# You were never going to remember all those passwords

> A 1952 psychology experiment explains why every "use a unique password for every site" lecture was doomed, and why a password manager is less a security upgrade than a resignation letter from a job you couldn't do.

- Canonical URL: https://shielda.ai/blog/password-managers-real-talk/
- Published: 2026-06-24
- Author: Vasyl
- Reading time: 7 min read
- Tags: Password Managers, Passkeys, MFA
- Cover image: https://shielda.ai/blog/covers/password-managers-real-talk.webp

In 1952 a psychologist named William Edmund Hick sat people in front of a row of lights, each wired to its own button. A light blinks, you slap its button, he times you. Then he adds more lights. Then more. It is the world's most boring arcade game, about to teach him something.

The result is now called Hick's Law. The more options you give a person, the longer they take to choose, and the curve isn't a straight climb. It's logarithmic: the brain doesn't check choices one at a time, it cuts the pile in half, then in half again, like a bouncer who alphabetized the guest list so he'd never read past one letter.

Hick was measuring one decision. One light, one button, go. Now hold that against what we ask a person to do with passwords: invent a unique one for every site, across two hundred sites, and recall which goes where, on demand, forever, with no notes. Hick would have taken one look and asked for a bigger building.

So when people don't do it, that's not a character flaw, it's the experiment running as designed. Last week I went after the password policy that turns Summer2024 into Autumn2024 every ninety days, the office version of paying a bounty per rat tail. I said I'd come back with what helps. It was never going to be discipline. You can't out-discipline arithmetic.

## The person using one password everywhere is not an idiot

I've watched this happen to people who are not idiots. Someone picks one password, a good one, long, a couple of numbers, a bit of punctuation they're quietly proud of, and uses it everywhere, because remembering one strong password feels responsible and remembering two hundred feels deranged. On that second point they're right. Then a site they'd forgotten they ever joined gets breached, and that one responsible password lands in a file traded around the internet, stapled to their email. That's the whole attack. It's called credential stuffing: a robot with a list, trying a dead-forum password against a bank login, because statistically, why wouldn't they match.

So reuse isn't laziness. It's a person doing what Hick predicted, folding too many choices down to the one a brain can hold. The mistake was never theirs. It was ours, for handing a person a job that belongs to a machine.

## What the machine actually does

A password manager is that machine, and far more boring than the marketing wants. It makes a long random password for each site, so you never invent one again, and remembers all of them, so you learn a single master password and it hauls the other two hundred, never tired, never reused. As a bonus, a good one only autofills on the exact address it saved a login for. So when you land on paypa1.com, with a number where the L should be, it just refuses, because it doesn't recognize the address. Its silence is the warning your eyes missed at 7am.

## Use Bitwarden. Here are the two times I wouldn't.

Bitwarden's free tier is the rare one that's free and not a thirty-day hostage drama. Unlimited passwords, unlimited devices, no countdown to a paywall. It's open source, so the encryption isn't a promise on a marketing page, it's code strangers have spent years trying to break and mostly couldn't. The paid tier is about twenty dollars a year, doubled in January after a decade of sitting still, announced with the warmth of a software company sending an email. Still twenty bucks. You'll cope.

First time I'd say otherwise: you want it to feel nice and you'll pay for nice. That's 1Password. You're buying polish, but also one real piece of engineering: your vault needs your master password plus a second random key that only lives on your own devices. Empty 1Password's servers and a weak master password still won't open the vault, because the second half of the lock was never there to take.

Second time: basically never, but if you're going to ignore me and use the one baked into Chrome, fine, it beats reusing a password. Most browser managers unlock the moment you're logged into your computer, so any program running as you can read the whole pile without asking. That isn't hypothetical, it's a product line: malware like RedLine and Lumma exists to wander into a browser and leave with every saved login. Apple's version is the honorable exception if you live entirely inside Apple, since it's properly end-to-end encrypted. Own one Android phone and one Windows laptop and it gets sad fast.

Here's my one Shielda line, then we move on. All of that fixes the passwords in your head, and you can do it yourself, today, for nothing. What it doesn't touch is the other kind of credential, the cloud keys and API tokens your code runs on, pasted into a repo because it was 2am and it worked. That surface is what Shielda watches. Different problem, harder to see, its own post. Do the password manager first.

## The one real objection, and its evil twin

There's one fair complaint: a manager puts every egg in one basket. Correct. But it swaps the job from "protect two hundred things badly" to "protect one thing well," and one thing is a job a human can finish. Make the master password long, a sentence beats a scramble, and put a second factor on the vault, so a leak still doesn't open it alone.

We got to watch the basket get stress-tested. In 2022 someone walked off with encrypted vault backups from LastPass, and the encryption held. The people who got hurt had master passwords weak enough to grind through, which is the whole lesson in a line: the master password is the only password left, so make it a wall. Then this year, attackers slipped into Bitwarden's command-line tool through the npm registry, the supply-chain trick I keep going on about. They got the plumbing and zero vaults, because Bitwarden can't read your vault either.

The basket has an evil twin worth naming: single sign-on. A manager gives every site its own password and keeps the keys on your machine. "Log in with Google" everywhere does the reverse, handing every site the same identity, with no separate password to fall back on. A stolen vault is recoverable. A stolen Google or Okta login is a stranger already inside everything at once. The convenience is real, and so is quietly giving one company the master key to your whole life.

## Where this goes sideways

- Using the browser for the accounts that actually matter. Email, banking, your cloud root, your code host go in a real manager. The browser can keep the forum you'll abandon by August.
- Leaving the old copies behind. After you import, clear the passwords back out of the browser, or you've bought a safe and left the cash on the counter beside it.
- Treating "I installed it" as "I'm done." A manager only protects the accounts you actually move into it. The login still on a sticky note is still on a sticky note.

## One thing worth keeping

Forget the brand names and keep this. A password manager doesn't make you more disciplined. It lifts a job your brain was never built for and hands it to something that does it without sighing. That's also how you spot security advice worth trusting: if the plan needs a tired human to stay vigilant forever, it loses. If it works while that human sleeps, it wins. So pick one this afternoon, move the accounts that matter, let it generate the rest, and lock it with one long master password and a second factor. Passwords are sliding toward passkeys anyway, which can't be phished or reused, and every manager here already syncs them, so today's choice carries you into what's next too.

One last thing. Hick spent a career measuring how long a person takes to choose. The joke he never got to hear is that for passwords, the winning move is to stop choosing and let the machine do it. Two hundred decisions, gone. Even the rats would approve.