For years I used the same password with small variations. A base word, a number at the end, an exclamation mark for some services. I considered this a reasonable compromise between security and practicality.
It wasn't. It was close to the worst thing you can do, and I'm happy to explain why.
The actual problem
The risk of someone guessing your password is small. The real risk is that a service you're registered with gets breached and the credentials end up circulating.
This happens constantly, at enormous scale, and usually without those affected noticing. There are compiled collections containing billions of records from such incidents.
What attackers do with them is called credential stuffing: take the email and password combination and try it automatically against hundreds of other services. If you use the same password everywhere, one compromised provider is enough and everything else falls with it.
And the variations help less than people think. If someone has your password for one service and it reads "Summer2019!amazon", it doesn't take a genius to work out what the password at another provider looks like.
My objections, in order
"Then all my passwords are in one place." True, and that was my main worry. The point is that this one target is considerably better protected than the alternative.
Reputable password managers encrypt the vault locally on your device before anything is synchronised. The provider stores only encrypted data and doesn't know your master password. If their servers are compromised, attackers get encrypted blobs.
The flip side: if you forget the master password, everything is gone. That isn't a bug, it's the architecture.
"Too complicated." That was an argument in 2015. Today these programmes fill forms automatically, work on a phone with a fingerprint, and are in practice more convenient than what I did before. I've barely typed a password in two years.
"I've nothing to hide." It isn't about hiding, it's about control. Anyone with access to your email account can reset the password at nearly every other service. Email is the master key, and most people protect it worse than their front door.
What actually matters
If you do only three things, do these.
A strong, unique master password. Ideally a passphrase — four or five random words that don't make sense together. That's easier to remember and harder to crack than a short password with special characters.
Two-factor authentication, at minimum on email and on the password manager itself. Preferably via an app or hardware key rather than SMS. SMS codes can be intercepted through SIM-swapping attacks, which happen more often than people assume.
An emergency plan. What happens if something happens to you and someone else needs access? Most providers have a feature for this. Alternatively: master password and recovery code printed and stored somewhere secure.
Which kind of programme
Broadly three categories.
The ones built into a browser or operating system. Free, convenient, and for most people an enormous improvement over nothing. Downside: they tie you to one ecosystem and become awkward when you change device or browser.
Standalone commercial providers. Work everywhere, more features, usually cost something. You're trusting a company whose core business is the security of this data — which is an argument both for and against.
Local, open-source options where the file sits on your own machine and you handle synchronisation yourself. Maximum control, more effort, no provider risk.
I use a commercial one, because the convenience means I actually use it. A perfect system you work around out of frustration is worth less than a good one you use daily.
The honest objection
One practical note on migration, since that is where most people stall. Do not try to change every password at once. It is tedious, you will lose momentum, and half of it will be abandoned.
Instead work in order of consequence. Email first, because it is the recovery route for everything else. Then anything with money attached — banking, payment services, anywhere your card is stored. Then anything with personal data you would not want read. Everything else can wait, and honestly a lot of it can simply be updated the next time you happen to log in.
The other thing worth doing early is checking whether your existing addresses appear in known breaches. Several reputable services let you search an email address against public breach collections. It takes a minute and it is usually sobering — most people with a decade-old address turn up in several. That list tells you exactly which passwords to change first, which is more useful than working alphabetically through a browser's saved list.
One concern remains legitimate and is rarely stated openly: a password manager is a single point of failure.
There have been security incidents at providers, some with serious consequences. And malware on your own machine reading an unlocked vault is a realistic scenario.
That's a genuine risk. The question is only whether it's larger than the risk of using the same password at forty services. And there the answer is fairly clearly no.
Security is never about perfection, only about whether you've reduced the risk. It took me ten years to understand that. The migration took about two hours on a Sunday afternoon.