What is a password manager?

Password manager: definition and purpose

Employees quickly accumulate dozens of logins: email, cloud, shop back end, supplier portals, social media. Anyone who has to remember them all picks simple or reused passwords. A password manager solves this: it creates a separate, long random password for every service, stores it encrypted and fills it in when needed.

The vault is protected by a master password and ideally by a second factor. Modern solutions also store one-time codes, notes, credit cards or passkeys. There are browser functions, standalone programs and team solutions; they differ mainly in administration, sharing and traceability.

How a password manager works

Reputable providers encrypt the vault on the user’s device before it is synchronized (zero-knowledge principle); the provider cannot read the contents. At sign-in, the extension fills in the data only on the matching address. That also protects against phishing, because nothing is filled in on a fake page. Solutions are available as a cloud service or for self-hosting; well-known examples are Bitwarden, 1Password and KeePassXC.

• Password generator for long, unique passwords
• Autofill only on the genuine address
• Shared vaults for teams with permission management
• Warnings for weak, duplicate or leaked passwords
• Emergency access and recovery for administrators

Real-world example: shared logins at an electrical contractor

At an electrical contractor with 20 employees, the logins for domain, hosting, Google Business Profile, wholesale portal and social media sit on a slip of paper in the office and in an Excel file. When someone leaves the company, nobody changes the passwords, and several services share the same password.

With a team password manager, everyone gets access only to the vaults they need. Shared logins are traceable, renewed after an employee leaves and secured with two-factor sign-in. The Excel list disappears, and the owner keeps the overview.

Benefits, limits and imple­menta­tion

The risk of a central vault can be managed: a long master password as a passphrase, a second factor, a recovery path for emergencies and a provider with a transparent security architecture. Current recommendations, for example from the BSI and NIST, favor long passphrases and advise against forced changes without cause. Password manager providers have also been attacked before; what matters is that vaults are end-to-end encrypted.

Nano Concepts selects a suitable solution, sets up team vaults and permissions, introduces employees to using it and connects the password manager with two-factor authentication and processes for when employees leave. That turns a good intention into a procedure that is actually used in daily work.

• The master password is reused or too short
• No second factor for the vault
• Shared logins are sent via chat or email
• Passwords remain unchanged when employees leave
• Browser storage used on private, unsecured devices