One of the biggest ways threat actors are breaking into customers’ accounts these days is by compromising passwords. Threat actors can easily steal passwords by sending your workers to a fraudulent login page, often by having them click a link in an email. Users trust the screen because it looks identical to the one they always use, so it makes sense to them to enter their username and password and complete two-factor authentication if required.
So it’s essential to look for ways to help users protect themselves. One of the best ways is to use phishing-resistant technology, such as passkeys, because users don’t type a password at all, so they can’t accidentally give it to a threat actor.
Spotting a Fake Login Screen
But because not all websites accept passkeys yet, password managers offer another benefit that not everyone thinks about. A password manager helps you identify fraudulent login screens because it won’t fill in the password.
A password manager associates passwords with specific websites. That means if a threat actor tries to trick you or your users into logging into a fake login screen, the password manager won’t offer to fill in the password when you get to that fake login screen because the web address doesn’t match the one it saved.
If you use a password manager and you ever see a login screen where the password manager does not automatically fill in the password, that is a major red flag. Train your users to be on the lookout too. The login screen may be fraudulent.
If you type in a website address you know is legitimate and your password still doesn’t fill in, that is unusual, so contact your IT professional to alert them. They’re even better trained to spot tricksters than most of us.
Overcoming Bad Password Habits
Another benefit of a password manager is that it makes it easier to overcome bad password habits. For one thing, a password manager makes it much easier to use a different password at every website, because users no longer need to remember separate passwords. The password manager takes care of that. All of us may have used the same password on more than one website at some point in our lifetime. Using unique passwords everywhere is much more secure, and a password manager makes it easy.
A way to make passwords more secure is to make them longer. So, when the website allows enough length, using a phrase or sentence with spaces is one of the best kinds of passwords. Some people explain that a 20-character passphrase is more secure than a 10-character password that uses uppercase and lowercase letters, numbers, and symbols. And because the password manager remembers it for you, you can use long passwords everywhere. If you prefer, password managers can generate and remember long passwords full of uppercase and lowercase letters, numbers, and symbols for you.
Keyloggers
Password managers can also help defeat programs called keyloggers. Threat actors love to install a program on your computer if they can. A keylogger is a type of malware that tracks every key you press. There are even hardware keylogger devices that people could plug in, for example, between your keyboard and your computer. Once threat actors know what you type, it’s not that difficult to figure out which keystrokes were passwords or passphrases. But if you’re using a password manager, it is filling in your passwords for you, and you’re not typing your website passwords except for the very first time. You’ll ruin the hacker’s day.
If a Password Manager Company Gets Hacked
One of the first worries that comes to anyone’s mind is that a hacker could break into the company that makes the password manager and find out the passwords of everybody who uses it.
To help prevent attackers from stealing passwords, use a zero-knowledge password manager. That means the password management tool is designed so the company that provides it cannot decrypt your passwords. They have zero knowledge of any of their customers’ passwords. This is all handled through cryptography. Even with quantum computing potentially coming soon, it’s unlikely that a threat actor could get everybody’s password, especially if the password management company has upgraded to quantum-resistant cryptography.
Two-Step Login and Your Master Password
Don’t think that password managers replace two-step login. You still need two-step login, so even if a threat actor gets your password, they can’t just log in as you unless they can get you to participate in two-step login somehow. So two-step logins are still important, especially until all of your sites support passkeys.
Always use a very strong master password for your password manager. This is where a long sentence comes in handy, because it’s more difficult for threat actors to crack long passphrases than short ones. And a sentence is much easier to remember than a bunch of symbols and numbers and letters, no matter what case they are. Many password managers accept very long master passwords. Use sentences you can remember and make them long. Maybe a sentence you made up yourself, one nobody else would ever say, would do nicely.
Which Password Manager to Use
People commonly ask me during presentations what password manager they should use. My answer is to ask their IT professionals to recommend one, because they probably have a preference, and they’ll be the ones supporting the password manager if it ever has a bug. So let them choose.
Sometimes people insist on knowing. So, as of November 7, 2026, this is a list of some of the password managers that score high in reviews, and many of our customers use some of these:
- 1Password Business
- Bitwarden Enterprise
- Dashlane Business
- Keeper Enterprise
- NordPass Enterprise
- Proton Pass Professional
- RoboForm for Business
If you don’t see your favorite password manager on the list, that’s okay. I encourage you to check with the company to make sure it’s a zero-knowledge password manager. In fact, you might want to check the ones on this list to confirm they are zero-knowledge password managers, because they may have changed since this article was written.
For Your IT Professionals
And this paragraph is for your IT professionals, in case they want to go deeper when researching them. They can ask the password management companies on their short list whether they use quantum-ready encryption, such as AES-256 or ChaCha20, to encrypt local and cloud vault files. These encryption algorithms are expected to successfully resist quantum attacks for years to come. To go a step further, they can ask whether they derive keys from your master password using Argon2id or an appropriately configured PBKDF2. Then ask whether their apps and services use TLS 1.3 with post-quantum hybrid key exchange, such as an ML-KEM-based method. They can also ask whether the feature for sharing passwords between users is moving to post-quantum methods. Not all password managers meet these criteria, but many are transitioning to them or similar technologies.
Password Managers at Home
If you decide to get a password manager for your family, your parents, or loved ones, the companies in the list offer personal solutions too. You will find them when you go to their websites.
Sometimes password managers, especially the ones for home use, come bundled with other products such as VPNs. Some people find that when they get a password manager, they are better off using only the password management features and skipping the rest. Just because you have something doesn’t mean you need to install it. Extra programs are one more thing that can break.
Please tell your friends so they can learn this very important benefit of a password manager. It can help them realize when they’re on a fraudulent login site, because the password manager will not automatically offer to fill in the password.
About
For the executive who would welcome another trusted person walking alongside them. For the IT professional who accomplishes more than anyone realizes. For the organization that knows the threats are real and wants to face them with clarity. For the families and people who want to live in a safer world. The Foster Institute is built around those people, and the book The Secure CEO is for them, as are the more than 1,500 keynotes and consulting engagements throughout North America. The goal has stayed the same: give leaders confidence, help IT professionals excel, and turn moving targets into plain next steps.
Mike Foster, CISSP and CISA | 805-637-7039 | mike@fosterinstitute.com | www.fosterinstitute.com
Disclaimer: The Foster Institute does not resell or endorse any password manager, and does not recommend or advise against any product, tool, or vendor named in this article. We receive zero compensation in any way for mentioning them. The list above includes only some of the password managers available.