Password managers: what they are and how they differ

So what is a password manager? It’s an app that remembers your passwords for you. It creates a different, hard-to-guess password for every account, keeps them all in one encrypted vault, and fills them in when you sign in. You unlock the vault with one strong master password (or a PIN or fingerprint), so that is the only one you have to remember.

That matters because reused passwords are one of the easiest ways into an account. If a password leaks from one service, for example in a data breach, criminals can try it on others. The Australian Signals Directorate’s ACSC describes password managers as tools that “can help you create, manage and store passwords for each of your accounts”. Its small business guide describes one as acting “like a virtual safe for your passwords”.

This guide starts with the password managers already built into phones and browsers, then explains how they work, what the ACSC says about using them safely, the points worth comparing, and how five widely available options describe themselves.

Do you need one?

What official guidance says is that every important account is better off with a unique password. The ACSC’s small business guide describes using a password manager to create and store unique passwords for each important account, and the ACSC’s account pages describe passphrases and multi-factor authentication (MFA) as the other main protections. The guide to securing online accounts covers both.

Many people already have a password manager:

• Apple says its Passwords app is built into iOS 18, iPadOS 18, macOS Sequoia and later, and syncs passwords and passkeys across approved Apple devices.
• Google says Google Password Manager is built into Chrome on all platforms and into Android.

For someone who uses one ecosystem, a built-in manager may cover what they need. A standalone product adds something mainly for people who use different brands of device and browser, or who want features such as sharing with others or business administration.

How to turn on Apple’s built-in Passwords app

Based on Apple’s instructions (checked October 2026). Menus can change between versions; Apple’s guide has the latest steps.

1. Update each Apple device to the latest software.
2. In Settings (or System Settings on a Mac), tap your name, then iCloud > Passwords and Keychain, and turn on iCloud Keychain.
3. Go to General > AutoFill & Passwords and turn on AutoFill Passwords and Passkeys.
4. When you create a new account, let the device suggest a strong password.

For Google Password Manager, the guide to securing online accounts walks through Google’s steps.

How a password manager works

The ACSC describes password managers as able to:

• generate strong and unique passwords
• store passwords and other logins in one place, accessible from any device
• enter passwords automatically on a login web page.

Behind the scenes, the vault is encrypted. Several providers describe their design as end-to-end encrypted, meaning data is encrypted on your device before it is synced, so the provider says it can’t read it. The ACSC describes encryption as what “prevents anyone from accessing your stored information without your master password”.

Many password managers now also store passkeys, the newer sign-in method that replaces a password with a cryptographic key on your device. What passkeys are and how they work explains them.

What to compare

These are the points the ACSC and the makers themselves discuss.

• Reputation and updates. The ACSC says to check whether the company and product have a good reputation, and whether the product has strong security and privacy features and gets regular updates.
• Encryption design. Makers describe their encryption in their security documentation. “End-to-end” and “zero-knowledge” are terms makers use to say they can’t read your vault.
• Breach alerts. The ACSC lists “alerting you if one of your passwords has been exposed in a data breach” as a feature to look for. Makers describe this under different names, and some limit it to paid plans.
• Passkey support. Which apps and devices can save and use passkeys differs between products.
• Platforms. A password manager is most useful when it works on every device and browser a person uses. Makers list their supported platforms.
• MFA on the vault. The ACSC’s guidance describes turning on MFA for the password manager itself, where available.
• Recovery. What happens if the master password is forgotten? Designs differ, and each maker explains its own. The guide to planning account recovery covers the general idea.
• Transparency. Some makers publish their source code or independent audit reports.
• Sharing and business features. Makers describe sharing with trusted people and, on business plans, administration for teams.

How the products compare

Based on makers’ published specifications, checked October 2026. Listed alphabetically, not ranked. Features and plans change, so each maker’s site has the current details, including pricing.

The product summaries further down this page set out what each maker states, with links to their pages.

How to move an account into a password manager

The ACSC’s password managers page sets out these steps for moving an account into a password manager (checked October 2026; the ACSC’s page has the latest version):

1. Log in to your chosen password manager.
2. Add the account’s name, current login details and web address.
3. Use the password manager’s built-in generator to create a strong and unique password or passphrase.
4. Log in to the account and change its password to the new one.
5. Check whether you can also turn on MFA for that account.
6. If the password manager supports it, allow automatic login entry for trusted devices and websites.

The ACSC also describes changing important passwords often, and changing any password exposed in a data breach straight away.

Things to watch for

• An unlocked device. The ACSC says leaving a password manager and device unlocked can give anyone access to your accounts.
• Shared and public computers. The ACSC says not to use the “remember me” feature for a password manager on a public or shared device.
• The master password. The ACSC says it should be the strongest password you can remember, should not be shared or include personal details, and describes a passphrase. It compares forgetting it to “losing the key to your safe”. See how to create a passphrase.
• Browser prompts. The ACSC’s guidance says never to save the master password to a browser if prompted.
• Notes apps aren’t password managers. The ACSC’s case study describes someone who kept passwords in a phone notes app, “giving criminals easy access to her accounts”.
• Bank terms. The ACSC notes that some service providers, such as banks, may not cover losses if a password is stored in a password manager. Each provider’s terms set out its position.
• Extra recovery items. Some products use extra secrets alongside the password; 1Password, for example, describes a Secret Key. Each maker explains how to keep these safe.

Common questions

What is a password manager and how does it work?

A password manager is an app that remembers passwords for you. The ACSC describes password managers as able to generate strong and unique passwords, store logins in one place accessible from any device, and enter them automatically on a login page. The vault is encrypted and unlocked with one master password, PIN or biometrics, and many password managers also store passkeys. See how a password manager works.

Do I need a password manager?

Many people already have one. Apple says its Passwords app is built into iOS 18, iPadOS 18, macOS Sequoia and later, and Google says Google Password Manager is built into Chrome and Android. The ACSC’s small business guide describes using a password manager to create and store unique passwords for each important account. A standalone product adds something mainly for people who use different brands of device and browser. See Do you need one?

Are password managers safe?

The ACSC calls them useful tools that are also attractive targets to cybercriminals. It describes protecting one with a reputable product, a strong and unique master passphrase and MFA on the password manager itself, and warns that leaving a password manager and device unlocked can give anyone access to your accounts. Several makers describe end-to-end encryption, meaning data is encrypted on the device before it’s synced. See things to watch for.

Is a free password manager safe?

The ACSC’s guidance doesn’t split password managers into free and paid. It describes checking the company’s reputation, the product’s security and privacy features and regular updates, alongside a strong master passphrase and MFA. Apple and Google build password managers into their devices and browsers. Among standalone products, Proton describes a free plan, and Bitwarden says its Data Breach report is free for all users, with most other vault health reports on paid plans. See the comparison table.

What happens if I forget my master password?

It depends on the product. The ACSC compares forgetting the master password to losing the key to a safe. Makers handle recovery differently: 1Password, for example, says only the account holder can unlock their vaults, and describes a Secret Key used alongside the account password. Each maker’s help pages explain its recovery options, and the guide to planning account recovery covers the general idea.

Will my bank cover losses if I keep my banking password in a password manager?

Not necessarily. The ACSC notes that some service providers, such as banks, may not cover losses if a password is stored in a password manager. Each bank’s own terms and conditions set out its position, so they’re the place to check. If account details have been misused, IDCARE offers free support on 1800 595 160, and the guide on what to do if an account has been hacked lists next steps.

Where to get official help

The ACSC’s password managers page is the official Australian reference. If account details or personal information have been misused, IDCARE offers free support on 1800 595 160. Related guides: how hardware security keys work and what to do if an account has been hacked.