Password Manager Basics: Safer Passwords Without Reuse
Password Manager Basics: Safer Passwords Without Reuse
A password manager stores passwords in an encrypted vault and can generate a different strong password for every account. This solves one of the most common password problems: reuse. If one reused password is stolen from a website, attackers can try it against email, banking, work, and social accounts. CISA recommends using long, random, unique passwords and a password manager to create and store them.[1]
For work accounts, use only the password manager approved by your organization and Zerolimit. Do not move company credentials into a personal vault, browser, spreadsheet, notes app, email draft, or unapproved extension. If you are not sure which manager is approved, ask Zerolimit before importing or saving anything.
Set up the vault safely
- Install or open it from an approved source. Use the organization’s software portal, managed browser, or a link supplied through a known Zerolimit channel. Search advertisements and unsolicited “upgrade” messages can lead to look-alike products.
- Create a strong master password or passphrase. Make it long, unique, and memorable. Never reuse it for any other account. Do not store it inside the same vault as a normal entry.
- Enable MFA for the password-manager account. Prefer the method approved by Zerolimit. Protect backup and recovery codes as directed; do not keep them in an exposed file or photograph.
- Let the manager generate unique passwords. Do not weaken generated passwords to make them easier to type unless a site has a technical limitation. For accounts that support passkeys and where the organization allows them, Zerolimit can advise on adoption.
- Lock the vault when you step away and keep the device itself protected with a screen lock, updates, and company security controls.
Google Password Manager describes generating and saving strong, unique passwords and checking saved credentials for compromise.[2] Microsoft’s password manager similarly supports saving and generating passwords in its ecosystem.[3] Built-in managers can be useful, but approval and account separation matter in a business environment.
Everyday use
Use autofill only after checking the site and context. A password manager may refuse to fill credentials on a look-alike domain, which is a useful phishing warning. Do not copy a password into a page reached from an unexpected email, text, QR code, or pop-up. Navigate through a trusted bookmark or type the known address yourself.
Never share your master password, recovery key, MFA code, or an exported vault. If a coworker needs access to a shared business account, use the organization’s approved sharing feature or ask Zerolimit to create appropriate individual access. Sending a password through chat or email defeats much of the manager’s protection and makes access hard to revoke or audit.
Avoid exporting passwords unless Zerolimit directs you. Exports are often readable files that can remain in Downloads, cloud sync, backups, or the recycle bin. Do not print the entire vault. If emergency access is required, follow the organization’s documented process.
If something seems wrong
Contact Zerolimit immediately if you receive an unexpected vault sign-in alert, MFA prompt, password-change notice, recovery email, or request to approve a new device. Also report a missing device that contains the vault, a master password entered on a suspicious page, an accidentally shared export, or an extension that changed unexpectedly.
Do not approve the prompt, click the alert link, or repeatedly try the master password. Use a known-good device and follow Zerolimit’s containment instructions. A master-password change alone may not revoke existing sessions or remove an unauthorized recovery method, so let Zerolimit confirm the account is secure.
Recovery and updates
Understand the recovery process before an emergency. Some password managers cannot recover a forgotten master password; others use organization-controlled recovery. Store recovery materials only in the approved location. Keep the manager, browser, and operating system updated, but install updates through normal application controls or the organization’s software system, not a pop-up advertisement.
A password manager reduces risk; it does not make every sign-in safe. Continue to use MFA, examine unexpected prompts, verify sensitive requests, and report suspicious activity. The combination of unique passwords, controlled recovery, MFA, and rapid reporting provides stronger protection than any one control alone.