User:KrzysztofPoplawski/sandbox/Password Manager

Password manager is a class of software that allows users to store and manage their passwords : with a password manager, there's no requirement to remember strong, unique passwords for all your accounts - those applications can stores them for you, helps you generate new, random ones and autofill login forms.

Usually this class apps protect access by one password called master password. Your master password is used to encrypt the contents of your password vault, so you should make it difficult for anyone else to guess it. However, it can't be so random you can't remember it. Your master password is likely unrecoverable if you do. Some password managers, eliminate the need for a master password by offering a passwordless entry to your desktop vault.

Most people use a password manager primarily to manage website credentials. In practice, when you log in to a secure site, the password manager offers to save your credentials. When you return to that site, it offers to fill in those credentials. If you've saved multiple logins for the same site, the password manager lists all those options.

to store passwords and/or other secure information like payment details and autofill login or other forms with this informations.

Dedicated password managers have existed since the mid to late 1990s. Web Confidential was probably one of the first programs to facilitate password management, when it first surfaced in 1998. All major browsers added this feature in the early 2000s.

Distribution
Password manager can be delivered as a one of or mixed of: computer application, mobile application, web browser extension, web based service, portable software for USB units.

password managers work on multiple devices and also come with browser extensions.

Password managers commonly reside on the user's device: computer or mobile device as a locally installed application or/and as a browser extension.

Local Installation

WebBrowser
All major browsers added this feature in the early 2000s.

Licencing
Application developed as part of business are available usually as a paid software on proprietary license often with limited functionality freemium version. With the beginning age of cloud software many password managers are available in subscription annual plan with many optons: single, family, enterprise and sometimes lifetime.

There are plenty of app from this class developed as open source software distributed with some free license like MPL-2.0, GPL-2.0-or-later, MIT granted no-cost use.

Storage
Cloud, Online, Offline / Locally

Cloud-sync

Git

Cloud Based The main difference between cloud and local management is that, with cloud management, the user data is encrypted and then stored on the provider’s servers. While with local management, user data is stored on the user’s device. Both storage options have their own perks.

Cloud storage saves your device space. Additionally, this is a really secure way to protect your data if you trust the provider since they usually have the means to ensure that their servers are really secure. Additionally, it’s practically impossible to hack the provider’s servers, and even if that happened – it would be impossible to decrypt your data.

More so, the password managers will not store your master password on their servers. So, there’s no issue of possible leaks. Also, zero-knowledge architecture is quite popular, meaning that everything gets encrypted on the user's device, and only then does it go to the provider’s servers.

On the other hand, local management is not the most optimal option if you want to access your passwords from more than one device. Additionally, the threats come if you were to lose your device with all your passwords. Since there’s no backup, the passwords very well may be gone for good.

Some password manager providers have a workaround for this issue – the passwords are saved on the user’s device, and when syncing is allowed, only then does the data go to the servers, like with RoboForm.

Features
The base functionality of password managers is storing passwords but most of them can offer additional functionality to improve usability.

Import from competitors
import passwords database from other application this type. This import can be done automatically during installation process as also later on demand by calling import feature. Sometimes import is not completely automatic but require additional steps like export data from other password manager application and then import from file.

Som software support by default their own format, like file in KeePass, but it also support common formats like TXT, HTML, XML or CSV.

Automatic password capture
Some products detect when you change your password to an account and offer to update the existing password on file to the new one.

Form filling / Autofill forms
Most password managers can fill in personal data on web forms, such as first and last name, email address, phone number, bank cards, passport numbers, etc. Some password managers also show you realistic images of credit cards with the correct color and bank logo of your physical card to make it easy to pick the payment option you want when shopping online. Many password managers also can capture and fill in credentials for desktop applications.

and fill forms.

Besides passwords those applications can offer storage other often used sensitive data like credit card data for payment and frequent flyer information.

Password strength report
Password managers can flag these bad passwords and help you improve them. A PCMag survey found that 70% of respondents reuse passwords for their accounts. Clearly, then, removing reused passwords is one of the biggest ways a password manager can improve your security. Some password managers even check whether you have set up multi-factor authentication for those services in your vault that support it and whether your personal information appears in any data breaches.

They can even remind you to change them regularly, which is a recommended practice. You will also be notified about duplicates, which are often found when you enter all the passwords into the database for the first time.

Passwordless access with biometrics
Password managers can eliminate the need for a master password by offering a passwordless entry to your desktop vault using biometric face (face ID) and fingerprint authentication (touch ID).

and embed in device biometrics like faceID or touchID.

Multi-factor authentication
Password manages can support multi-factor authentication to secure account by solution using biometric, SMS-based, or via time-based one-time passwords (TOTPs) stored in an authenticator app. The best standard for 2023 is supporting authentication via U2F or OTP-based hardware security keys, most of which are about the size of an actual key and made to go on your key ring.

Password managers can also use 2F authentication

Strong password generating
password generator

In many cases software used to manage passwords allow also generate strong passwords

A password manager assists in generating passwords