Key Takeaways
- A password manager is an encrypted vault that creates and stores a unique, complex password for every account, so you only have to remember one master passphrase.
- Reusing passwords enables "credential stuffing" attacks, where a login stolen from one site is tried on many others — which is why the Cyber Centre says every account needs its own
- The Cyber Centre recommends a master passphrase of at least four words (15+ characters), multi-factor authentication on the manager and your accounts, and a recovery plan in case y
One Password to Remember, and 50 You Never Have To
Think of the accounts you signed into this week. Banking. Email. Social media. The loyalty program you joined for a free coffee.
Every one wants a password — and every one is supposed to be different. The Canadian Centre for Cyber Security calls the result "password overload" — and overload pushes people into the two habits attackers love most: writing passwords down, or reusing one favourite everywhere.
A password manager breaks that trap: a digital vault that creates, stores and fills in a unique, complex password for every account. You remember exactly one — the master password that unlocks the vault. It remembers the other 50.
Why Reused Passwords Are an Open Door
Reusing a password feels harmless. It isn't.
When one website is breached, stolen logins get sold or posted online. Attackers then run an automated trick the Cyber Centre calls credential stuffing: bots try those stolen logins on other sites — banking, email, shopping — until something opens. Because so many people reuse passwords, it works. According to Get Cyber Safe, 41% of Canadians say they use the same password for multiple accounts — so one leak can hand a stranger the key to several accounts at once.
With a password manager, every account gets its own random password. A leak at one site burns one password, and one only.
The One Password That Has to Be Great
Your master password guards everything, so the Cyber Centre says to make it a passphrase: at least four words and 15 characters. Something like maple-otter-river-lantern is long, memorable, and brutally hard to guess or crack. (A plain password: at least 12 characters, mixing cases, numbers and symbols.)
Then add a second lock: multi-factor authentication (MFA) on the password manager itself, and on your important accounts. The Cyber Centre recommends MFA "whenever possible" — a code or fingerprint means a stolen master password alone isn't enough.
Browser-Based or Stand-Alone?
- Browser-based managers are built into your browser. Convenient, but risky if other people use your device, the Cyber Centre warns — and they don't always sync to your other devices.
- Stand-alone managers are separate apps storing your vault locally on your device or in the cloud. They tend to be more secure, says the Cyber Centre, support a complex primary password, usually offer two-factor authentication, and sync across your phone, tablet and computer.
The Cyber Centre's shopping list is clear: choose one that supports MFA and uses "zero-knowledge" encryption, so your passwords are unreadable to everyone — even the vendor. Good ones also flag weak or reused passwords and warn you about breaches.
The Catch: Don't Lose the Key
Zero-knowledge cuts both ways: if you forget your master passphrase, the vendor can't reset it and hand your vault back — by design, they can't read it either. That's why the Cyber Centre advises having a recovery plan, and says if you write the primary password down, store it properly — in a locked safe — and share it with no one.
The Cyber Centre is honest about the trade-off — a vault is a "one-stop shop" — but a strong passphrase, MFA and regular updates keep that single door stronger than the 50 flimsy ones it replaces.
The Twikup Take
Nobody can memorize 50 strong, unique passwords — pretending otherwise is how one reused password ends up unlocking your whole life. One great passphrase, one locked vault, MFA on top: that's the setup Canada's own cyber agency recommends.
Image: AI-generated illustration.