Active incident or hacked WordPress? Ransomware Hacked WordPress 423-888-0252 · 828-484-1257
Diversified Tech Solutions Diversified Tech Solutions Technology · Security · Compliance

What Is a Password Manager?

Definition

A password manager is an application that creates, stores, and fills in passwords for you. It keeps every login in an encrypted vault unlocked by one strong master password, ideally plus multi-factor authentication, so each account can have a long, random, unique password that nobody has to remember or reuse.

How It Works

The vault is encrypted on your device with a key derived from the master password, then synced between your computer and phone. When you visit a site, the manager matches the saved login to that web address and fills it in. That matching is also a quiet phishing defense: a password manager will not offer your bank login on a look-alike domain.

Business editions add the parts an office needs:

  • Shared folders so a team can use one vendor login without passing it around in email or chat.
  • Admin policies for master password strength, MFA, and where vaults can be exported.
  • Offboarding controls so a departing employee loses access to shared credentials the same day.
  • Breach and reuse reports that flag weak, repeated, or exposed passwords.

NIST's current digital identity guidance, SP 800-63B-4, says verifiers "SHALL allow the use of password managers and autofill functionality," and notes that password managers "have been shown to increase the likelihood that subscribers will choose stronger passwords." CISA's advice is just as direct: "Create long, random, unique passwords with a password manager."

A password manager concentrates risk in one place, so the master password and the vault account need the strongest protection you have. NIST lists "a vulnerability in an insufficiently secure password manager" among the threats to consider.

Real-World Example

In December 2022, LastPass disclosed that an attacker had copied a backup of customer vault data. Website addresses in the vaults were not encrypted, but usernames, passwords, secure notes, and form data were encrypted with AES-256 using a key derived from each customer's master password, which LastPass does not store. LastPass warned that the attacker might try to brute force master passwords offline, and urged customers with weak master passwords to change their stored passwords. A March 2023 update said the attacker had reached the backup by targeting a senior DevOps engineer through vulnerable third-party software, using information stolen in an earlier August 2022 incident to pick its target.

Why It Matters for a Small Business

Without a manager, small teams reuse passwords, keep them in spreadsheets, or share one login across five people. That is how a single stolen password becomes credential stuffing across email, banking, and payroll. A business password manager fixes reuse, makes offboarding fast, and gives the owner a record of who can reach which account. The LastPass case also shows the trade-off: the vault is only as strong as the master password and the vendor's own security, so choose carefully and use MFA on the vault.

How to Spot It / How DTS Handles It

Warning signs: passwords stored in spreadsheets or browser notes, shared logins sent by email, the same password on several accounts, and no way to cut off a leaver's access to shared vendor accounts.

DTS can help with choosing and setting up a business password manager: vault policies and MFA, moving shared logins into controlled folders, and removing vault access when someone leaves. See our managed IT service, or our Microsoft 365 security service for the accounts the vault protects.

Related Terms

  • Multi-factor authentication (MFA): the second lock on the vault itself.
  • Credential stuffing: the attack that unique passwords defeat.
  • Password spraying: guessing common passwords across many accounts.
  • Brute force attack: the offline risk to weak master passwords.
  • Passkeys: a passwordless login many managers can store.
  • Offboarding and access review: removing shared credentials when people leave.
  • Password policy (NIST SP 800-63B): the rules a manager makes easy to follow.

Sources

  • NIST, SP 800-63B-4: Digital Identity Guidelines, Authentication and Authenticator Management (2025): https://pages.nist.gov/800-63-4/sp800-63b.html
  • CISA, Use Strong Passwords (Secure Our World; page marked archived): https://www.cisa.gov/secure-our-world/use-strong-passwords
  • LastPass, Notice of Recent Security Incident (December 22, 2022): https://blog.lastpass.com/posts/notice-of-recent-security-incident
  • LastPass, Security Incident Update and Recommended Actions (March 1, 2023): https://blog.lastpass.com/posts/security-incident-update-recommended-actions

Last updated October 14, 2026.