A password manager is an app that creates a strong, different password for every website and app a person uses, and stores them all in one encrypted vault. The person remembers only one password, the master password, which opens the vault. Browsers and phones now include a basic password manager, and separate apps offer more.
Why is this needed? Most people use the same few passwords on many sites. When one site is hacked and its passwords leak, criminals try the same email and password on banks, email and shopping sites. This is called credential stuffing. It succeeds whenever a password has been reused.
Consider a nurse in Chandigarh who has about 70 online accounts: the hospital's duty roster, her email, a pension portal, food delivery and shopping. When she signs up on a new site, the app makes a random password, such as "tR7#qL2vX9!mB4wz", 16 characters long, and saves it. The next time, the app fills it in for her. Later, one shopping site that she used is hacked. Only the password for that one site leaks, and it works nowhere else. She changes that password, and her other 69 accounts stay safe.
The vault is protected by encryption. The app turns the master password into a key on her own phone, and uses that key to lock the vault. Good password managers never send the master password or the key to their own servers. So even if the company's servers are hacked, the thief gets only scrambled data. Some apps keep the vault only on the person's own devices, or in a cloud storage account that the person already uses. Others keep an encrypted copy on their own servers, so that it is available on every device.
A password manager also helps against phishing. It fills a password only on the exact website where the password was saved. On a fake site with a slightly different address, it fills nothing, and that is a warning sign.
The weak point is the master password. If someone learns it, they can open everything. So the master password should be long, and the vault should also ask for a second proof, such as a code from the phone. This is multi-factor authentication (MFA). Many sites now also offer passkeys, a login with no password at all, which the phone stores in a similar way.
Companies solve the same problem differently. With single sign-on (SSO), an employee logs in once and does not need a separate password for each work app. Passwords that leak despite all this can be caught by identity theft protection.