What Password Managers Do (And Why Aliases Matter)
Most people reuse passwords without realising the risk, so one breach can unlock dozens of accounts. Here is how a password manager, email aliases and printed backup codes close that gap.
Jump to section
Every time a company announces a data breach, the advice is the same: change your password. Most people change that one and carry on using the same password everywhere else.
That habit is what turns one small breach into a takeover of your whole online life. A password manager ends password reuse. A separate email alias for each account stops the same address following you everywhere. Here is what each one does, how they work together and how to set them up without locking yourself out.
Short answer: four things, in this order:
- Use a password manager so every account gets its own long, random password (or a passkey where the site offers one).
- Give your main email account the strongest password and two-factor authentication you have, because it can reset everything else.
- Sign up for new accounts with an alias, ideally on your own domain, so a leak at one site can’t be linked to the rest.
- Print your recovery codes. Nobody can reset a zero-access vault for you.
At a glance: what each tool stops
| Tool | What it stops | What it doesn’t stop |
|---|---|---|
| Password manager | Password reuse, weak passwords and many fake login pages (autofill won’t fill on the wrong domain) | A breach at the site itself, or someone who already has your inbox |
| Passkeys | Phishing and stolen passwords for that site: there is no password to steal | Losing every device the passkey is on, if you have no backup |
| Email aliases | One leaked address being matched to all your other accounts, and spam you can’t trace | Password reuse, if you still use the same password |
| Two-factor authentication | Sign-ins with a stolen password alone | Losing your second factor without a backup |
| Printed recovery codes | Being locked out of your vault or main email for good | Anything, if you only keep them inside the account they protect |
What a password manager does
A password manager creates, encrypts and stores a different random password for every site you use, then fills it in for you. That leaves you with one job: protecting a single master password.
- It makes the passwords. Long, random and fitted to each site’s rules, so you never have to think one up.
- It locks them away. Your vault is encrypted on your device before it is synced, so the company holding it can’t read it.
- It fills them in on the right site only. Autofill matches the saved login to the site’s domain. A lookalike address won’t match, so the manager won’t offer your password to a fake page. If it doesn’t offer to fill, stop and check where you are.
- It holds your passkeys. All the big managers now save passkeys too and sync them between your devices.
Good to know: a passkey replaces the password altogether. Your device proves who you are with your fingerprint, face or PIN, and there is nothing a fake site can trick you into typing. Where a site offers a passkey, I take it, and keep the password manager for everything else.
Why reusing a password is so risky
When a site is breached, lists of email addresses and passwords are sold and shared quickly. Attackers then try those pairs automatically on other, more valuable sites. This is called credential stuffing, and it works like this:
- A small site you signed up to years ago is breached.
- Your email address and password from that site end up on a list.
- Software tries the same pair on email providers, banks and shops.
- Anywhere you used the same password, they are in.
Most account takeovers aren’t personal. They happen because a password from an old forum still works on someone’s main email or bank. You can check whether your address has been in a known breach with Have I Been Pwned.
Watch out: your email account is the reset button for almost everything else. Anyone who gets into your inbox can ask for password reset links, delete the security alerts and lock you out. Give it a unique password and two-factor authentication before anything else. A hardware security key is the strongest option, and I explain how to set one up in my YubiKey and Proton Pass guide.
Is it safe to keep every password in one place?
It is a fair worry. The reason it’s less risky than it sounds is that the mainstream password managers use a zero-access (sometimes called zero-knowledge) design.
| What matters | A typical website account | A zero-access password manager |
|---|---|---|
| Where encryption happens | On the company’s server, and the company holds the keys | On your device, before anything is sent |
| Your master password | Stored on the server as a hash | Never sent to or stored by the company |
| If the company is breached | Your data or password hash can leak | The attackers get an encrypted vault they can’t open without your key |
That protection is only as good as your master password, so make it long and use it nowhere else. Some managers, such as 1Password, add a separate secret key on top. For more on the idea, see what zero-access encryption really means.
Where email aliases come in
A password manager stops you reusing passwords. An alias stops you reusing your identity. Each account gets its own forwarding address, and mail sent to it lands in your normal inbox.
- A leak stays in one place. If a site leaks your details, the address can’t be matched to your real inbox or your other accounts.
- You can see who leaked it. If an alias starts getting spam, you know exactly which site sold or lost it.
- You can switch one off. Turn off a single alias without changing your main address anywhere else.
The easiest way to use aliases is to let your password manager make one each time it makes a password.
Password managers that make aliases for you
| Password manager | How it makes aliases | Worth knowing |
|---|---|---|
| Proton Pass | Built in (“hide-my-email” aliases) | The free plan includes 10 aliases. Pass Plus adds unlimited aliases and your own domain, from $2.99 a month paid yearly (as listed on Proton’s pricing page in November 2026). |
| Bitwarden | Its generator connects to an alias service you already use | Works with SimpleLogin, addy.io, Firefox Relay, Fastmail, DuckDuckGo and Forward Email. You paste in an access key from that service once. |
| 1Password | Connects to Fastmail’s Masked Email | Needs a Fastmail account. Set it up from Masked Email in Fastmail’s settings. |
| Apple Passwords | Hide My Email, offered by Safari on sign-up forms | Needs an iCloud+ subscription and works best if you live on Apple devices. |
If you’re weighing up aliases against throwaway inboxes, I compare the two in masked email vs disposable email.
Put your aliases on your own domain
Aliases on the alias service’s own domain are better than nothing, but they tie your accounts to that company. If you leave, or it closes, those addresses can go with it.
Aliases on a domain you own move with you:
| Site | Its own alias | What it’s for |
|---|---|---|
| Amazon | amazon@yourdomain.com | Orders and deliveries |
| Netflix | netflix@yourdomain.com | Your subscription |
| Your bank | finance@yourdomain.com | Statements and alerts |
If you later change email provider or alias service, you point the domain at the new one and none of those logins needs changing.
How I’d set it up
Secure your main email first
Give it a new password from your password manager and turn on two-factor authentication, or add a passkey if your provider offers one.
Fix the accounts that matter most
Work through your bank, shopping sites with a saved card and anything else you’d hate to lose. Replace each reused password as you go. Most managers flag reused and weak passwords for you.
Use an alias for every new sign-up
Connect your password manager to an alias service (or use one with aliases built in) so a new alias appears every time it makes a password.
Print your way back in
Print your vault’s emergency kit, the master password, any secret key and the recovery codes for your vault and your main email. Keep them with your important papers, not only inside the accounts they protect.
Watch out: because a zero-access company can’t see your vault, it can’t reset your master password. Forget it without a backup and the vault is gone. Check, too, that your manager can export to a standard file such as CSV or JSON, so you can always leave.
None of this makes you untouchable. It means a failure at one website never takes your whole online life down with it.
Frequently asked questions
Is it safe to keep all my passwords in one app?
With a reputable zero-access manager and a strong master password you use nowhere else, it is far safer than reusing passwords. A breach of the company’s servers gives attackers encrypted data, not your logins.
Do I still need aliases if every password is different?
Yes, because they solve a different problem. Different passwords stop a leak spreading to your other accounts. Aliases stop one address linking all those accounts together, and show you who leaked it.
Do passkeys replace password managers?
Not yet. Plenty of sites still only take passwords, and your password manager is a good place to keep your passkeys anyway, so they sync between your devices.
What happens if I forget my master password?
With a zero-access manager, the company can’t recover it for you. That’s why the printed emergency kit and recovery codes matter.
Should my aliases use my own domain?
If you can, yes. Aliases on your own domain keep working if you change alias service or email provider.
Checked and updated 1 November 2026. Sources: Proton Pass pricing, Bitwarden: forwarded email alias generator, Fastmail: Masked Email with Bitwarden, 1Password: Fastmail Masked Email, addy.io.
Paul O'Brien
I've spent over 25 years working hands-on with email, DNS and cloud infrastructure. I test email providers and privacy tools for real, then tell you what they're good at and where they fall short.
More about meMore like this
You're subscribed. New articles come by email, as I publish or every Thursday. Change how often
Comments