How to Set Up a Password Manager (Without Locking Yourself Out)
A password manager is the single biggest security upgrade most people can make in one evening. It remembers a different strong password for every site, fills them in for you, and quietly refuses to fill them on fake sites. Here's how to pick one, set it up, and move your passwords in without locking yourself out.
Steven's old system was one password, with a different number on the end for each site. That's not a system, Steven. That's one password. — Nyx
Why it matters: when a site gets breached, attackers try the leaked email and password on every other popular site. If you reuse passwords, one breach opens many doors. A password manager makes "a different password everywhere" effortless, which is the thing that actually stops this. (Why length matters is covered in strong passwords and passphrases; this page is the setup.)
Step 1: pick one (any of these is fine)
The best password manager is the one you'll actually use. All of these are reputable:
- The one already on your device: Google Password Manager (Chrome and Android) or Apple's Passwords app and iCloud Keychain (iPhone, iPad, Mac). Free and already built in. Great if you live mostly in one ecosystem.
- Bitwarden: free plan covers unlimited passwords on all your devices, and it's open source. A good pick if you mix Windows, Android and iPhone.
- 1Password: paid, very polished, with strong family sharing.
- KeePassXC: free and fully offline. Your passwords live in one encrypted file that you look after yourself. For tinkerers who want no cloud at all.
Pick one. Two managers fighting to save the same passwords is how people end up with old passwords in one and new ones in the other.
Step 2: make one great master passphrase
This is the only password you'll still remember. Make it long: four or five random words beats a short complicated one. It must be unique (used nowhere else) because it protects everything.
- Write it down on paper and keep it somewhere safe at home. Not in a note on your phone, not in an email to yourself.
- If your manager offers a recovery kit or emergency sheet, print or save it and keep it with that paper.
Most good managers are built so the company itself can't read your vault or reset your master passphrase. That's good for security, and it means losing it can lock you out for good. That's why the paper copy matters.
Step 3: lock the manager with two-step sign-in
Turn on two-step sign-in (MFA) for the password manager account itself, using an authenticator app if you can. Now a stolen master passphrase on its own isn't enough to get in. Save the backup codes it gives you with your paper copy.
Step 4: install it everywhere you sign in
- Install the app on your phone and turn on autofill. On iPhone that's in Settings under passwords and AutoFill; on Android it's under autofill service in Settings. The app walks you through it.
- Install the browser extension on your computer (skip this if you're using your browser's built-in manager).
- Sign in to the same account on each so everything syncs.
Step 5: bring your existing passwords in
Most managers can import the passwords your browser has already saved. Look for an Import option in the manager. Some do it directly; others ask for an export file from your browser.
If you export a file: it's every password you own in plain text. Import it straight away, then delete the file and empty the Recycle Bin or Trash. Don't email it, don't put it in cloud storage.
Once everything is in, switch off "offer to save passwords" in your browser so you're not saving into two places.
Step 6: fix the important ones first
You don't have to change every password tonight. Work through them in this order, letting the manager generate a new random password each time:
- Email first. Your email can reset every other account, so it's the master key.
- Banking and payments next.
- Anything the manager flags as reused or found in a breach. Most managers have a health or security check page that lists these.
- Everything else, whenever you next sign in to it.
"Isn't it risky putting all my passwords in one place?"
Fair question. Password managers can be attacked too. The big public example is LastPass, which disclosed in 2022 that copies of customers' encrypted vaults had been stolen. Vaults protected by a long, unique master password were far safer than ones with short or reused ones.
So the risk is real but manageable: a long unique master passphrase plus two-step sign-in. Compare that with the alternative, reusing a handful of passwords that are probably already in someone's breach list. One well-locked vault beats dozens of weak locks.
The bonus: it spots fake sites for you
Your manager fills a password only on the exact site it was saved for. If you land on a convincing fake login page and the manager offers nothing, that silence is a warning. Don't type the password in by hand. More on reading links in is this link safe?
The one-minute version
- Pick one manager: built-in, Bitwarden, 1Password or KeePassXC.
- One long, unique master passphrase, written on paper at home.
- Turn on two-step sign-in for the manager itself.
- Install on phone and computer, import, then delete any export file.
- Change email first, then banking, then anything flagged.
- If it won't autofill, check the address before you type.
One password to remember, and it's actually a good one. Revolutionary, Steven. — Nyx
Do the setup tonight and the email change tomorrow. Twenty minutes, and you're safer than most of the internet. — Nova