Cyberpediaby Brain
ENDEFR

Enterprise password manager or browser manager

Enterprise password manager versus the browser's built-in one: what sets them apart, what employees do and the pitfalls to avoid.

In 30 seconds

Where it happens
Every time you log in to a work tool, when the browser offers "Save password".
What the attacker wants
To retrieve the credentials saved in the browser, then reuse them on other systems or accounts to extend their access3.
The reflex
Use only the manager provided by Brain for work passwords, turn on two-factor authentication and save nothing in the browser.
If it has already happened
Report the loss or theft of a device without delay, then follow the security team's instructions to change the passwords concerned.

What it is

A password manager is a database encrypted by a single "master" password1. It answers a common problem: an employee handles dozens of passwords, not only work ones, and many people reuse the same one or choose common ones, which attackers exploit2.

Two families of tools exist on the work side: the manager the company provides and administers, and the one built into the browser. They look alike on screen, but they do not protect in the same way, and the company does not have the same hold over them.

Straight answers

What is an enterprise password manager?

It is a manager whose use the organization controls. The UK's NCSC notes that some products offer centralized password management across the organization, and that these solutions usually cost money2. Credentials are stored in a vault accessible with a master password2. The administrator can set usage rules and see an overview of how passwords are used2.

How does it differ from the browser's manager?

The NCSC distinguishes between managers that are a standalone application and those built into the browser or the operating system2. CISA lists browser-built-in managers among free managers4. Centralized administration features (controlled sharing, logs, rules) are described by the NCSC for enterprise managers2. The NCSC also lists, among the choices open to an organization, allowing employees to save their passwords in browsers2: it is therefore up to Brain to set the rule, and Brain's rule is to use its tool.

Why avoid saving work passwords in the browser?

Browsers generally keep credentials in encrypted form in a dedicated store, but methods exist to extract the passwords in clear text3. On Windows, for example, Chrome's encrypted credentials can be read from a database file, then a system function decrypts them using the victim's cached login credentials3. Known malware, such as Agent Tesla, collects credentials from several browsers3. The CNIL adds that you should never save your passwords in the browser of a shared computer1.

Can an enterprise manager be attacked too?

Yes. The NCSC says so: a manager can have flaws, and it attracts attackers because a successful attack gives access to all the stored passwords2. It nonetheless judges that the benefits outweigh the risks2. The master password and two-factor authentication protect this single point of access.

What should you do if a device is lost or stolen?

Report it to the security team right away. The procedure is the one Brain indicates.

1How it works1 min

The vault is encrypted. According to the NCSC, the decryption key is generally derived from the master password, and it should be accessible to no one else, not even the service provider for managers synchronized in the cloud2. The CNIL describes the same principle: a database encrypted by a single "master" password, which lets you remember one password and have all the others very long and different1.

The NCSC lists other useful features:

  • autofill, which offers credentials only to the site they were saved for, and which can help against phishing because a manager detects fake sites better than a human does2;
  • generation of random, long and unique passwords2;
  • auditing of password quality, which flags a reused password, for example2.

For the company, centralization adds password sharing with an access log and control by an authorized person2. The NCSC does not recommend sharing between individuals, but accepts that some organizations cannot yet do without it; an enterprise manager then reduces the risks2. Administrators should not be able to see or use individual passwords outside a sharing group, and their access should be audited2.

2What you do1 min
  • Use the tool provided by Brain for all work passwords. The NCSC recommends that organizations provide a suitable means of storage, and recommends password managers where appropriate5.
  • Turn on two-factor authentication on the manager. With it, an attacker must know the master password and hold the second factor2. The CNIL also recommends two-factor authentication when the service offers it1.
  • Save no work password in the browser.
  • Let the tool generate the passwords. CISA advises long passwords (at least 16 characters), random and unique for each account4.
  • For the master password, choose a passphrase: CISA suggests a string of 4 to 7 unrelated words4.
  • Report any loss of a device.
3Pitfalls2 min

A weak master password

The whole vault depends on it. The NCSC warns that, if the user forgets it, they lose access to all their saved passwords, and that a recovery method can be exploited to access the credentials2. Choose a long phrase, remembered by heart and never written down in a file or on a sticky note. The CNIL lists sticky notes, text files, the smartphone and messaging among the media not designed to store passwords1.

Synchronization with a personal account

Some enterprise managers offer a personal vault for private accounts. The NCSC then asks for good separation: work passwords must not be accessible from the personal vault, and the reverse2. It notes that, if the company allows personal devices or personal accounts at work, the user does not always see which vault they are using2. Before turning on synchronization, check therefore that it does not mix the two.

Export in clear text

Some managers export all passwords to a text file. Once exported, whether by a legitimate user or by an attacker, the file is no longer protected2. Export the vault only if company rules allow it, and handle the file as that rule indicates.

Phishing that imitates a login page

Autofill helps here: the manager offers credentials only on the saved site2. If the tool offers nothing on a login page that should be a known one, that is a warning sign. Do not retype the password by hand on a suspicious page.

The vault as a target

The NCSC points out that managers, like any security software, are not infallible and are an attractive target5. It asks for multifactor authentication on all cloud-synchronized managers, and for privileged accounts2.

4Going further1 min

NIST revision 800-63-3, replaced since 1 August 2025, recommended that services allow pasting into password fields6. The CNIL describes the manager as a database of passwords encrypted by a single "master" password whose security has been verifiable1.

Fact sheet

Identifier
CP-346
Wing
5. Office life and reflexes
Brain skill
Mastering Passwords & MFA (master_passwords)
Brain reflex
cr-009
Diagram
G2 · Visual vs Technical Indicators
Languages
de, en, fr
Sources
6 sources checked on 3 November 2026
Sources6 sources
  1. CNIL, “Les conseils de la CNIL pour un bon mot de passe”, 26 January 2017. https://www.cnil.fr/fr/les-conseils-de-la-cnil-pour-un-bon-mot-de-passe (accessed 3 November 2026)
  2. NCSC (UK), “Password manager buyers guide”, 19 November 2018. https://www.ncsc.gov.uk/collection/passwords/password-manager-buyers-guide (accessed 3 November 2026)
  3. MITRE ATT&CK, “Credentials from Password Stores: Credentials from Web Browsers, Sub-technique T1555.003 - Enterprise | MITRE ATT&CK®”, 12 February 2020. https://attack.mitre.org/techniques/T1555/003/ (accessed 3 November 2026)
  4. CISA, “Use Strong Passwords | CISA”. https://www.cisa.gov/secure-our-world/use-strong-passwords (accessed 3 November 2026)
  5. NCSC (UK), “Password policy: updating your approach”, 19 November 2018. https://www.ncsc.gov.uk/collection/passwords/updating-your-approach (accessed 3 November 2026)
  6. NIST, “NIST Special Publication 800-63B”. https://pages.nist.gov/800-63-3/sp800-63b.html (accessed 3 November 2026)

Cite this article

Brain, “Enterprise password manager or browser manager”, Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/enterprise-password-manager-vs-browser/

BibTeX 
@misc{brain_cp346_en_2026,
  author = {Brain},
  title = {Enterprise password manager or browser manager},
  year = {2026},
  howpublished = {Cyberpedia},
  url = {https://startbrain.io/cyberpedia/en/articles/enterprise-password-manager-vs-browser/},
  note = {CC BY 4.0}
}
CC BY 4.0 licence