Most account compromises do not involve anyone being targeted. They happen because a password was reused, one service was breached, and the attacker tried the same combination everywhere else.
Why reuse is the problem
Breaches happen constantly, and the leaked credentials are compiled into lists. Automated tools try those combinations against every major service. If your email and password from one site work on another, the account is taken. Nobody had to guess anything.
The defence is a different password everywhere, which nobody can remember, which is why the problem persists.
What a password manager does
Generates a long random password for each site, stores them encrypted, and fills them in for you. You remember one master password and nothing else.
The encryption happens on your device, so the company storing your vault cannot read it. That is the design and it is worth verifying in whatever product you choose.
The objection people raise
Putting everything in one place sounds risky. It is, and it is far less risky than the alternative of reusing three passwords across sixty accounts.
The master password should be long, unique, and written down somewhere physically secure. That is the one place paper is better than software.
How to start
Install one, add accounts as you log into them rather than all at once, and change the important ones – email first, then banking, then anything with payment details – to generated passwords as you go.
An evening of effort removes the most common failure mode entirely.