Secordit home
Contact

What is a password manager?

A password manager stores your sign-in details in a protected vault. The NCSC also uses the name credential manager. It can create a different strong password for every site, so you do not have to remember each one. You still need a strong primary password for the manager itself. 12

By Secordit. Last checked: 10 November 2026.

Go to the steps · All glossary terms

How it works

  1. The manager stores usernames and passwords in a protected vault, and can create strong unique passwords for you. 12
  2. It can fill those details on the real site, which helps against some fake-site tricks. It may also warn if a saved password has appeared in a breach. 12
  3. If the manager has its own account, turn on 2-step verification for it, and never reuse the primary password elsewhere. 12

How it can look

The NCSC recommends a password manager so people can use a different password on every account. First-party managers from the device-maker or browser-maker, such as Chrome, Safari, Edge and Firefox, are treated as acceptable. A reputable third-party manager is an option if you need features those tools lack. The NCSC does not name a best paid product. 12

Warning signs

  • The same primary password is reused on other sites. 1
  • The manager account has no 2-step verification, where that option exists. 12
  • A site or message asks you to type your vault password into a page that is not the manager or the real service. 12

What to do now

  1. Choose a built-in manager, or a reputable third-party manager if you need features the built-in tool lacks, and set a strong unique primary password. 12
  2. Turn on 2-step verification for the manager account if it has one. 12
  3. Where a site offers passkeys, the NCSC recommends those first, and a password manager for the sites that do not. 31

UK reporting and support

  • If you think a vault or an account has been taken over, follow the NCSC help for a hacked account. Change the affected passwords through the genuine sites. 4
  • For fraud or hacking in England, Wales or Northern Ireland, use Report Fraud. In Scotland, call Police Scotland on 101. 578
  • If money has gone or banking details were shared, call your bank using the number on your card. Or use 159 if your bank participates. 6
  • If someone is in danger, call 999. 78

How to protect yourself

  • Use the manager to give every account its own password. Do not reuse the primary vault password. 1
  • Turn on 2-step verification for the manager and for important accounts. 12
  • Use passkeys where a service offers them, and keep the manager for the rest. 3

Frequently asked questions

Is it safe to keep all my passwords in a password manager?

The NCSC recommends password managers for this job. Protect the vault with a strong unique primary password, and with 2-step verification if the manager has an account. That still does not make phishing impossible. 12

Should I use the manager built into my phone or browser?

First-party managers from the device-maker or browser-maker, such as Chrome, Safari, Edge and Firefox, are treated as acceptable. A reputable third-party manager is an option if you need features they lack. The NCSC does not rank a best paid product. 12

Do I still need a password manager if I use passkeys?

Yes, for sites that do not offer passkeys. The NCSC recommends passkeys where they are available, with a password manager for the sites that do not offer them. 31

Matching kit

Account Lockdown Kit · £19 · Digital download.

A self-serve guide to securing email, phone and online accounts. It does not promise to stop every attack.

General information, not legal, financial or personalised security advice. Secordit is not a police or bank reporting service.

News Pulse

Account security, explained by email.

Read about News Pulse

Sources

  1. NCSC, Password managers | National Cyber Security Centre. Accessed 10 November 2026 (Europe/London).
  2. NCSC, Trusting the tech: using password managers and passkeys | National Cyber Security Centre. Accessed 10 November 2026 (Europe/London).
  3. NCSC, Passkeys: what you need to know | National Cyber Security Centre. Accessed 10 November 2026 (Europe/London).
  4. NCSC, Help for individuals | National Cyber Security Centre. Accessed 10 November 2026 (Europe/London).
  5. Report Fraud, Report Fraud. Accessed 10 November 2026 (Europe/London).
  6. Stop Scams UK, 159 Phone number - Stop Scams UK. Accessed 10 November 2026 (Europe/London).
  7. Police Scotland, How to report a crime - Police Scotland. Accessed 10 November 2026 (Europe/London).
  8. Report Fraud, Reporting cyber crime and fraud or phishing attempts - Report Fraud. Accessed 10 November 2026 (Europe/London).