What Password Managers Do (And Why Aliases Matter)

Every time a company announces a data breach, the standard advice appears: change your password. Most people update that one account and carry on using the same password everywhere else.

That habit is what turns a minor breach into a full takeover of your online life. A password manager breaks the chain by ending password reuse. Add a unique email alias for each account and you also stop the same address following you everywhere. This post explains what each tool does, how they work together, and how to avoid locking yourself out in the process.

At a glance

What a password manager does

A password manager generates, encrypts and stores a unique, random password for every site you use. It fills them in for you, which leaves you with one main responsibility: protecting a single master password.

• Generation. It creates long random passwords that fit each site’s character rules, so you never have to invent one.
• Encrypted storage. Your credentials sit in a vault that is encrypted on your device before it is synced to the cloud.
• Autofill. It matches the saved login to the site’s domain. That also helps against phishing, because a lookalike URL won’t match and the manager won’t offer your password.

Why password reuse is dangerous

When an online service is breached, lists of email and password pairs circulate quickly. Attackers then run automated scripts, known as credential stuffing, to try those leaked combinations on other, more valuable services.

Breached Site A ──► Leaked Credentials (User + Password)
                            │
                            ▼
          Automated Credential Stuffing Attack
                            │
        ┌───────────────────┼───────────────────┐
        ▼                   ▼                   ▼
 Email Account       Bank Account      Shopping Services
  (COMPROMISED)      (COMPROMISED)       (COMPROMISED)

Account takeovers rarely happen because someone targeted you personally. They happen because a password leaked from an obscure forum still works on your main email or your bank. You can check whether your address has turned up in a known breach with Have I Been Pwned.

Protecting your primary email

Your email account is the reset button for almost everything else. If an attacker gets into your inbox, they can request password reset links for linked services, delete the security alerts and lock you out. A unique, strong password on that account, plus two-factor authentication, is your first line of defence. If you want the strongest option, a hardware key is hard to beat, and I cover setting one up in my YubiKey and Proton Pass guide.

The security model: zero-access encryption

A common worry is putting every credential in one app. The reason that is less risky than it sounds is that mainstream password managers use a zero-access (or zero-knowledge) design.

If a password manager’s servers are breached, the attackers get encrypted data. Without your master password (and, with some managers such as 1Password, a separate secret key), decrypting a strong vault is not practical. That protection is only as good as your master password, so make it long and use it nowhere else. For more on the idea itself, see what zero-access encryption really means.

The combination: password managers and email aliases

A password manager stops credential reuse. An email alias service stops identity reuse. Services such as Proton Pass, SimpleLogin (owned by Proton since 2022) and addy.io (formerly AnonAddy) let you create a separate forwarding address for each account. Fastmail’s Masked Email does the same and works with 1Password and Bitwarden.

Standard Signup:   user@gmail.com  +  Reused Password  ──► Single Breach = Full Access
Masked Signup:     alias@domain.com + Unique Password ──► Single Breach = Isolated Incident

What compartmentalising gets you

• Breach isolation. If a service leaks your data, the exposed address and password can’t be matched to your real inbox or your other accounts.
• Spam tracing. If an alias starts getting spam, you know exactly which service sold or leaked it.
• Instant shut-off. You can turn off one compromised alias without changing your main address anywhere else.

If you are deciding between aliases and throwaway inboxes, I compare the two in masked email vs disposable email.

Custom domains: owning the identity layer

Aliases on a shared domain that belongs to the alias service improve privacy, but they keep your identity tied to that vendor. If you leave, or the service closes, those addresses go with it.

Putting your aliases on a domain you own makes your identity portable:

If you later change email host or alias tool, the domain moves with you and none of those logins needs updating.

Vault recovery and emergency precautions

Because zero-access systems stop the provider from seeing your data, they cannot reset your password if you forget it. Lose your credentials and you lose the vault.

1. Print an emergency kit. Keep a physical copy of your master password, any secret key and your recovery codes with your important papers.
2. Keep 2FA backup codes offline. Print the one-time codes you get when you turn on two-factor authentication for your vault and your primary email. Never store them only inside the account they protect.
3. Check you can leave. Make sure your manager can export to a standard format such as CSV or JSON, so you keep control of your data.

What I’d do

Start with the account that matters most: your main email. Give it a new, unique password from a password manager and turn on two-factor authentication. Then work through your important accounts (bank, shopping, anything with a saved card) and replace reused passwords as you go. Use aliases for new sign-ups, on your own domain if you have one. Finally, print the recovery codes and put them somewhere safe.

Reducing your blast radius isn’t about being invulnerable. It’s about making sure a failure at one website never takes down your whole online identity.

FAQ

Is it safe to keep all my passwords in one app?

With a reputable zero-access manager and a strong, unique master password, it is far safer than reusing passwords. A breach of the provider’s servers yields encrypted data, not your logins.

Do I still need aliases if every password is unique?

They solve a different problem. Unique passwords stop a leak spreading to other accounts. Aliases stop your one address being used to link those accounts together and make spam traceable.

What happens if I forget my master password?

With a zero-access manager, the provider cannot recover it for you. That is why the printed emergency kit and recovery codes matter.

Should my aliases use my own domain?

If you can, yes. Aliases on your own domain keep working if you change alias service or email provider.

Note: checked and updated 17 October 2026. Sources: SimpleLogin, addy.io: AnonAddy has rebranded as addy.io, Fastmail: Masked Email.