Loading page
Keyring is a private demonstration page, not a password manager, and is not affiliated with any company. No product is named or recommended on it.
Password managers
You do not have a password problem. You have a reuse problem.
Almost nobody is breached because their password was too short. They are breached because one site leaked it and twenty others accepted it. A manager exists to make every password different — which is a thing no human memory can do, and the only thing that actually closes this off.
Why reuse is the problem
One leak, and every door with the same key
This is what credential stuffing is: attackers take a username and password from one breach and try the pair everywhere else, automatically. It works because most people reuse.
Leaked from one forum in 2019
Summer2019!
Long enough. A capital, a number, a symbol. It passed the site's strength meter — and none of that matters once the site itself is breached and the pair is published.
Your email accountTotalResets the password on everything else
Online bankingSevereDirect access to money and statements
Shopping accountsSevereSaved cards, addresses, order history
Cloud storageSevereDocuments, photos, scans of your ID
Social accountsHighImpersonation of you to people who trust you
Streaming and utilitiesModerateResold access, and your details inside them
Notice what fixes this and what does not. Making that password longer changes nothing — it was published in full. Only making it different everywhere does, and that is the entire job a manager is doing.
The arithmetic
Length does more than symbols do
Every character you add multiplies the number of possibilities; swapping an o for a 0 does not, because the software guessing knows that substitution. These are categories, not stopwatch figures — anyone quoting you exact crack times is guessing at hardware.
P@ssw0rd!
Falls immediately
It is a dictionary word with the substitutions every cracking tool tries first. The symbols buy essentially nothing because the pattern is the most common one there is.
Tr0ub4dor&3
Falls quickly
Harder, and still built from one word plus decoration. It is also impossible to remember, which is why people write it down or reuse it — the practical failure rather than the mathematical one.
kitchen-radio-9
Reasonable for a low-value account
Three unrelated elements, easy to recall, no substitutions. Fine for a forum. Not what you want on email or banking.
copper lantern drift almanac
Strong, and memorable
Four random common words. Long, no symbols, and you can actually hold it in your head — which is what makes it a realistic choice for the one password you must remember: the manager's own.
This matters for exactly one password. Every other password you own should be long, random and unmemorised, because the manager types them. Spend your memory on the master.
The switch-over guide
Moving to a manager is the part people abandon halfway. This is the order that works, including what to do about the accounts you have forgotten.
Before you switch
What a manager fixes, and what it concentrates
The trade is real and worth naming: you are putting every credential behind one secret. A page that recommends this without saying so is not being straight with you.
It fixes
Reuse, completely
Every site gets a different password because you never have to remember any of them. This is the whole benefit, and it is a large one.
It fixes
Phishing, partly
A manager fills credentials by matching the site address. On a lookalike domain it simply will not offer them — which is a better phishing check than human attention.
It fixes
The forgotten-account problem
The vault becomes a list of every account you have, which is the only practical way to find and close the ones you stopped using.
It concentrates
Everything behind one secret
If the master password is guessable, or written where someone finds it, the concentration works against you. It has to be long, unique and never used anywhere else.
It concentrates
Recovery into one path
Most managers cannot reset your master for you — that is the point of the design. Losing it can mean losing the vault, so the recovery kit is not optional paperwork.
It does not
Protect an already-breached account
Changing a password after a leak matters, but if someone is already inside with a session or a passkey, the password is not the only thing to revoke.
How to choose
Five questions worth asking
Ignore the feature grids; the differences that matter are about architecture and exit, not how many fields the notes editor has.
Is the vault encrypted before it leaves your device?
The phrase to look for is end-to-end or zero-knowledge encryption: the provider stores a blob it cannot read. If a service can show you your own passwords through a support agent, it can also be compelled to.
Can you export everything, in a standard format?
Check this before you import a single login. A manager that makes leaving hard has a lock-in incentive, and you will want to move at some point.
What is the recovery story, exactly?
Some offer an emergency kit, some a trusted contact, some nothing at all. Whichever it is, set it up on day one — not the day you need it.
Has the code or the crypto been independently reviewed?
Published audits and open-source clients are not guarantees, but they are the only external evidence you get. Prefer specifics over the word “bank-grade”, which means nothing.
Does it support passkeys as well as passwords?
Passkeys are gradually replacing passwords on major sites, and a manager that stores both is the difference between one place to look and two.
Your browser's built-in manager is a legitimate starting point and much better than reuse. Its limits are cross-browser use and sharing — if neither matters to you, it may be all you need.
Straight answers
Questions people actually ask
- Is putting every password in one place not risky?
- It concentrates risk, which is a real cost, and it removes reuse, which is a much larger one. For nearly everyone that is a good trade — but it makes the master password and the recovery kit the two things you cannot be casual about.
- What if the company gets breached?
- With end-to-end encryption the attacker gets a blob they must crack per user, and a long master password makes that impractical. It is also why a short master is genuinely dangerous: it is the one thing standing between a stolen vault and its contents.
- What if I forget the master password?
- In most designs, nobody can recover it for you — that is deliberate. This is why the recovery kit exists and why setting it up is part of installation, not something to do later.
- Is the browser's built-in one good enough?
- It is far better than reuse and fine for many people. You outgrow it when you use more than one browser, need to share a login with someone, or want passkeys and notes in the same place.
- Do I still need two-factor authentication?
- Yes, especially on email and the manager itself. A password proves you know something; a second factor proves you have something. Reuse is solved by the manager, stolen-session and phishing risk is not.
- What about passkeys — are passwords finished?
- Not yet, and not everywhere. Passkeys are better where they exist and adoption is uneven, so for years yet you will be running both. A manager that holds both is the practical answer.
Go straight to the source
Independent references, none of them selling a manager
- CISA — use strong passwordsThe federal cyber agency's own guidance, including on managers.
- NIST digital identity guidelinesWhere the length-over-complexity advice actually comes from.
- Have I Been PwnedCheck which breaches your address appears in.
- EFF — creating strong passwordsThe passphrase method, explained by the people who popularised it.
- FTC — password securityConsumer-side checklist from the regulator.
- passkeys.devWhat is replacing passwords, and where it works today.
One email, then we leave you alone
Take the switch-over guide before you install anything
The order that works, what to do with forgotten accounts, and the two things to set up on day one rather than the day you need them.