Custom profiles versus permission sets
Key Takeaway
Default settings such as page layout assignments and login hours belong in the profile. Extra access goes in permission sets, which you can assign to users regardless of their profiles.
Profiles and permission sets both control what a user can do in Salesforce, such as which objects, fields, and features they can use. Every user has exactly one profile, which sets default settings and baseline access. A permission set is an optional add-on: a collection of settings and permissions that extends a user's access without changing their profile.
Access adds up
You assign each user's profile when you create the user, and you can assign the same profile to many users. A user can also have many permission sets, depending on the edition. You can assign permission sets to users regardless of their profiles, so users on different profiles can share the same permission set.
A user's access adds up across their profile and permission sets. If a permission is off in the profile but on in one of the user's permission sets, the user has it.
For example, imagine a user whose profile lacks the "Manage Password Policies" permission. That user can still manage password policies if one of their permission sets grants it.