# What is a password manager?

> Software that creates, stores or regenerates a distinct strong password for every account you hold.

Last reviewed: 2026-09-01

## Password manager

Category: Passwords

Canonical page: https://moolkey.com/glossary/password-manager

A password manager gives every account its own strong password so that one breach cannot cascade into ten. Most store passwords in an encrypted vault; some recompute them on demand from a master key. Either way, the goal is the same: remove the human habit of reusing one memorable password everywhere.

### Why reuse is the problem worth solving

Credential-stuffing attacks take email-and-password pairs from one breach and replay them against other services. Reuse is what turns a leak at a forum you forgot about into a compromised email account. Your email account can then reset everything else.

### The two architectures

Vaulted managers (1Password, Bitwarden, Dashlane, Keeper) encrypt and sync stored credentials. Deterministic managers (MoolKey, LessPass, Spectre) recompute generated credentials from a Master Key instead of storing a generated credential list. Vaults offer autofill and recovery; deterministic tools trade those conveniences for a smaller stored-secret surface.

Further reading: [How password managers work, in depth](https://moolkey.com/blog/how-do-password-managers-work)

### Sources

- [OWASP: Credential Stuffing Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Credential_Stuffing_Prevention_Cheat_Sheet.html): How password reuse is replayed at scale and how services can limit the damage.
- [NIST: SP 800-63B-4: Authentication and authenticator management](https://csrc.nist.gov/pubs/sp/800/63/b/4/final): Current requirements for passwords, authenticators, recovery, and rate limits.
- [NIST: Computer Security Resource Center glossary](https://csrc.nist.gov/glossary): Canonical terminology used across US computer security guidance.