Choosing a Password Manager Without Losing Control

In wartime, codebreakers did not need to guess every message. They needed the key. A password manager works on the same principle. It keeps dozens of unique passwords inside an encrypted vault, and one master password opens it. That master password is your key. If it falls into the wrong hands, the vault falls with it. If it stays strong and private, the vault can travel with you without giving up its secrets. The aim is not to trust a manager blindly. It is to know where the cryptography ends and your own habits begin.

Your Master Password Is the Key

Start here, because no feature can rescue a weak master password. Use a passphrase of four to six random words: something like cobalt-lantern-driftwood-seven, though please do not use that exact one. Length matters more than a short scramble of symbols. A long phrase is easier to remember and much harder to guess. Keep it unique. Never reuse a password you have used anywhere else, and never make it a famous quote, song lyric or family name.

You will type this master password often, so practise it until it is automatic. If you write it down, store the paper in a locked drawer or safe, not in a notes app or a photograph on your phone. Enable two-factor authentication on the manager account itself. That way, even if someone learns your master password, they still need your second factor. If the manager offers a recovery kit, print it and store it separately. Do not store the master password inside the manager.

Look for Real Cryptography, Not Marketing

A good password manager should explain how it protects your vault in plain language. Look for zero-knowledge or end-to-end encryption: the provider stores your vault in encrypted form and cannot read your passwords. Check that it uses a modern key derivation function, such as Argon2, scrypt or PBKDF2, to turn your master password into an encryption key. That slows down guessing attacks. Look for independent security audits and, where possible, open-source code that researchers can inspect.

Remember the old codebreaking principle: a cipher should remain secure even if the method is public. The secret is the key, not the design. Be wary of vague phrases like "military-grade encryption" with no explanation. If a provider cannot tell you what happens to your data, assume the worst and look elsewhere. You are not being paranoid; you are doing what any puzzle solver does when checking a lock.

Features That Matter Day to Day

• Apps and browser extensions for the devices you actually use, with reliable autofill.
• A strong password generator that creates long, random passwords and remembers them for you.
• Two-factor authentication support for your manager account, plus backup codes.
• Secure sharing or emergency access if a partner or family member needs access in a crisis.
• Import and export tools so you can move your data if you change your mind. Your vault should be portable.
• Breach alerts and password health reports that flag reused or weak passwords, but treat them as prompts, not proof.
• Offline access if you travel or lose signal, and a clear plan for what happens if you forget your master password.

Set It Up Without Handing Over Control

Install the manager on your main device first. Create your master passphrase, enable two-factor authentication, and save the recovery kit. Then import passwords from your browser or an old spreadsheet. Expect a mess. Work through it in stages: start with email, banking, shopping and social accounts. Change reused passwords to generated ones, and delete accounts you no longer use. Turn on autofill, but check the web address before you let it fill a login form. Lookalike domains are a classic trap.

Keep your devices updated and locked with a PIN, password or biometric unlock. Biometrics are convenient, but know the fallback. If your phone is lost or stolen, you should be able to revoke access, change your master password and restore your vault from a backup. Test that process before you need it. A recovery plan you have never practised is just a hopeful guess.

Test Your Defences Like a Puzzle Solver

Ask yourself who you are protecting against. A nosy flatmate, a lost laptop, a data breach, a targeted attack? Your answers shape your choices. For most people, a reputable manager with a strong master passphrase and two-factor authentication is a huge improvement over reused passwords. For higher-risk situations, consider a hardware security key, a local-only vault, or a manager with more advanced sharing controls.

Try to break your own setup. Can you log in on a new device? Can you restore your vault from the recovery kit? Do you know what happens if you forget the master password? Are your backup codes stored somewhere safe? If you use autofill, do you still glance at the domain? These small tests turn security from a vague worry into a practical skill. That is the spirit of codebreaking: you learn the system, then you look for the weak point.

Staying in Control for Years

A password manager is not a one-off purchase; it is a habit. Review your vault once or twice a year. Remove old accounts, update weak passwords, check that recovery details are current, and make sure your emergency contact still makes sense. Keep your master passphrase strong and private. Do not share it over email or chat. If you ever suspect it has been exposed, change it immediately and rotate the passwords inside the vault, starting with email and banking.

You do not need to understand every mathematical detail to use cryptography well. You need to understand the key, the vault and the habits that protect them. Choose a manager that explains itself, set it up carefully, test your recovery, and keep your master password to yourself. That way, you get the convenience of a codebook without handing over the keys to the kingdom.