Term
Password manager
An application that stores and generates passwords securely so that every account has a different strong password. In a company it lets staff share access without emailing passwords and revoke it when someone leaves.
Updated
What it means
A password manager is an application that securely stores login details for different services in an encrypted vault. The user remembers only one strong master password, and the manager creates and fills in unique, long, random passwords for every service.
The main benefit is that every service has a different password. When a password leaks from one service, the attacker cannot use it to log in elsewhere, which is today the most common way into company accounts. The manager also helps detect phishing, because it will not fill in a password on a fake domain.
Business versions of password managers let teams share access without emailing passwords, set rights by role and remove a departing employee’s access in a single step. They thus become part of access management.
How it works in practice
In our own firm we use a password manager for all access to client systems, banks and authorities. Shared access is divided by team and client, so everyone sees only what they need, and changes are recorded in an audit log.
We combine the password manager with two-factor authentication. A strong password alone is not enough if someone tricks a person into revealing it; the second factor blocks login even with a stolen password. The master password must always be protected by a second factor.
We help clients introduce one: choosing the tool, moving passwords out of spreadsheets and notes, setting up sharing and rules for leavers. The biggest gain is usually the end of passwords in files and on sticky notes on monitors.
What to watch out for
A forgotten master password with no way to recover it can mean losing access to all data. For business tools we therefore set up recovery through an administrator, and for personal vaults backup codes stored safely away from the computer.
A password manager does not protect against social engineering if a person reveals a password or code to an attacker. Even with a good tool, people need to understand that passwords and verification codes are never read out to anyone.
Need the term explained on your own situation? Consulting from €55 / hour excl. VAT, depending on topic and complexity.