Password manager
A password manager is an app that stores all your passwords in one locked, encrypted place and can create strong new ones for you, so you only need to remember one. Cyber Essentials names it, alongside a secure locked cabinet, as a way to support staff to use unique passwords. It belongs in your answer to A7.12.
- Term
- Password manager
- Also known as
- Password vault, Password safe
- Category
- Accounts and access
- Requirement area
- 4. User Access Control
- Questions
- A7.12
- Reviewed against
- Requirements v3.3
What does the term password manager mean in Cyber Essentials?
A password manager is an app that stores all your passwords in one locked, encrypted place and can create strong new ones for you, so you only need to remember one.
How does password manager apply to Cyber Essentials?
In plain terms
A password manager is like a key safe. Instead of remembering dozens of passwords, or writing them on sticky notes, you remember one strong password to open the safe. The app fills in the rest and can make up a long random password for each new account, so nothing is reused.
What Cyber Essentials asks
The NCSC requirements say you should "Support users to choose unique passwords for their work accounts". Two of the listed ways mention password managers:
- "teaching people to use the password generator feature built into some password managers"
- "providing usable secure storage for passwords (for example a password manager or secure locked cabinet) with clear information about how and when it can be used"
A7.12 asks: "Please explain how you encourage people to use unique and strong passwords." Naming the password manager you provide, and the guidance you give staff about using it, is a clear answer.
Cyber Essentials does not require a password manager. It is one of several ways to meet the support measures, alongside training and promoting passwords made of three or more words.
Practical points
Protect the password manager itself well: its main password and MFA matter most, because it holds everything else. A cloud-based password manager used for work accounts is likely to meet the scheme's definition of a cloud service, so list it at A2.9 and apply MFA as you would for any other cloud service. Include it in your leavers process so a departing member of staff loses access to shared vaults.
See the Cyber Essentials password rules and A7.12. Related: password, passphrase, credential stuffing.
Related terms
- PasswordA password is a secret string of characters that you type to prove you are the person an account belongs to.
- PassphraseA passphrase is a password made of several ordinary words strung together, such as three random words, which is long and hard to guess but easy to remember.
- Credential stuffingCredential stuffing is when criminals take usernames and passwords leaked from one website and try them on other websites, betting that people reuse the same password.
- Passwordless authenticationPasswordless authentication is a method to establish a user's identity that uses a factor other than knowledge, such as FIDO2 authenticators, biometrics, security keys, one-time codes, QR codes or push notifications.
- Privileged accessPrivileged access is any level of access above that of a normal user, such as admin rights that let someone change settings, install software or see everyone's data.
- Service accountA service account is a login used by a program or automated process, rather than by a person, for example the account a backup tool uses to reach your files.
Frequently asked questions
A password manager is an app that stores all your passwords in one locked, encrypted place and can create strong new ones for you, so you only need to remember one.
In the 2026 Danzell question set, password manager comes up at A7.12. Read those questions against the definition above so your answers use the term the way the assessor will.
Password manager relates to 4. User Access Control in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.