A Password Manager: Why One Password for Every Site, Passwords in the Browser and Notes in a Notebook Lead to Hacked Email and Social Media, How a Password Manager Works and How to Switch Without Risking Losing Everything

Email, banking, government services, social media, messengers, shops, food delivery, the cloud, work systems — the average user has more than fifty accounts. Remembering a long, unique password for each is impossible, so almost everyone does the same thing: uses one or two passwords everywhere with small variations, trusts them to the browser or writes them in a notebook. That works until one of the sites suffers a database leak. Attackers take the email-and-password pair from it and automatically try it on hundreds of other services. Within hours, the email, social media and sometimes access to money are taken over. Let's look at how a password manager protects against this scenario.

Why one password everywhere is the main weakness

Major leaks happen constantly, and billions of username-password pairs are publicly available. Even if your password is complex, if it's used on several sites, a leak from the weakest of them opens access to all the others. This is called credential stuffing, and it's one of the most widespread causes of hacked accounts. The only reliable defence is a unique password for every service.

Passwords in the browser and on paper

The browser's built-in password saving is better than one password everywhere, but it has weak spots. There's info-stealing malware designed specifically to extract passwords and session files saved in the browser and send them to attackers. If the computer is shared or not password-protected, anyone who sits down at it can view the saved passwords. A paper notebook is safe from hackers but not from theft, loss or prying eyes in the office — and it isn't to hand when you need to sign in from your phone on the move.

How a password manager works

A password manager is a program or service that keeps all your passwords in an encrypted vault. The vault is opened with a single master password that only you know. The manager generates a long random password for each site, fills it in for you when you sign in, syncs the vault between your computer and phone, and warns you if any of your passwords has appeared in a known leak or is reused. Good managers encrypt the data on your device, so even the service itself can't read it.

The master password — the only thing to remember

The master password should be long and unique — a phrase of several unrelated words works well. It must not be used anywhere else. It's important to understand that if the master password is forgotten and no backup recovery method is set up, nobody can open the vault. So when setting up, prepare a fallback straight away: a printed emergency kit, a trusted contact for emergency access, or a recovery key kept somewhere safe.

Family and team

Password managers let you share individual passwords or folders: for example, the home Wi-Fi and streaming service passwords for the whole family, or work service passwords for a department. In a company it's especially convenient: when an employee leaves, you simply revoke their access to shared passwords rather than changing everything while trying to remember what they knew.

How to switch without risk

• Choose a manager with a good reputation and on-device encryption.
• Create a strong master password and set up a recovery method straight away.
• Import the passwords saved in your browser, then turn off browser saving and delete the old entries.
• Start with the most important accounts — email, bank, cloud — and change their passwords to unique ones.
• Turn on two-factor authentication for the manager itself and for important accounts.
• Gradually update the remaining passwords as you sign in to sites.

What our technician does

1. Helps choose a password manager for you, your family or your company.
2. Installs it on computers and phones and sets up sync and autofill.
3. Moves passwords out of browsers and checks them for reuse and known leaks.
4. Sets up emergency access and two-factor authentication.
5. For companies, organises shared folders by department and a procedure for revoking access.

A real example

A family from Vake got in touch after emails asking to borrow money started going out from the father's address, and then his social media account was hacked. A check showed he'd used the same password on eight sites, one of which had suffered a leak several years earlier. We restored access to his email and social media, checked the computer for malware, installed a family password manager on every device, replaced the passwords with unique ones, enabled two-factor authentication for email and banking, and printed an emergency kit that's kept somewhere safe at home.

A common question is how safe it is to keep every password in one place. The risk is indeed concentrated, but a well-protected vault with a long master password and two-factor authentication is incomparably more secure than one password on fifty sites. Even if the service's servers were breached, attackers would get only encrypted data that's useless without the master password. The key is never to use the master password anywhere else or type it into suspicious pages.

Call a technician

If you want to sort out your passwords, or an account has already been hacked, we'll help in any district of Tbilisi around the clock. Learn more on our computer setup, virus removal and software installation pages.