Password Managers: What They Solve, When Free Online Tools Fail
A password manager is the one piece of security software that almost every expert agrees is worth using. It will not make you immune to breaches, but it removes the two habits that cause most harm: reusing passwords across sites and storing them in easy-to-read places. For many people, a reputable manager is safer than doing nothing; for others, the wrong one is simply another cloud account they do not control.
This guide covers what a manager protects you from, how a vault breach differs from a plaintext leak, and why the master password is both the strongest and weakest link. We also explain when a free online tool is the wrong place for credentials, and when a spreadsheet, native app, or professional is the safer bet. Siteb.biz is an independent directory of browser tools, not a vendor; this is guidance, not a recommendation.
What a password manager actually stops#
The main protection is not against the vault provider being hacked; it is against the everyday attacks that work because people reuse passwords or choose weak ones. When every account has a unique, random password, a breach at one service cannot be used to log in to another. A manager also fills credentials only on the site they belong to, which makes some phishing attacks harder, and it removes the temptation to keep passwords in email drafts, spreadsheets, or notes on a phone.
- Credential stuffing: attackers take a leaked password from one site and try it on dozens of others.
- Weak or predictable passwords: the manager generates strings you would never memorise.
- Phishing by lookalike domains: most managers refuse to fill credentials on the wrong site.
- Passwords stored in plain sight: email drafts, spreadsheets, and sticky notes.
- Device loss: your vault can be restored on a new phone or laptop, provided you know the master password.
Encrypted vaults vs plaintext leaks#
Not all breaches are equal. If a service stores your password as plaintext, anyone who steals the database can read it immediately. If it stores only a hashed password, the attacker must crack it, and a strong unique password usually survives. A password manager adds another layer: your vault is encrypted on your device before it leaves, so the provider typically holds only ciphertext. Even if that ciphertext is stolen, an attacker still needs your master password to unlock it. That is a meaningful difference, but it is not invulnerability.
| Scenario | What the attacker gets | What stops them |
|---|---|---|
| Plaintext leak | Your actual password, readable immediately | Nothing; change the password at once |
| Hashed password leak | A scrambled hash that must be cracked | A long random password and slow hashing |
| Encrypted vault theft | Ciphertext without the decryption key | Your master password and the key derivation settings |
| Master password guessed | Full access to the decrypted vault | Length, randomness, and not reusing it elsewhere |
Some managers have been criticised for weak default iteration counts; check the security settings if you are concerned.
The master password problem#
The strongest encryption in the world becomes useless if your master password is short, personal, or reused. Because the vault provider does not know this password, they cannot reset it for you. That is the point: you alone hold the key. It also means that if you forget it, the data is gone. The best master passwords are long passphrases—five or six random words, or a long string of characters you can type reliably. For this job, the right free online tool is a passphrase generator that runs entirely in your browser; anything that sends candidate passwords to a server is learning your future master password.
- Use at least 16 characters; 20 or more is better if you can type it consistently.
- Do not reuse your master password anywhere else, not even as a security answer.
- Avoid names, birthdays, pet names, and favourite quotes that appear online.
- Generate it with a browser-based passphrase tool that does not upload the result.
- Practise typing it for several days before you rely on it; muscle memory matters.
The recovery plan you should write down before you need it#
Most people only think about recovery after they are locked out. Write the plan down on paper before that happens. Store the paper somewhere safe: a locked drawer, a safe, or with a trusted person, depending on your threat model. Do not keep the only copy next to the computer. The sheet should not include your master password unless you have decided, consciously, that the risk of forgetting it outweighs the risk of someone else finding it. For most people, a strong hint is enough.
| Item to record | Why it matters | Where to keep it |
|---|---|---|
| Vault provider name and login email | You cannot recover what you cannot find | Paper and a secondary email account |
| Two-factor authentication method | Losing the authenticator can lock you out | Backup codes in a sealed envelope |
| Emergency contact or inheritance contact | If you are incapacitated, someone must access accounts | With your will or a trusted relative |
| Master password hint | Jogs your memory without revealing the phrase | On paper, separate from the device |
| Recovery key or export file | Lets you move to another manager or restore access | Encrypted USB drive or safe deposit box |
A paper record is not old-fashioned; it is offline, durable, and harder to steal remotely than a cloud note.
When a password manager is the wrong choice#
There are situations where a manager adds friction without adding safety. If you cannot remember a strong master password and have no secure place to store a hint, you will eventually lock yourself out. If you need family members to access accounts when you cannot, a shared spreadsheet in a secure location may be more practical—though less secure in other ways. Regulated businesses sometimes need audit trails and centralised control that consumer managers do not provide. In those cases, a free online tool is the wrong place for your vault; the right answer may be an enterprise product, a native OS keychain, or a professional.
- You have no recovery plan and no trusted contact to hold a backup.
- You share credentials with family members who will not use the same app.
- Your employer or regulator requires logging, escrow, or centralised administration.
- You need access on devices that cannot run the manager or its sync service.
- You are unable to memorise or reliably type a long master password.
Choosing among the four common types#
Consumer password tools fall into four categories, and the best one depends on how much control you want and how much you are willing to spend. Browser-built-in managers are convenient but tied to one ecosystem. OS keychains are better integrated and encrypted, but still limited. Cloud managers sync across devices and add sharing, at the cost of trusting a third party. Self-hosted options give you full control, yet they also give you full responsibility for backups and updates.
| Type | Typical cost | Trade-off |
|---|---|---|
| Browser built-in | €0 | Convenient, but tied to one browser account and harder to export |
| OS keychain | €0 (included with the device) | Tightly integrated, yet limited sharing and recovery options |
| Cloud password manager | €0–€60/year (free tier vs paid features) | Cross-device sync and sharing, but you trust the provider's security |
| Self-hosted vault | €0–€200/year (hardware, hosting, and your time) | Full control, but you are solely responsible for backups and updates |
This is general guidance, not legal, financial, or regulated security advice; consult a professional if you handle sensitive organisational data.
A short setup checklist#
- Choose the type of vault that matches your recovery needs and budget.
- Generate a long master passphrase using a browser-based tool that runs locally.
- Enable two-factor authentication on the vault account and save backup codes.
- Add a few low-risk accounts first, then gradually migrate the rest.
- Write down the recovery sheet and store it offline before deleting old password lists.
Do not treat setup as a one-off event; review your recovery kit at least once a year.
Frequently asked questions
Can the password manager company see my passwords?
In a well-designed service, the answer is no. The provider stores only encrypted data and never receives your master password in a usable form; decryption happens on your own device. This is often called zero-knowledge architecture. It is not magic, though. You are still trusting that the code, the update mechanism, and the cryptography are implemented correctly. A dishonest or compromised provider could, in theory, serve a malicious update that captures your master password when you type it. That is why many people prefer open-source managers or those that have been independently audited, and why you should keep the app updated.
What should I do if my password manager reports a breach?
First, find out whether the stolen data was encrypted vault files or plaintext account information. If only ciphertext was taken, change your master password as a precaution and review your two-factor authentication settings; the old vault files will remain protected by the previous master password unless it was weak. If plaintext data such as email addresses or URLs was exposed, watch for targeted phishing and consider rotating the most sensitive account passwords. If you had reused your master password anywhere else, change those copies immediately, because that reuse is now the real danger.
Is a free online password generator safe to use?
It depends on what it does with the data. A generator that runs entirely in your browser and never uploads the result can be perfectly safe for creating one-off passwords. The risk appears when a tool sends your generated password to a server, stores it in analytics, or runs on a site you do not trust. For everyday passwords, a local browser-based generator is reasonable. For your master password, use a dedicated passphrase generator that also stays local, and never paste the result into an online form just to test it. When in doubt, generate passwords offline.
free online toolspassword manager pros and consencrypted vault breach explainedhow to choose a master passwordpassword manager recovery planpassphrase generator vs password generator
