Choosing and using password managers

Module 2: Passwords and logging in · Reading time: 9 minutes

Learning objective: After this lesson you can choose and set up a password manager, protect the master password and share passwords safely within a team.

Key concepts: password manager, master password, vault, end-to-end encryption, shared vault, emergency access, browser password manager

What a password manager does

In lesson 2.1 you saw that every account needs its own long, random password. Nobody can remember eighty of them. A password manager is software that does it for you. It:

creates a strong, random password for every service;
stores all passwords encrypted in a vault;
fills them in on the correct website, and only there;
often warns you about weak, reused or leaked passwords;
with many products, can also store two-factor authentication (2FA) codes and passkeys (lessons 2.3 and 2.4).

You only need to remember one: the master password that opens the vault. The NCSC recommends a password manager as a standard basic measure, also for small organisations, with clear agreements on which manager you use and for which accounts it is mandatory.

Types of password managers

There is no single best type. The NCSC distinguishes between the manager in the browser, the standalone app, and online (cloud) versus offline (local). In practice you will come across these forms:

Type	Example of how it works	Advantages	Disadvantages
Built into the browser or operating system	The browser or your phone offers to save a password and fills it in later	Already there, easy, syncs within the same ecosystem	Often no separate master password: anyone who gets into your computer gets into your passwords; less suitable across different systems and for sharing in a team
Standalone app with cloud sync	A separate app and browser extension on all your devices, vault encrypted at the supplier	Works on all systems, shared vaults, team management, warnings	You trust the supplier; you need a strong master password
Local (offline)	An encrypted vault file on your own computer	You keep everything in your own hands	You handle backup and syncing yourself; sharing is harder
Open source, possibly self-hosted	The code can be checked publicly; some you can run on your own server	Verifiable, no dependence on a single company	Self-hosting means updating, securing and backing up yourself

Well-known examples of standalone managers are Proton Pass, 1Password, Bitwarden and KeePassXC, alongside the managers built into browsers and operating systems. In the guide Password manager in practice we compare 23 password managers on ease of use, security and privacy (EU and GDPR), including the company's country, the price and reviews (see Further reading). Our advice there: Proton Pass, or 1Password if you want the very easiest option. Not sure? Then choose based on the questions below.

Questions to ask when choosing

Does it work on all your devices and browsers, including your colleagues'?
Can you share vaults with permissions per folder, and remove someone from a vault again?
Is the vault end-to-end encrypted, and what is and isn't encrypted (for example the website addresses)?
Can you protect the vault with two-factor authentication or a passkey?
Is there emergency access or a recovery option, and exactly how does it work?
Can you export your data if you want to switch?
For free versions: what is the business model?

End-to-end encryption: what if the supplier is hacked?

With a good cloud manager, your vault is encrypted on your device with a key derived from your master password. The supplier only receives the encrypted package. This is called end-to-end encryption (sometimes "zero knowledge"). The supplier cannot read your passwords, and so cannot reset your master password for you either.

If the supplier is hacked, an attacker can steal the encrypted vaults. They can then try to crack them offline, as in lesson 2.1. At that point your master password is your only protection. That's why:

The master password is long and unique: a passphrase of at least five, preferably six random words.
You use it nowhere else.
After a breach at the supplier, you change your master password and the passwords of your most important accounts. After all, the old, stolen vault is encrypted with the old master password.

Two-factor authentication on the vault helps against someone who has your master password and wants to log in via the website. It does not help against cracking a stolen vault file. The NCSC says so too: 2FA on the manager is no reason for a weak master password.

Protecting the master password

With a good manager, forgetting the master password is often final: the supplier cannot recover it. So sort this out in advance:

Write the master password on paper and keep it in a safe place at home. The NCSC considers this fine, as long as you don't write down what it is for.
Create the recovery kit or emergency code your manager offers, print it and keep it with the paper.
Only type the master password into the manager's own app or extension, never on a website that asks for it.
Turn on automatic locking after a few minutes of inactivity.

Why autofill helps against phishing

A password manager links each password to the website's address. On https://mijnbank.example it fills in your password. On a lookalike such as https://rnijnbank.example (rn instead of m) or https://mijnbank-veilig.example it does nothing, because those addresses aren't stored with the item.

A person often can't see the difference between rn and m. The manager compares characters and never gets tired or rushed. That is real security, but only if you let it do its job:

Does your manager suddenly not fill anything in on a site where it always did? Don't work around it by copying the password by hand. First look very carefully at the address. This is exactly the moment the manager is warning you.

Sometimes there is a good reason it doesn't fill in: a service that has moved to a new address. Check that through another route, for example by typing the address you already knew yourself.

Sharing in a team

In a small business there are always accounts you use together: the webshop on webwinkelplatform.example, the account at koeriersdienst.example, the company's social media. It's best if everyone has their own account (module 7). If that isn't possible, use a shared vault:

Create vaults or folders per topic ("Webshop", "Finance", "Social media") and only give access to those who need it.
Never share via email, chat or a spreadsheet. Anyone with access to the shared vault sees the password there.
Someone leaving? Remove them from the vault and change the passwords they could see. Removing them from the vault alone is not enough: they may have copied or saved them.
Arrange emergency access: what happens if you, the owner, are ill or no longer available? Many managers have a feature that gives a trusted person access after a waiting period. Or you keep the recovery details in a sealed envelope with a second person.

In practice: switching in one afternoon

Choose a manager and install it on your computer and phone, with the browser extension.
Create a master password (passphrase), write it down, keep the recovery kit safe.
Turn on two-factor authentication for the vault.
Import the passwords your browser already saved. An export is often an unencrypted file: delete it right after the import, including from the recycle bin.
Start with the most important accounts and give each a new, random password: your mailbox (info@example.com), your hosting and domain registration, your bank and your accounting software (for example on boekhoudpakket.example).
Update the rest whenever you log in anyway. The warnings about reused passwords will help you.

Do you use a service in the WebOké environment, such as a mailbox or Nextcloud, with apps on your phone? For that you sometimes create a separate app password (see Knowledge Base 436). You store that in the manager too, with the right item. Other providers work in a similar way.

Summary

A password manager creates, stores and fills in unique passwords; you only remember the master password.
Types: built into the browser or system, standalone app with cloud, local, open source or self-hosted. Choose based on devices, sharing, encryption and recovery.
With end-to-end encryption, your master password is the last line of defence if the supplier is hacked.
If the manager doesn't fill in, look at the address instead of copying.
Share via a shared vault and change passwords when someone leaves.

Quiz

Exercise

Exercise D2.2: Setting up your password manager. Choose a password manager, create a master password and a recovery kit, turn on two-factor authentication for the vault and give your five most important accounts a new, unique password. Tick off the checklist and answer the reflection questions. You don't enter a password anywhere.

Exercise D2.2: Setting up your password manager

Here's how to approach it: (1) Choose a type of password manager (built in, a separate app with cloud sync, local, open source, or self hosted) using the questions from lesson 2.2. (2) Install it on your computer and phone, with the browser extension. (3) Create a master password: a passphrase of at least five, preferably six random words. Write it on paper and keep it somewhere safe at home, together with the manager's recovery kit or emergency code. (4) Turn on two-factor authentication (2FA) for the vault. (5) Import your existing passwords from your browser and delete the export file straight away, including from the recycle bin. (6) Give your five most important accounts a new, random password of at least 15 characters: mailbox, hosting or domain registration, bank, accounts, and the account everything else depends on. (7) If you work with others: create a shared vault for shared accounts and only add the people who need them.

Password manager chosen and installed on all my devices
Master password is a passphrase and isn't used anywhere else
Master password and recovery kit are on paper somewhere safe
Two-factor authentication (2FA) is on for the vault
Export file deleted after import
The five most important accounts have a new, unique password
Auto-lock is switched on
(team) Shared vault with only the people who need it

Why did you choose this type of manager, and what's the biggest downside for you?

Who can get to your passwords if you're out of action for a month starting tomorrow, and how have you arranged that?

For which account did the manager not fill in automatically, and what did you check then?

Your ticks and notes only stay in this browser; we don't send them anywhere. If you're signed in, we only save in My courses that you've done the exercise.

Cookies at WebOké

Cookie settings

Necessary

Marketing