Credential Manager

A credential manager is a program that stores and manages access data. Access data — called “credentials” — is information used to identify oneself to a system: usually a username and a password, sometimes also a digital certificate or a token, i.e. an automatically generated one-time code. The credential manager keeps this data encrypted, so that users don’t have to remember it themselves or write it down anywhere. It can also automatically enter the data whenever a website or program asks for a login. This sounds simple, but it is the core of an important security principle: those who don’t have to remember passwords can use a different, long and random password for every account.

Why weak passwords are a structural problem

People are bad at inventing and remembering many different passwords. Studies regularly show that “123456” and “password” are among the most common passwords worldwide. This is not a failure of individual users, but a predictable outcome: anyone with dozens of accounts will eventually fall back on simple or reused passwords.

This is exactly where the risk lies. If just one of these accounts is hacked, attackers can try the same password on other services — this attack is called credential stuffing. A credential manager solves this problem at its root, because it can generate and remember arbitrarily complex passwords. The user only has to remember a single master password that unlocks the vault.

How a credential manager protects data

The stored access data is kept in an encrypted database, the so-called vault. Encryption here means that the data looks like meaningless gibberish without the right key — the master password — even if someone steals the file. Common implementations use the AES-256 standard for this, which is also used by government agencies and banks.

Many credential managers also offer two-factor authentication. This means that even if someone knows the master password, they need a second proof — for example, a code from an app on a smartphone. Some systems, especially in companies, do not store the vault locally on the device but in the cloud, so that it can be accessed from anywhere without losing data.

For software developers and companies there is a specialized variant: the secrets manager. It does not manage human passwords, but so-called API keys and database passwords that programs exchange with each other. Here it’s not about convenience, but about ensuring that access data doesn’t sit openly in program code and thus accidentally become public.

Credential managers in everyday life and in the news

Anyone who uses an iPhone already knows credential managers: iCloud Keychain is Apple's built-in solution. Windows has its own component called “Credential Manager,” which stores passwords for networks and websites. Browsers like Chrome or Firefox also come with simple password managers built in. Standalone programs like Bitwarden, 1Password, or KeePass offer more control and work across devices.

In business and tech news, the term usually comes up in connection with data breaches. When a company reports that employees' access data has been stolen, the standard recommendation afterward is almost always: adopt a password manager and enable two-factor authentication. The credential manager also plays a central role in the debate around passkeys — a newer method intended to replace passwords entirely — because it manages these new keys as well.

A common misconception is that a credential manager is itself an attractive target for attacks and is therefore less secure than not using one at all. The opposite is true: those who don’t use one typically have weak, reused passwords — making them a much easier target than someone whose vault is protected by a strong master password and two-factor security.