Can a password manager protect me from phishing?
Short answer
Partly, and quietly. A password manager fills your login only on the domain where you saved it, so on a lookalike page it stays silent. Treat "why isn't it filling?" as a warning, not a glitch to work around by typing the password yourself.
How it works
A password manager matches saved logins to the site's domain. A pixel-perfect copy on another domain doesn't match, so nothing is offered. Unlike a person, it isn't swayed by a logo.
The habit that makes it work
When it doesn't offer to fill on a page that should be familiar, stop. Look at the domain and at how you got there before typing anything by hand. Typing over its silence is how this protection gets defeated.
Other ways it helps
Unique passwords per site mean one phished password opens one account, not five.
Where it doesn't help
- Some services legitimately use more than one domain, so a no-fill is a prompt to check, not proof of a fake.
- It doesn't stop you approving an MFA prompt or typing a card number into a fake page.
- It can't help if you type your password into a drawn browser-in-the-browser window yourself.