How to start with a password manager

Most people keep their passwords in their head, in a notebook, or in the habit of reusing the same one everywhere. A password manager replaces all of that with a single encrypted vault. You remember one strong password, and the manager remembers every other one, generating long random logins you never have to type. It sounds like a big change, but the setup is short and you can move your accounts across at your own pace.

What a password manager really is

A password manager is an encrypted vault for your logins. Everything you store, usernames, passwords and security notes, is scrambled so that only someone with your master password can read it. Good managers encrypt and decrypt on your own device, so the company storing your vault cannot see inside it, and the vault syncs across your phone, laptop and browser. The trade-off is that the security of everything inside rests on the one password you choose.

Reused passwords are the real risk

The problem a password manager solves is repeated passwords more than weak ones. When a company suffers a breach, the leaked email and password pairs get tried automatically against other sites. If you reused one password on your email, your bank and a forum that got breached, one leak can open all three. Making every login different keeps a breach on one site contained there, which is the whole point.

Choosing a master password you will not lose

Your master password is the one key to the whole vault, so it needs to be both strong and memorable, because in most designs no one can reset it for you. A passphrase works well: four or five unrelated words with a bit of punctuation make something long enough to resist guessing yet easy to recall. Avoid names, birthdays and anything a stranger could find, and make it unlike any password you have used elsewhere. Losing it is the one mistake that is hard to undo, and many managers cannot recover it by design, so plan for that now: write it on paper and store it safely, or set up whatever recovery option your manager offers before you rely on the vault.

• Prefer a long passphrase of several unrelated words over a short, complicated string.
• Do not reuse a password from anywhere else for the master password.
• Keep a paper copy somewhere secure, separate from your devices.
• Decide on recovery before you fill the vault, not after you are locked out.

Turn on two-factor authentication

Two-factor authentication, often shown as 2FA, adds a second check beyond your master password when you sign in to the vault. Even if someone learned your master password, they would still need the second factor, usually a code from an app on your phone or a physical security key. Turn this on for the password manager first, since it guards all the others, then keep your recovery codes somewhere safe so a lost phone does not lock you out.

Setting it up step by step

1. 1

   Create the vault and set the master password

   Install the manager, create your account, and set your master passphrase, typing it a few times so it sticks in memory.

2. 2

   Switch on two-factor and save recovery codes

   Enable two-factor authentication on the vault, then store the recovery codes somewhere safe, away from the device that holds the app.

3. 3

   Bring your logins in gradually

   Import saved passwords from your browser if the manager offers it, or add accounts one at a time as you sign in over the coming days.

4. 4

   Replace weak and reused passwords

   Use the built-in generator to create a long, unique password for each account, starting with email and banking, and let the manager save each new one.

5. 5

   Set up autofill on browser and phone

   Install the browser extension and phone app, then allow the manager to fill logins automatically. From here, signing in means approving a prompt rather than typing.

Browser built-in or a dedicated app?

Most web browsers now offer to save and fill passwords for free, which is a real improvement over reusing one password everywhere. But a browser manager ties your vault to that browser and its account, so moving to another browser or sharing logins with a desktop app can be awkward. Dedicated managers tend to work the same across every browser and device and handle more types of items, such as notes and cards. A browser manager is a fine place to begin; a dedicated app is the usual next step when you want your passwords to follow you everywhere.

A password manager turns dozens of risky, repeated passwords into one strong key and a vault of unique ones. Set a passphrase you will not lose, turn on two-factor, move your accounts over a few at a time, and let autofill do the typing.