Password Manager

A password manager is software that generates, stores and fills in a distinct, strong password for every account, keeping them in an encrypted vault opened with one primary secret or a device authenticator. NIST SP 800-63B-4 (section 3.1.1.2) says verifiers "SHALL allow the use of password managers and autofill functionality" and should permit pasting into password fields.

NIST's reason is that password managers make users more likely to choose stronger passwords, and a unique password per site is what breaks credential stuffing, which depends on reuse. The trade-off is concentration: one vault now holds every credential, and many managers now also store passkeys and TOTP seeds, so the vault's primary secret and the endpoint it runs on become the real security boundary. In August 2026 Unit 42 showed malware on a Windows machine could pull synced passkey keys out of Google Password Manager in Chrome's memory, and the EU Cyber Resilience Act lists password managers among its "important products", which face stricter conformity assessment. NIST's SP 800-63-4 implementation hub includes an FAQ on password managers for agencies deciding what to recommend.

See also: top open-source password managers, best password managers for business, best password managers for personal use, password management vendors, credential stuffing