Password managers: the single highest-leverage security habit

Most account compromises do not involve sophisticated hacking. They involve a password that was reused, guessable, or caught in a breach elsewhere. A password manager fixes the root cause by making strong, unique passwords effortless — which is why it is the highest-leverage habit in personal security.

What it changes

• Generates a long, random password for every account, so one breach can't cascade.
• Fills credentials only on the genuine site, which quietly defeats many phishing pages.
• Lets you see, at a glance, which of your logins are weak, reused or exposed.

Adopting one without the overwhelm

1. Install the manager and its browser extension; set a long, memorable master password.
2. Turn on a second factor for the manager itself.
3. Let it capture logins as you sign in normally over the next few weeks — don't try to migrate everything in one sitting.
4. Fix your most important accounts first: email, bank, primary cloud account.

The honest risks

A manager concentrates risk behind one master password, so that password and its second factor matter enormously. Reputable managers use end-to-end encryption, meaning the provider cannot read your vault — but you must not lose the master password, because they cannot recover it for you. That trade — one strong secret you protect carefully, in exchange for unique passwords everywhere — is overwhelmingly worth it.