What is a Password Manager? Security & IAM
A password manager is an application that stores passwords and other confidential data in an encrypted vault, and fills in your credentials automatically when you log in. The only password you need to remember is the one that unlocks the vault itself. That single requirement makes it feasible to use a genuinely strong, unique password for every account you hold.
Password managers are used both privately and within organisations. The core functionality is the same in both contexts; business solutions add centralised administration, audit logging, and policy enforcement on top.
How Does a Password Manager Work?
A password manager runs either as a cloud application or as software installed locally on a device. You set it up with a username and a master password, and optionally protect it further with Multi-Factor Authentication (MFA) or a hardware security key such as a YubiKey. From there, everything is stored in and retrieved from the encrypted vault.
Adding items
Adding a password is straightforward. You specify the type of item, enter the site name, URL, username, and password, and save it. If you are creating a new account and need a password, the built-in password generator creates one for you to your specifications: minimum length, character types, and complexity rules can all be configured. The generated password is saved automatically.
Logging in
Most password managers provide a browser extension that recognises login pages for stored accounts and fills in the credentials automatically. Creating a new account somewhere adds it to the vault in one click. The autofill function handles the vast majority of logins without any further action required.
Sharing credentials
Many password managers include a sharing function. In personal use this is useful for shared accounts such as streaming services. In business environments, sharing individual credentials is generally not recommended. SSO and IAM provide better-controlled solutions for shared access at an organisational level.
Benefits of a Password Manager
Benefit | What it means in practice |
|---|---|
One password to remember | Your master password is the only credential you need to recall, making it realistic to choose a genuinely strong one |
Strong, unique passwords everywhere | Every account can have a distinct, complex password without you needing to remember any of them |
Autofill | Credentials are entered automatically or with one click; no typing, no copy-pasting |
Synchronisation | Cloud-based managers make your credentials available across all devices automatically |
Phishing protection | The URL of each site is stored alongside its credentials; a phishing site using a different URL will not be recognised and will not be autofilled |
Encrypted vault | Without the master password, the stored data is inaccessible regardless of where it is stored |
Are Password Managers Secure?
Yes. Whether data is stored locally or in the cloud, it is encrypted using strong methods such as AES-256. The main area requiring attention is the master password itself. Because it protects everything in the vault, it needs to be both strong and unique. Adding MFA or a hardware key such as a YubiKey significantly raises the bar for anyone attempting to access the vault.
That security applies to the vault, not to every downstream interaction. Once credentials are passed to a target application or website, they travel through the normal channels and could theoretically be intercepted or stolen at that end. A password manager makes your password hygiene as strong as possible, but passwords remain inherently vulnerable as an authentication method. This is part of the reason for the growing focus on passkeys and biometric authentication, which remove the shared secret entirely.
Choosing a Password Manager
The right choice depends on your requirements. For business use, the evaluation criteria tend to go well beyond what personal users need.
Criterion | What to assess |
|---|---|
Security | End-to-end encryption (E2EE), AES-256 algorithm, MFA support |
Device compatibility | Operating systems, browsers, and mobile platforms supported |
Usability | Ease of adding items; reliability and speed of autofill |
Cost | Feature set per subscription tier; many free tiers lack key functionality |
Future-proof | Support for modern authentication methods such as passkeys |
Reputation | Security incident history and vendor response; open-source codebase and auditability |
Business requirements | Centralised management, user support, monitoring, reporting, compliance with internal IT policies |
How to Create a Strong Password
A strong password is one where cracking it would require more time and computing power than the value of what it protects. The main threat is not someone attempting to log in directly; repeated failed login attempts are detected and blocked quickly. The real risk is a stolen or leaked credentials database.
When a database is compromised, passwords are stored as hashed values. You cannot log in with a hash, but offline brute-force techniques can test millions of password combinations per second against it until a match is found. Two factors determine how long that would take: complexity and length.
Complexity means using a mix of character types: upper and lower case letters, numbers, and special characters. More character types means more possible combinations for each position in the password.
Length matters more. A 20-character passphrase made of three random words can take centuries to brute-force, whereas an 8-character password with symbols can be cracked in minutes. Every additional character multiplies the number of possible combinations exponentially. Passwords of 8 characters are now widely considered too short. ncsc
Because your password manager stores every password for you, there is no reason to hold back on length or complexity for your stored passwords. Use the maximum your settings allow.
Choosing Your Master Password
Your master password is the exception: you need to remember it yourself. Very long and very complex works against you here, because you will forget it or write it down.
The NCSC recommends a practical solution to this. Create your master password using three random words. The result is long enough to be cryptographically strong and memorable enough to recall without writing it down. Adding a fourth word or a number strengthens it further while keeping it rememberable:
coffee train fish lamp
A passphrase of unrelated words is both easier to recall than a complex character string and significantly harder to crack by brute force. HelloID's passphrase tool uses this principle to generate secure passphrases automatically. You can also check the strength of any password using our password strength checker.
Password Managers and HelloID
If your organisation uses an IAM platform such as HelloID, do you still need a password manager? In most cases, yes, though the two complement rather than duplicate each other.
HelloID manages accounts and access rights across your connected systems, ensuring every user has the correct permissions at all times. How users authenticate to those systems depends on your setup.
Most organisations using HelloID handle authentication through the HelloID Access Management module or an external identity provider such as Active Directory or Entra ID, giving users Single Sign-On (SSO). With SSO in place, users authenticate once at the start of a session and gain automatic access to all registered applications. The role of the password manager is reduced significantly in that setup.
It is rarely eliminated entirely. Not every business application supports SSO. Staff also use work-related websites and tools outside the IAM-managed environment. A password manager handles those credentials securely where SSO cannot reach.
The practical split is straightforward: SSO covers your managed application estate. A password manager covers everything else.