Password Manager Tips

*This information is adapted from the National Cybersecurity Alliance

Did you know?

Vassar provides a free account with LastPass, a password manager, to all students, alumni, and employees. Visit this site to learn more about how to set up and use LastPass: CIS Password Management – LastPass

What Is a Password Manager?

A password manager is a piece of software that can generate, store, and provide your passwords for every account you log into. They can be apps you install, plugins on your browser, or even built-in to your browser and/or computer operating system.

What do they do?

At its core, a password manager is a hyper-secure vault that stores all your passwords. When creating a new password or logging in somewhere for the first time using the password manager, it will ask if you want to save that password. Once you approve, all you need to do to log into that site the next time is provide the password for your password manager, and it will fill in that account’s specific password. Password managers can also help you generate passwords that meet the requirements of a secure password (see the page on Passwords). You can also add passwords into the manager manually when you set it up, so it will be ready to use whenever you need it.

Why use one?

A password manager helps you keep track of all your passwords. Every day we create more and more online accounts, and if you are following good password protocol, each of these accounts should have a unique password. Password managers make this far more, well, manageable, so you don’t have to remember each of those passwords, or, even worse, write them down. It can be confusing, easy to make mistakes, and easy to accidentally reveal your passwords when they are physically written down somewhere. Plus, using a password manager, you only have to remember a single password, the one that lets you access the manager itself. This will save you time, allow you to access passwords across multiple devices, and protect your identity. Plus, many password managers will alert you of potentially risky sites and if a password has been compromised.

Are they actually secure?

Password managers take lots of steps to keep your information as secure as possible. Let’s take a look at a few of them.

Encryption
A good password manager encrypts all the passwords stored in them, whether they are stored locally or on a company server. This means that even if a hacker breached the password manager, they wouldn’t be able to decode what your passwords are. The only way to access the passwords is with the password manager’s own password that you set.

Multi-Factor Authentication
The best password managers will have you use multi-factor authentication to log in. This means that when you try to log in, especially from a new device, you will be asked not just for your password manager’s password, but also to verify in another way, such as through a code emailed to you, a biometric verification like a fingerprint scan, or verifying in a separate app. For more information on how this keeps your information safe, see the page on multi-factor authentication.

Zero Knowledge
This means that your password manager keeps no information on what your password actually is. The company will store only the encrypted version of your main password, meaning it cannot access the password itself, and you are the only one who knows it. Which means it should be extra secure!

How to Choose a Password Manager