Password Managers as a Phishing Alarm
A password manager only autofills on the website it saved the password for. When it stays silent on a login page, that hesitation is a warning. How to use it as a phishing alarm.
People often think of password managers as a convenience. They are also a quiet phishing detector. A password manager matches the saved password to the exact website address, not to how the page looks. A convincing fake login page on a different address gets nothing.
How the alarm works
You visit your bank's real site: the password manager offers to fill in your details. You click a link in a message and land on hxxps://secure-banklogin-verify[.]com: the page looks identical, but the password manager offers nothing, because it has never seen this address.
That silence is the signal. Your eyes can be fooled by a logo; the password manager cannot.
The dangerous moment is the workaround. When autofill does not appear, the natural reaction is to open the vault, copy the password and paste it in. Stop and check the address first.
When autofill stays silent
- Look at the address bar. Is the domain exactly right? See lookalike domains.
- Close the tab and reach the site through a bookmark or by typing the address.
- If autofill works there, the first page was almost certainly fake.
- If you already typed the password in, follow entered your password on a phishing page.
Getting the most from it
- Save every login in the manager so silence always means something.
- Use unique passwords, so one phished password does not unlock others. See why password reuse is dangerous.
- Protect the manager itself with a strong master password and two-step verification.
New to this? Start with setting up a password manager.
Got a login link you are unsure about? Paste it into CyberWatch AI Scan for a free check.
For the full picture, see how to protect yourself from phishing.
Frequently asked questions
Why didn't my password manager fill in my password?
It may be a phishing site with a different address. It can also be a genuine site that changed its login address, so check carefully before copying the password in by hand.
Should I ever copy and paste a password manually?
Only after you have confirmed the site is genuine by typing its address yourself or using a bookmark.
Can a password manager be phished?
Its master password can be, so protect it with two-step verification and never enter it on a page reached from a link.
Sources
- Top tips for staying secure online, UK National Cyber Security Centre
- Use Strong Passwords, US Cybersecurity and Infrastructure Security Agency
- Recognize and Report Phishing, US Cybersecurity and Infrastructure Security Agency
