I'd describe myself as an average tech savvy computer user. I have many accounts in forums, shopping sites, etc where I recycle two moderately strong password with small variation. These are account where I don't care if anybody gains access to them and that's why I have them saved in the browser's password manager. For example, I don't care if somebody gains access to my Alfa Romeo forum account or my Deal Extreme account because they can't do me any harm.

Now for my internet banking and main email, it's a different story. I use a strong password for my internet banking which I DON'T recycle and don't have it saved in my browser password managers. For banking transactions I use a hardware token. For my gmail I use a two-step verification with another strong password. To me that sounds like a secure enough method where I'm keeping what's important safe and at the same time I'm not clogging my mind with too many passwords or worrying about what the latest security breach in my password manager would be.

Thanks!

Yes.

The average user should use long random passwords for every site. Passwords should not be repeated, passwords should not follow a discernible pattern. The compromise of any one password (e.g. your Adobe or LinkedIn login) must not be allowed to make it any easier for the attacker to guess your other passwords. These requirements make remembering passwords very nearly impossible. But that's not the primary reason why you should use a password manager.

The primary reason is that it reliably protects you against phishing attacks. A browser-integrated password manager will only fill in a site-specific password if you're actually visiting the correct site. So you won't accidentally type in your Paypal.com password into www.paypal.com.us.cgi-bin.webscr.xzy.ru. This is doubly true for average users, who on the average, rely on the general familiarity of a site to determine whether or not its legitimate (a terribly ineffective heuristic). Since you don't know your password, you can't type it in. Instead, it will only auto-fill if you're at the authentic site.

Use a browser-integrated password manager, don't get phished. It literally is that simple. Phishing is far more prevalent and serious a threat than password disclosure, anyway.
