Password Manager
Also called: password vault, credential manager, password keeper, 密码保险库
Definition. A password manager is an app that generates strong, unique passwords and stores them in an encrypted vault. You unlock the vault with one master password or biometrics, and it fills in logins for you across devices.
Stanislav Vovchyk · Updated Nov 5, 2026 · 5 tools have it
In short
- A password manager encrypts your logins on your device and unlocks them with one master password, so every account can have a unique random password.
- Zero-knowledge encryption means the provider cannot read your vault, but it also cannot recover a forgotten master password.
- A VPN and a password manager protect different things; bundled managers are a pricing convenience, so check features and export options.
A password manager stores your logins, and often card details, notes and passkeys, in an encrypted vault. You remember one master password, and the app creates a different random password for every site and fills it in when you log in. Some are standalone products. Others come bundled in VPN and security suites, usually on higher-priced tiers.
How it works
When you create an account, the app derives an encryption key from your master password using a slow key derivation function such as Argon2 or PBKDF2. The vault is encrypted on your device, usually with AES-256 or XChaCha20, before it is synced to the provider's servers. In a zero-knowledge design the provider only stores encrypted data and never sees your master password, so it cannot read your vault or reset the master password for you.
On your devices, browser extensions and mobile apps unlock the vault with the master password, a PIN or biometrics. Autofill matches the saved entry to the domain you are on. This also helps against phishing: a fake site on a lookalike domain does not get an autofill suggestion.
Why it matters
Most account takeovers start with reused or weak passwords. When one site leaks its database, attackers try the same email and password combination on other sites (credential stuffing). A unique random password for each account limits the damage of any leak to that one account.
A password manager also makes good habits practical. Nobody can remember 100 random 20 character passwords, but an app can. Common extras include:
- Password generator with length and character rules
- Passkey storage, so you can sign in without a password on sites that support it
- TOTP codes for two-factor authentication
- Password health reports flagging weak, reused or leaked passwords
- Breach monitoring for your email addresses
- Secure sharing with family or team members, and emergency access
Standalone vs bundled with a VPN
| Standalone manager | Bundled in a VPN or security suite | |
|---|---|---|
| Typical cost | Free tier or about $1 to $5 per month | Included in higher VPN tiers |
| Feature depth | Usually fuller: sharing, business admin, audits | Often core features only, sometimes fewer platforms |
| Cancelling | Independent of other services | Losing the VPN plan can mean losing the manager, so export first |
A VPN and a password manager protect different things. The VPN encrypts traffic between your device and the VPN server and hides your IP address. The password manager protects the credentials themselves. One does not replace the other, and a bundle is mainly a pricing convenience.
Limits and risks
- Master password is the key to everything. If it is weak or phished, the vault is exposed. Use a long passphrase and turn on two-factor authentication for the account.
- Forgotten master password. With zero-knowledge encryption the provider cannot recover it. Set up a recovery kit, recovery code or emergency contact if offered.
- Provider breaches. Encrypted vaults have been stolen from providers in the past, as in the 2022 LastPass incident. The data stays safe only as long as the master password resists offline guessing, and unencrypted fields such as site URLs may leak.
- Malware on your device. A keylogger or infostealer on an unlocked device can capture the master password or vault contents. A password manager does not replace device security.
- Lock-in. Check that you can export everything, including passkeys, in a usable format.
What to check when comparing tools
- Zero-knowledge, end-to-end encryption, and which key derivation function and settings are used
- Independent security audits, and whether client code is open source
- Supported platforms and browsers, including Linux and Safari if you need them
- Passkey support, TOTP storage and autofill reliability
- Two-factor options for the vault itself, including hardware security keys
- Sharing, family plans and business admin controls
- Import from your current browser or manager, and full export
- For bundled offers: which plan includes it, device limits, and what happens to your data if you downgrade
Tools that have it
From the directory, based on each tool's own feature list. Check the plan: some offer it only on paid tiers or certain apps.
- N
NordVPNNordPass included on Plus and higher plans · From $2.99/mo - P
PureVPNBundled password manager in subscription · From $1.69/mo - P
Proton VPNProton Pass bundled in Proton Unlimited plan · Free, from $3.49/mo - S
SurfsharkAlternative ID masked emails, no full vault · Paid - E
ExpressVPNExpressVPN Keys password manager bundled with plans · Paid
FAQ
Is it safe to store all passwords in one place?
With a reputable zero-knowledge manager and a strong master password plus two-factor authentication, it is far safer than reusing passwords. The main risks are a weak or phished master password and malware on your device.
What happens if I forget my master password?
In a zero-knowledge design the provider cannot reset it or decrypt your vault. You need a recovery code, recovery kit, emergency contact or biometric unlock set up in advance, otherwise the data is lost.
Is a browser's built-in password manager enough?
Built-in managers in Chrome, Safari or Firefox now offer generation, sync and passkeys, and are much better than reusing passwords. Dedicated managers usually add cross-browser support, secure sharing, TOTP storage, audits and easier export.
Does a VPN with a password manager replace a standalone one?
It can, if the bundled app covers your platforms and features. Check which plan includes it and export your vault before cancelling, because the manager often stops working when the VPN subscription ends.