second factor only if the second factor is not also sitting unlocked on the same desk all day.

Export and travel are the quiet risks. An unencrypted export is a list. A vault on a shared family computer is a vault on a shared family computer. Lock on close. Do not leave the desktop app open on a machine other people sit down at. If you leave a product, export into the next vault and then change the important accounts. A forgotten vault with a forgotten master password is a locked box with no spare key. That is a feature until the day it is your box.