Password Manager

Password managers are programs that help to implement the requirements for secure passwords: to use a unique, complex, multi-digit password for each user account, which consists of letters, numbers and special characters. As the name suggests, password manager programs take over the management of these unique passwords. Users then only have to remember a single complex password – that of the password manager.

What does password manager mean in detail?

On the subject of passwords in general:

• Your password security is essential for the security of your data, accounts, and cybersecurity. Anyone who knows your relevant passwords can make purchases at your expense, steal your data and misuse your computer for criminal purposes, among other things.
• Why unique passwords are so important: Time and again, data is stolen from providers such as online shops through cyberattacks. Records of login data are particularly sought after. This is because they reveal which passwords belong to which usernames or e-mail addresses. This allows cybercriminals to log into the respective user accounts. Through credential stuffing , cybercriminals can also quickly and automatically check whether they can also gain access to user accounts with other providers with the same combination. If you use a different password for each user account, you will prevent this approach from succeeding.

Why complex passwords are so important:

The longer and more complex a password is, the longer it takes statistically to calculate it. In many cybercriminal attacks, time is of the essence – the time it takes for their attack to be noticed and mitigated. The longer it takes to randomly calculate your password, the more likely the cybercriminals are to have to cancel their attack before calculating it.

On the subject of password managers:

• The password manager program stores all user names and passwords. You don’t have to remember them anymore. If you want to log in to a provider, all you need is your password manager’s master password.
• Be very careful to choose a highly secure master password. At best, it should have at least twelve digits, upper and lower case letters, numbers and special characters.
• Good password managers offer two-factor authentication. If possible, use them to further increase your security, especially for sensitive user accounts.
• Many good password managers offer helpful additional functions. They help, for example, to prevent duplication of stored passwords and support you in creating secure passwords. Some check whether your data is on leaked lists of stolen login data, i.e. whether it needs to be changed.

There are different types of password managers. Two important differences:

1. There are standalone password manager programs and password managers that are included in another program, such as the browser. Assessment: Since browsers are complex programs, even the best ones contain many potential security vulnerabilities. This exposes your passwords to a relatively higher risk. It is considered safer to use a good, standalone password manager program.
2. There are password managers that store your passwords on your computer. Others store them on the program provider’s servers or in a cloud. This allows the password manager to be used with several different devices of the same user. Assessment: Basically, a responsibly protected computer offers less attack surface compared to third-party servers or a cloud, so it is considered more secure. However, if a user uses multiple devices, it’s still safer to use the same good password manager with externally stored data for all of them than the same passwords for multiple accounts. The decisive factor is the security of the consistently usable solution, not the security of the ideal solution, which does not prove itself in everyday life and ultimately leads to risky behavior.

Where do I encounter the topic of password managers in my everyday work?

Every time you create an (online) user account with a password backup. Every time you log in that requires you to enter a password.

What can I do to improve my security?

• Use a good informed password manager. Get a reliable program recommended by your IT department or an IT security service provider like Perseus.
• Choose a highly secure master password for your password manager. If possible, use two-factor authentication, at least for sensitive accounts.
• Provide devices that use a password manager with a strong password or PIN.
• If you use a password manager that stores your passwords externally, check the location of that storage and the privacy policy of the program provider. If necessary, consult your IT department or an external IT security service provider such as Perseus. Basically, if you are unsure, choose another program.

Learn more

• The technical article of the German Federal Office for Information Security (BSI) on the subject of password managers