Password Manager: Another Layer of Privacy
Credential abuse is still a significant chunk of how breaches happen, driven by password reuse. What a password manager does about it, and where it falls short.
Published September 4, 2026· By Juan Martinez
A meaningful share of account takeovers don’t start with someone intercepting your traffic or fingerprinting your browser. They start with a password that was already sitting in a breached database somewhere, waiting to be tried against a hundred other sites you also used it on. That’s a different kind of exposure than the network-level stuff — and it’s the one a password manager is built to close.
Why reuse is the actual problem
Verizon’s 2026 Data Breach Investigations Report — the industry’s largest annual analysis of confirmed breaches, drawing on more than 22,000 cases across 145 countries — found that credential abuse accounted for 13% of the ways attackers get into a network. It used to be the single biggest initial-access vector; this year, vulnerability exploitation overtook it, now sitting at 31%.[1] Credential abuse isn’t the top attack path anymore, but it’s still a meaningfully sized one, and it doesn’t require a sophisticated attacker — just a list of passwords from an old breach and enough patience to try them elsewhere.
The reason that works at all is reuse. A study of over 19 billion passwords exposed in roughly 200 breaches and leaks between April 2024 and April 2025 found that 94% were reused or duplicated across accounts — only 6% were unique.[2] That figure is a year and a half old at this point and hasn’t been repeated at the same scale since, but nothing about the underlying behavior — one password, many accounts — has an obvious reason to have changed.
What a password manager actually does
The core function is simple: generate a unique, random password for every account, so a leak on one site can’t be replayed on another. That alone breaks the mechanism the 19-billion-password study describes. Everything else is built on top of it.
Autofill checks the domain, not just the page. Because a manager fills credentials based on the saved URL rather than what a page looks like, it won’t offer your bank password to a convincing fake hosted on a different domain. It’s worth knowing this protection has settings, not one fixed behavior: Bitwarden’s default match mode, for instance, is “base domain” — matching google.com to accounts.google.com — looser than the exact-domain option it also offers.[3] The protection is real, but it depends on how it’s configured, same as any other setting.
Passkeys close the gap TOTP leaves open. A common second factor, the six-digit code from an authenticator app, is still phishable — the U.S. General Services Administration’s own playbook for federal agencies lists “Time-based OTP (TOTP) for mobile, email, and tokens” among the “phishable and replayable authentication options,” alongside the plain statement that “any MFA authentication option is better than just a password alone, but phishing-resistant authentication options are widely available.”[4] Passkeys are different: they’re cryptographically bound to the real domain, so there’s nothing to type into a fake site in the first place. All three managers below can store and autofill passkeys.
Where it doesn’t reach
A password manager protects credentials. It doesn’t encrypt your network traffic, and it doesn’t stop a site from fingerprinting your browser — those are separate layers with separate tools, and a manager was never meant to cover them. It also can’t undo human error: if you type your master password into a phishing page yourself, or reuse that password somewhere else, the whole model breaks. The tool removes the reuse problem for everything it manages; it doesn’t remove the need for basic care.
Picking one
This link earns us nothing — no tracking, just the review.
Best free option. Fully open source, free tier with no meaningful limits, self-hostable if you want to run your own server. See our Bitwarden review.
This link earns us nothing — no tracking, just the review.
Built by a privacy-first team. Swiss jurisdiction, non-profit ownership structure, and it encrypts more of your vault than most managers do — not just passwords, but the usernames and URLs too. Full write-up in our Proton Pass review.
This link earns us nothing — no tracking, just the review.
Strongest security architecture, no free tier. Its Secret Key adds a second layer beyond your master password. The trade-off is a closed codebase and a subscription from day one. Details in our 1Password review.
Summary
Password reuse is still a real, sized attack path — 13% of how breaches happen, according to the most recent industry-wide data, built on a habit that affects the overwhelming majority of people who’ve had a password leaked. A password manager closes it directly: a unique password per account, autofill that checks the real domain instead of trusting appearances, and passkey support where a site offers it. It’s not a substitute for the other layers of a privacy setup — just the one most people skip. Start with the password managers we’ve reviewed.