Never remember a password again: password managers in plain English

Imagine never having to remember a password again. No more “forgotten password” emails, no more passwords on sticky notes, and no more being locked out of something important the day you need it.

That’s what a password manager does. Most people have never heard of one, but you may already have one on your phone.

The problem it solves

Most of us have dozens of logins: email, banking, suppliers, social media, the domain name for our website. Remembering a different password for each one is impossible, so people reuse the same one everywhere, or write them down and lose the list. And for the things you only log into once a year, like your domain name, you end up resetting the password every single time, usually at the worst moment: your domain is about to expire, or you need something urgently.

We see the cost of this all the time. The thing that most often holds up a new website isn’t the design or the content. It’s a password nobody can find: the email account the domain was registered with, or the login to change where the domain points.

What a password manager is

Think of it as a locked notebook that lives on your phone and computer, holding every password you have. You remember one password to open it, and it does the rest.

The UK’s National Cyber Security Centre explains it simply: a password manager “stores passwords safely for you, meaning that you can have unique passwords for each service as you won’t need to remember them.”

In practice:

• It fills them in for you. When you go to log in, it offers the right username and password. One tap.
• It makes strong ones for you. When you sign up for something new, it suggests a long, random password and saves it straight away.
• It’s on all your devices. Save a password on your phone, and it’s there on your computer too.

This is the clever part. Because you never have to remember your passwords, they can be ones you couldn’t remember if you tried: long, random, and different for every account. That’s exactly what makes a password hard to guess or steal. The NCSC points out that a password manager can “quickly create a strong and unique password for each account”, so one leaked password never opens anything else.

Why it matters for your business

Your email password is the one to protect most. The NCSC warns that if someone gets into your email, they could “reset all your other account passwords”, because “forgotten password” links go to your inbox.

It works the other way too. If you can get into your email and you have your passwords saved, you can always get back into everything else: your website, your domain, your Google listing.

Your options

You may already have one

• Apple Passwords, on iPhone, iPad and Mac. Since iOS 18 and macOS Sequoia, Apple has a Passwords app for your passwords and verification codes, kept in step across your Apple devices with iCloud Keychain. You can share passwords with family or colleagues in a shared group. On a Windows PC, you can reach them in Chrome or Edge through iCloud for Windows.
• Google Password Manager, in Chrome and on Android. Google says it’s “built in to the Chrome web browser and Android devices”, so there’s nothing to install.

If all your devices are Apple, or you use Chrome and an Android phone, start with the one you already have.

If you use a mix of devices, or share with staff

• Bitwarden works on any phone, computer and browser. It has a free plan that covers most people, including sharing with one other person, and paid plans for families and teams.
• 1Password also works on everything. It’s paid, with a 14-day free trial, and makes it easy to share passwords with family, or with anyone through a link that expires.

They all do the same core job well. The best one is the one you’ll actually use.

Getting started

First, open it:

• iPhone, iPad or Mac: open the Passwords app. If you can’t find it, update your device: it came with iOS 18 and macOS Sequoia.
• Android phone, or Chrome on any computer: sign in to Chrome with your Google account, and it saves passwords as you go. To see them, go to passwords.google.com.
• Bitwarden or 1Password: download the app from your phone’s app store, or from their website for your computer, and create an account.

Then, don’t try to do everything at once. Add these first, because if you forget these, you can be locked out of your own business:

• Your email account. The key to everything else.
• Your domain name (yourbusiness.co.uk). The company you registered it with, such as 123 Reg, GoDaddy, IONOS, Fasthosts or Namecheap, and the login for it. Not sure which? Search your inbox for your domain name: the renewal emails come from them.
• Your Google Business Profile, or the Google account that manages it.
• Your website’s admin, and your social media accounts.

Then add the rest as you go. Each time you log in to something, your password manager will offer to save it.

Two things to get right:

1. Remember the one main password. The NCSC says it’s “the key to accessing your password manager”, so make it strong, and one you won’t forget.
2. Turn on two-step verification for the password manager. It’s an extra step to prove it’s really you, usually a code sent to your phone. It can feel like a nuisance, but the NCSC calls it “one of the most effective ways to protect your online accounts”: even if someone learns your main password, they can’t get in without your phone.

What if I forget the main password?

It’s the first worry most people have, so it’s worth knowing before you start.

• Apple and Google: your passwords are kept with your Apple or Google account, so getting back into that account gets you back into your passwords. Google suggests adding recovery details, like a phone number, so you always can.
• Bitwarden and 1Password: your main password is never known to them, which is what keeps your passwords safe, but it also means they can’t reset it for you. Set up a way back in on day one: 1Password gives you an Emergency Kit to keep somewhere safe, and on a family plan the organiser can help you back in. Bitwarden lets you add a password hint, or a trusted emergency contact.

Ten minutes setting up a way back in is what makes a password manager safe to rely on.

Don’t give your passwords to your web designer (including us)

Sooner or later, someone will need to work on your accounts: a web designer or developer, someone running your social media, a bookkeeper, a member of staff. A good one doesn’t need your password. Most services let you add another person with their own login, such as your Facebook Page and your website’s admin. They get access to what they need, you can see who has it, and you can remove it in a click when the work is done.

Where a service can’t do that, log in yourself and do it together, on a call if need be. As a last resort, share it through your password manager, never by text or email, and change it once the job is done.

We work this way ourselves. We’ll never ask you to email us a password: we’ll ask you to add us as a user, or sit with you while you log in.

If you’re about to have a website built, sorting this out first makes everything quicker. Our guide to who owns your website explains which accounts should always be in your name.