The short version: a generator creates passwords; a manager stores them. They're not alternatives — they're two halves of the same system. Use both.
People treat this as an either/or choice, and it's the wrong frame. It's like asking whether you need a stove or a refrigerator. The generator solves "my passwords are weak." The manager solves "I can't remember 80 unique passwords." You have both problems. You need both tools.
What each one does
Password generator. Produces a random, high-entropy password on demand — say, 18 characters mixing uppercase, lowercase, numbers, and symbols. Its job ends the moment you copy the password. Good ones, like PDFEdit's generator, use the Web Crypto API for real cryptographic randomness, let you tune length and character sets, show you the entropy in bits, and run entirely locally so the password never touches a server.
Password manager. An encrypted vault that stores all your passwords behind one master password. It autofills logins, generates passwords itself (most have generators built in), syncs across your devices, warns you about reused or breached passwords, and lets you share credentials securely.
The overlap: most managers include a generator. The standalone generator's advantage is speed and privacy — no account, no vault, no sync; just a password, right now, in your browser.
Why a generator alone fails
Try it: generate 20-character random passwords for ten accounts and memorize them. You can't. Nobody can. So without a manager, one of three things happens:
- You write them in a notes app or spreadsheet (readable by anyone with your phone).
- You simplify them until they're memorable (defeating the purpose).
- You reuse a few across everything (the original sin).
The generator is the engine; the manager is the garage. An engine without a garage just sits in the rain.
Why a manager alone is almost enough — but not quite
A good password manager covers nearly the entire workflow: it generates, stores, fills, and syncs. If you have one and use it well, you barely need anything else.
The remainder: there are moments you need a password without your vault handy — a shared computer, a device you haven't set up, generating a quick credential for someone else, or a WiFi password for guests. A standalone generator in the browser fills that gap instantly. It's also useful for one-off secrets: a PDF password, an encrypted archive, a temporary share link.
What to look for in a password manager
If you're choosing one, these are the features that actually matter:
Zero-knowledge architecture. Your vault is encrypted with your master password, and the provider cannot read it. This is the single most important property — it means a breach of their servers doesn't expose your passwords.
A built-in generator. Any manager worth using generates strong passwords when you create accounts. (You'll still want a standalone generator for the moments your vault isn't handy.)
Autofill that resists phishing. Good managers only fill credentials on the correct domain — so a fake paypa1.com login page gets nothing. This is an underrated anti-phishing feature.
Breach monitoring. Alerts when your saved credentials appear in known breaches, so you can rotate them.
Secure sharing. For shared accounts (family streaming, team tools) — sharing through the manager beats texting passwords.
Cross-device sync and offline access. Your passwords on your phone, tablet, and laptop, available even without connectivity.
Emergency access. A way for a trusted person to get in if you're incapacitated — morbid, responsible, and often overlooked.
Free tiers of reputable managers cover the essentials for individuals. Paid tiers add family sharing, more storage, and priority support. Either way, any established manager beats no manager by orders of magnitude.
How to set up the system (once, properly)
1. Pick a manager. Reputable options exist on every platform, many with generous free tiers. Your browser's built-in manager is a fine starting point if you want zero setup.
2. Create one excellent master password. This is the one password you memorize. Make it long — a five-word random passphrase works well — and never reuse it anywhere.
3. Set up recovery immediately. Recovery codes, a trusted device, an emergency contact — whatever your manager offers. Do this on day one, not after you've forgotten the master password.
4. Turn on two-factor for the vault. The vault holds everything; protect it accordingly.
5. Migrate gradually. You don't need to change 100 passwords tonight. Start with email, banking, and cloud storage. Then change passwords opportunistically — whenever you log into a site, generate a fresh unique one and save it. In a few months, you're covered.
The honest threat model
Let's be realistic about what this protects against:
- Credential stuffing after breaches: eliminated by unique passwords. This is the most common real-world attack, and the system defeats it completely.
- Guessing and brute force: defeated by length and randomness.
- Phishing: not defeated by passwords at all — a fake login page captures whatever you type. Only 2FA (especially security keys) and vigilance help here.
- Someone with your unlocked device: not a password problem. Lock your devices.
No tool fixes everything. But unique generated passwords in a manager fix the largest, most automated category of account takeover — the one that hits ordinary people every day.
Bottom line
Get a password manager. Use its generator — or a fast standalone one like ours when you need a password right now. Memorize exactly one strong master password. Turn on 2FA for the important stuff. That's the whole system, and it's more security than most people will ever need.
