Skip to main content
Identity Authority
Category: Passwords & Hashing

Password Manager

Also known as: Password Vault, Credential Manager
Simply put

A password manager is a software tool that stores and organizes your login credentials in an encrypted database, often called a vault. It can take the form of an app, a browser extension, or a feature built into an operating system or browser, and many also store related items such as passkeys, payment card details, and other sensitive information.

Formal definition

A password manager is a software application that stores usernames, passwords, and in many implementations additional secrets (such as passkeys, payment details, or files) within an encrypted collection commonly referred to as a password vault. The vault is intended to be encrypted at rest, typically protecting stored credentials so they can be retrieved and supplied at authentication time. A password manager assists a user in supplying credentials during the authentication step but does not itself constitute an authentication or authorization protocol; its role is credential storage and retrieval rather than identity verification or access decisioning. Deployment forms vary, standalone applications, browser extensions, and platform-built-in features, and specific capabilities (for example passkey support or enterprise features such as shadow IT visibility) depend on the vendor and product. Details of encryption schemes, key derivation, and vault synchronization are out of scope for this definition and vary by implementation.

Why it matters

Password managers address a persistent tension in identity practice: strong authentication depends on credentials that are unique, high-entropy, and hard to guess, yet human users struggle to create and remember many such secrets. By storing login credentials in an encrypted vault, a password manager allows users to maintain distinct strong passwords across services without reusing them, reducing the blast radius when any single service is compromised. This directly counters credential stuffing and password reuse attacks, where credentials exposed in one breach are replayed against unrelated accounts.

Because the vault concentrates many credentials in one place, it also becomes a high-value target, and the security of the master credential and the vault's encryption at rest become critical dependencies. Many implementations now store additional secrets beyond passwords, passkeys, payment card details, and sensitive files, which broadens both the convenience and the potential impact of a vault compromise. It is worth being clear about scope: a password manager assists a user in supplying credentials during the authentication step, but it is not itself an authentication or authorization protocol and does not perform identity verification or access decisioning.

In organizational settings, password managers increasingly extend beyond individual credential storage toward governance-adjacent capabilities. Some enterprise products advertise features such as shadow IT visibility across SaaS and AI tools, giving administrators insight into where employees are creating accounts. These capabilities vary by vendor and product and should be evaluated against actual requirements rather than assumed.

Who it's relevant to

IAM Engineers and Security Architects
Password managers factor into how organizations reduce password reuse and support unique, high-entropy credentials across services. Architects should treat the vault as a high-value target and evaluate deployment form (standalone app, browser extension, or platform-built-in feature) and capabilities such as passkey support against their environment, recognizing that specific behaviors depend on the vendor and product.
System Administrators
Administrators are often responsible for rolling out and supporting password managers across a workforce. Some enterprise products offer features such as shadow IT visibility across SaaS and AI tools, which can inform account governance; these features vary by vendor and should be validated rather than assumed.
Compliance Officers
Password managers are relevant to policies requiring unique, non-reused credentials and encrypted storage of sensitive data. Because encryption schemes and vault protections vary by implementation, compliance teams should confirm that a given product's stated protections align with the controls their frameworks require rather than treating all password managers as equivalent.
End Users
For individual users, a password manager stores and organizes login credentials, and in many products passkeys, payment details, and other sensitive items, in an encrypted vault, removing the need to memorize many distinct passwords while supporting stronger, unique credentials per service.

Inside Password Manager

Encrypted credential vault
A secured store, typically protected by strong encryption, that holds usernames, passwords, and often other secrets. The encryption keys are generally derived from a master secret so that stored data remains unreadable without the user's master credential.
Master password or unlock mechanism
The primary knowledge factor (or, in some deployments, a biometric or possession-based unlock) that authenticates the user to the manager itself and enables decryption of the vault. Its strength largely determines the security of everything inside.
Credential generation
Functionality that creates long, random, high-entropy passwords, reducing reuse across sites. This addresses password quality but does not by itself change how any given service authenticates the user.
Autofill and form-filling integration
Browser extensions or platform integrations that populate credential fields on matching sites or applications. Domain-matching behavior varies by product and affects resistance to phishing.
Synchronization and storage model
The mechanism by which vault contents are stored and, in many deployments, synchronized across devices. Implementations range from local-only vaults to cloud-synchronized services, with differing trust and exposure characteristics.
Additional secret storage
Many managers also store items such as TOTP seeds, recovery codes, secure notes, and passkey material, depending on the product and configuration.

Common questions

Answers to the questions practitioners most commonly ask about Password Manager.

Does a password manager replace multi-factor authentication?
No. A password manager stores and supplies knowledge-factor credentials (passwords); it does not by itself add a second factor. Even with strong, unique passwords, the account still relies on a single knowledge factor unless MFA is configured separately at the relying application or identity provider. Many password managers can store TOTP seeds and generate one-time codes, but placing the password and the second factor in the same vault can weaken the independence assumption behind MFA depending on your threat model and how the vault itself is protected.
Is a password manager the same thing as passwordless authentication or passkeys?
Not inherently. A traditional password manager automates the storage and entry of shared-secret passwords, which is still password-based authentication. Passwordless approaches such as FIDO2/WebAuthn use possession-based public-key credentials and do not rely on a shared secret transmitted to the server. Some password managers now also act as passkey providers, storing and syncing WebAuthn credentials, but that is a distinct capability from managing passwords, and whether a given product supports it depends on the vendor and configuration.
Should an enterprise use a standalone password manager or the credential management built into an SSO or IGA platform?
It depends on scope. SSO federation (for example via SAML 2.0 or OIDC) removes the need to manage separate passwords for integrated applications entirely, which is generally preferable where supported. A password manager typically remains useful for the long tail of applications that cannot be federated, for shared or service credentials, and for personal-to-work boundary cases. In most deployments these are complementary: federate what you can, and use a managed password vault for what you cannot, ideally with the vault itself accessed through SSO and MFA.
How should a password manager be integrated with existing IAM controls?
Common practice is to place the vault behind the organization's primary authentication, so that vault unlock is tied to enterprise SSO and MFA rather than an independent master password alone. Where the product supports it, user access to the vault can be provisioned and deprovisioned through directory integration or SCIM so that offboarding removes access consistently with other systems. Note that specific integration options, including provisioning and policy enforcement, vary by vendor and edition.
What are the key considerations for shared or team credentials in a password manager?
Shared credentials break the one-principal-per-account assumption, which complicates attribution and audit. Where shared entries are unavoidable, look for products that log which user accessed or revealed a credential, support access grouping consistent with your access control model (for example role-based grouping), and allow rotation after a team member departs. Treat highly privileged shared accounts as candidates for a dedicated privileged access management solution rather than a general-purpose password manager, depending on your requirements.
What should be evaluated about how a password manager protects the stored vault?
Key questions include how the vault is encrypted, whether encryption and decryption occur on the client so the provider cannot read stored secrets, and how the master secret or key is derived and recovered. Confirm that recovery mechanisms do not undermine the encryption model, and clarify what happens to access if the master credential is lost. The exact cryptographic design and recovery behavior differ by product, so verify these against vendor documentation rather than assuming a common standard.

Common misconceptions

A password manager authenticates you to websites and services.
A password manager stores and supplies credentials; the actual authentication is still performed by the target service, which verifies the submitted knowledge factor. The manager itself only authenticates you to its own vault. It does not replace or alter a service's authentication mechanism.
Using a password manager is equivalent to using MFA or passwordless authentication.
A password manager primarily manages a single knowledge factor and any secrets you store in it. Storing TOTP seeds alongside passwords can concentrate factors in one vault rather than keeping them independent. Passkeys or FIDO2/WebAuthn credentials are a distinct approach, and while some managers can store passkeys, doing so is not the same as the manager providing multi-factor or passwordless authentication on its own.
If the vault is encrypted, stored credentials are safe under all conditions.
Vault security depends on the strength of the master secret, the encryption implementation, and the storage and synchronization model. A weak master password, a compromised device, or configuration weaknesses can expose contents. Encryption at rest does not, by itself, guarantee protection in every deployment context.

Best practices

Protect the vault with a strong, unique master password, and where supported, add an independent second factor to unlock the manager rather than relying on a single knowledge factor.
Use the built-in generator to create long, random, unique credentials per service so that a breach of one service does not enable credential reuse elsewhere.
Understand the storage and synchronization model of your chosen product, and select local-only versus cloud-synchronized options based on your organization's trust and exposure requirements.
Rely on domain-based autofill matching rather than manual copy-paste where possible, since strict domain matching can reduce the risk of submitting credentials to look-alike phishing sites.
Evaluate whether to store TOTP seeds and passkey material in the same vault as passwords, weighing convenience against the risk of concentrating multiple secrets in one place.
Treat the password manager as a credential store, not as an authentication or access-control system, and enforce MFA, step-up authentication, and passwordless options at the services themselves according to their supported profiles.
Application Security Isn’t Optional Anymore.