# Every password should belong to one account. You do not need to remember them all. Staying a step ahead · 01 · 9 min read Unique passwords keep one breached service from becoming a route into the rest. A manager can generate and store them, leaving you with one main passphrase and a recovery plan to understand. This page helps you: - Understand why every account needs its own password - Choose a manager by how you would get back in - Know two features to understand before you rely on them 1. **Pick one, and install it everywhere**: Many phones and browsers include a manager, and dedicated options support different combinations of devices. Compare recovery, export, and sharing before choosing. 2. **Protect the manager itself**: Use a long, unique main passphrase, turn on the strongest sign-in method the manager supports, and understand its recovery path before moving everything in. 3. **Give key accounts unique passwords first**: When you change each one, let the manager generate and store the new password. Start with email and financial accounts, then work through the rest a handful at a time. ## A meter sees the string. It cannot know its history. Compare three fixed examples. None is a passphrase to copy. The point is to separate what a page can observe from what only you and the service can know. ### A familiar pattern `Spring2026!` Capitalizing a common word and adding a year and symbol follows a pattern that guessing software can try early. Composition is not the same as unpredictability. Visible: The example is short and built from a season, a year, and punctuation. Still unknown: This illustration does not check a service's blocklist or whether a similar value has appeared in breached password data. ### A familiar quotation `the best is yet to come` Length helps, but a phrase drawn from a quotation, lyric, or saying may be tried earlier than unrelated words chosen without a familiar source. Visible: The example is longer, but its words arrive in a well-known order. Still unknown: A page cannot tell whether a phrase is personally meaningful, reused, or already known without seeing information it should not ask you to enter. ### Unrelated words `harbor tulip orbit kettle` Several unrelated words can make a long main passphrase easier to remember. This is a structural example, not a passphrase to copy. Visible: The example gains length without relying on a familiar sentence or personal fact. Still unknown: Only you can keep a real main passphrase unique to this vault. No fixed example on a public page can satisfy that requirement. ### Across all three - Length: Useful, especially without forced symbol tricks - Predictability: Patterns and familiar phrases can be tried early - Uniqueness: A public page cannot verify this without seeing your secret Reviewed July 2026. Technical reference: [NIST password guidance](https://pages.nist.gov/800-63-4/sp800-63b.html). ## The attacker may already know the password Password attacks do not always begin with guessing. After a breach, lists of email addresses and passwords circulate. Software can try those pairs against other services automatically. An old streaming password may be tested against your bank, email, or work account. This is called credential stuffing, and it is why one reused password can quietly open far more than the account it came from. A unique password for every account, kept in a password manager, also appears in guidance from the [UK NCSC](https://www.ncsc.gov.uk/collection/top-tips-for-staying-secure-online/password-managers). If every account has a different password, that chain ends at the breached service. The password may still need to be changed there, but it does not also unlock the rest of your life. A manager makes that separation practical without asking you to memorize every credential. **One leaked pair, tried everywhere** - **One password, reused** - Streaming service (breached): Leaked in the breach - Bank: Opens with the same pair - Email: Opens with the same pair - Work account: Opens with the same pair - **A different password for each** - Streaming service (breached): Leaked in the breach. Change it here. - Bank: Stays closed - Email: Stays closed - Work account: Stays closed With a different password for every account, the chain ends at the breached service. ## What one vault changes "Isn't putting every password in one place more dangerous, not more secure?" The answer depends on the provider's design. Many managers encrypt a vault before syncing it and describe their design as _zero-knowledge_. Check what the provider can access, how it protects the vault, and what recovery options it offers. The label alone is not enough to compare two services. The practical comparison is between a managed vault and passwords stored or reused another way. A manager can reduce reuse, but its security still depends on the provider, your main passphrase, recovery settings, and the devices you use. > A password manager can keep a different password for every account. Before you rely on one, learn > how it protects your vault and how you would get back in if you lost access. ## The key and recovery path Learn what happens if you forget the main passphrase or lose a device. Recovery options differ by provider. Before moving your passwords, learn what happens if you forget the main passphrase or lose a device. Store any recovery code using the provider's instructions, somewhere secure that you can reach without opening the vault. A password manager's own recovery code cannot do its job if the only copy is locked inside that manager. ## Two features to understand before you rely on them - A · **Breach notices**: Some managers offer breach notices for saved accounts. Check what the notice covers and confirm it through the affected service before changing anything. - B · **Emergency access or recovery contacts**: Some managers offer emergency-access or recovery-contact features. Check what the other person can access, how long approval takes, and how you can revoke it. ## The category name tells you less than the recovery plan. Built-in, standalone, open-source, and family managers are overlapping descriptions. A tool can be several at once. Choose a criterion below to see the question worth answering in the provider's documentation. ### Where it works Ask: Will it work everywhere you regularly sign in? A manager only reduces reuse if it is available at the moment you need a credential. Built-in and standalone tools can both span devices, but their boundaries differ. Check: List the phones, computers, browsers, and apps you use. Confirm where the manager can create, save, and fill credentials, and what changes if you move to another device brand. ### Recovery Ask: What can you still reach when the vault will not open? Providers recover accounts in different ways, and some cannot restore a forgotten main passphrase. A recovery route that lives only inside the locked vault is not a recovery route. Check: Read the provider's recovery instructions before moving everything in. If it issues a recovery code, keep that code somewhere secure that you can reach without opening the vault itself. ### Moving later Ask: Can you leave without rebuilding every login by hand? An export can make switching practical, but it may also create a readable copy of the vault. Portability matters, and so does the provider's handling guidance. Check: Find the export and import instructions. Check which data moves, how the exported file is protected, and how to delete that file safely after a move. ### Sharing Ask: Can shared access stay limited and reversible? A family plan, a standalone manager, and an open-source manager may all offer sharing. The useful distinction is how access works, not the category name. Check: Look for separate private and shared areas. Confirm who can add or remove a person, whether access can be revoked, and what happens to shared items afterward. ## Autofill can notice a mismatch before you do A manager generally associates a saved login with a site or app. If it does not offer a login where you expect one, stop and check the address yourself. Autofill behavior varies, so its silence proves nothing on its own. Treat it as a prompt to look more closely. More on reading addresses in [spotting a fake site](https://explained.withpersona.com/your-identity-online/fake-sites). A practical first session is to install the manager on the devices you use, learn its recovery process, and create a unique main passphrase. Start with email and financial accounts, then move the rest a few at a time. --- _Part of Identity Explained (by Persona). https://explained.withpersona.com/your-identity-online/password-managers_