Ask any IT professional or cybersecurity specialist and they’ll tell you: password managers are a great tool and should be used by businesses of all sizes.
Presumably, if they’re endorsed by the experts, password managers must be good — safe, secure, cost-effective, all that jazz. And yet…
65% of Americans don’t trust password managers (source).
There’s clearly a disconnect. Why is there such widespread distrust of a tool designed to help us stay safe online? Here’s what we think is going on: people like to understand the “why” behind the “what.” Experts telling you to use a password manager isn’t enough — so let’s explain why they’re actually safe, in plain English.
What Is a Password Manager?
A password manager is an app that both creates and stores your passwords. It also uses autofill to enter your passwords so you don’t have to type them manually — which isn’t just convenient, it also protects against keylogging.
What’s the Point of a Password Manager?
In today’s world, where practically every online service requires a distinct sign-in, most of us have a lot of passwords to keep track of — ten, twenty, even 100+. Unless you’ve been blessed with a memory that’d put an elephant’s to shame, memorizing all of those credentials is impossible.
Some of us just give up on having unique passwords. A survey by Google found that 52% of us reuse passwords, and a shudder-inducing 13% use a single password for everything. This is a terrible idea: if one account is breached, hackers will try that password everywhere else too.
A password manager creates and stores unique, long, random passwords (often 50+ characters) for every account, so you don’t have to remember them yourself. Length matters more than you’d think:
A 12-character password takes 62 trillion times longer to crack than a 6-character password (source).
The “Eggs in One Basket” Objection
The obvious worry: isn’t keeping all your credentials in one place a recipe for disaster? It’s understandable — but let’s examine it.
The relative security of a password manager comes down to your master password — the one password you actually need to remember. If a hacker gets your master password, they could in theory access everything, which is exactly why layering on multi-factor authentication matters so much.
Make your master password long and random — don’t go below 10 characters, and 20-30+ is better. A few tricks for making a long password memorable:
- Use a phrase or sentence: Tallpeoplehittheirheadsondoorsoften
- Choose a phrase that evokes a vivid image: Bobstoleanappleandwenttojail
- Add a deliberate misspelling to dodge dictionary attacks: Bobstoleanapleandwenttojale
- Add special characters for extra complexity: Tall%peoplehit!theirheadsondoors#often
If a reputable password manager forgets your master password for you when you lose it, that’s a red flag — a trustworthy provider follows a “zero knowledge” policy and never has access to your actual passwords. Instead, they store only the encrypted version, unlockable solely with your master password.
Layers, Layers, and More Layers
Password managers are human-made, so they’re not infallible — brute-force attacks exist. But even a successful breach runs into a wall thanks to encryption: your passwords are gold, but encrypted, they’re garbage. Without the master password, turning that garbage back into gold is extremely difficult, which is why pairing a password manager with multi-factor authentication matters so much — one peer-reviewed study found MFA reduces the risk of commercial account compromise by 99.22% (source).
Finally, supplement your password manager with the fundamentals: regular software patching and a robust anti-virus. A world-class master password won’t save you if your computer is infected with malware logging every keystroke.
A Message to Business Owners
Maybe you think you’ve got a clever personal system for handling credentials that beats a password manager. Fair enough — but that’s not really the point. Using a password manager at your organization protects not just your credentials, but your entire team’s. You might practice good password hygiene, but you can’t guarantee the same from every employee, and one weak link can lead to a breach.
Password managers aren’t infallible. But until the passwordless future actually arrives, they’re the best option going — for your business and your personal life alike.
Don’t Go It Alone
Feeling overwhelmed by cybersecurity, or IT in general? Modern IT is genuinely too complicated to handle solo, which is why more organizations are turning to managed service providers to take it off their plate.
If you’re looking for an experienced, reputable MSP, get in touch with CelereTech — we’ll help bring your cybersecurity up to speed and under budget.
