What Password Managers Do (And Why Aliases Matter)

Every time a company announces a data breach, the standard advice appears: change your password.

Most people update that single account, then carry on using the exact same password everywhere else. That habit turns a minor breach into a full digital identity takeover. A password manager breaks that chain reaction by eliminating password reuse entirely.

What a Password Manager Does

A password manager generates, encrypts, and stores unique, random passwords for every site you use. It handles authentication automatically, leaving you with one primary responsibility: protecting a single master password.

• Automated Generation: Creates high-entropy passwords tailored to each site's specific character requirements.
• Encrypted Storage: Keeps credentials inside a vault encrypted locally before synced to the cloud.
• Autofill Integration: Detects valid domain names and populates credentials automatically, which also protects against phishing sites using fake URLs.

Why Password Reuse Is Dangerous

When an online service is breached, credential dumps (containing email and password pairs) circulate quickly. Attackers run automated scripts (credential stuffing) to test those leaked combinations across high-value services:

Breached Site A ──► Leaked Credentials (User + Password)
                            │
                            ▼
          Automated Credential Stuffing Attack
                            │
        ┌───────────────────┼───────────────────┐
        ▼                   ▼                   ▼
 Email Account       Bank Account      Shopping Services
  (COMPROMISED)      (COMPROMISED)       (COMPROMISED)

Account takeovers rarely happen because an attacker targeted you directly; they happen because a password leaked from an obscure forum still works on your main email or banking portal.

Protecting Your Primary Email

Your email account serves as the universal reset button for your entire online presence. If an attacker gains access to your inbox, they can request password reset links for almost every linked service, bypass security alerts, and lock you out permanently. Using a unique, complex password on your primary inbox is your first line of defence.

Security Model & Zero-Access Encryption

A common concern is consolidating all credentials into a single application. However, modern password managers operate on a zero-access (or zero-knowledge) architecture:

If a password manager provider suffers a server-side breach, attackers only obtain encrypted data blobs. Without your master password and secret key, decrypting the vault is computationally infeasible.

The Power Combo: Password Managers + Email Aliases

Combining unique passwords with unique email aliases changes how online identity works. While a password manager stops credential reuse, an email alias service (such as Proton Pass, SimpleLogin, or AnonAddy) stops identity reuse.

Standard Signup:   user@gmail.com  +  Reused Password  ──► Single Breach = Full Access
Masked Signup:     alias@domain.com + Unique Password ──► Single Breach = Isolated Incident

Benefits of Account Compartmentalisation:

• Breach Isolation: If a service leaks your data, the exposed email address and password cannot be matched to your real inbox or other accounts.
• Spam Tracking: If an alias receives spam, you know precisely which service sold or leaked your address.
• Instant Disablement: You can deactivate a single compromised alias without changing your master email address anywhere else.

Custom Domains: Owning the Identity Layer

Using provider-granted aliases (e.g., @proton.me or @anonaddy.me) improves privacy, but keeps your identity tied to that vendor. If you switch providers, those aliases break.

Using a custom domain for your aliases makes your identity portable:

If you decide to change email hosts or alias management tools in the future, your custom domain moves with you. No login emails need to be updated across your accounts.

Vault Recovery and Emergency Precautions

Because zero-access systems prevent providers from viewing your data, they cannot reset your password if you forget it. Losing your credentials means losing access to your entire digital life.

1. Print Emergency Kits: Store a physical copy of your master password, secret key, and account recovery codes alongside critical legal documents.
2. Offline 2FA Backups: Print the one-time backup codes generated when enabling two-factor authentication on your vault and primary email. Never store these recovery codes exclusively inside the account they protect.
3. Verify Vault Portability: Ensure your chosen manager supports exporting standard JSON or CSV files so you retain control over your data.

Reducing your blast radius isn't about achieving absolute invulnerability—it's about ensuring that a security failure at a single website never compromises your whole digital identity.