This guide is for the person who reuses the same three passwords everywhere and knows it is a bad idea: the parent juggling school portals and streaming logins, the small-business owner whose staff share a single password for the company social accounts, the retiree whose passwords live in a notebook by the computer. If one of those reused passwords leaks in a data breach, every account that shares it is exposed. A password manager is the most practical fix, and setting one up takes an evening.
What a password manager does
A password manager is an app that creates, stores and fills in passwords for you. You remember one strong master password, or unlock the app with your fingerprint or face, and it handles the rest. Your vault is encrypted, so the stored passwords are unreadable without the master password.
The US Cybersecurity and Infrastructure Security Agency recommends exactly this approach in its guidance on strong passwords. It advises creating long, random, unique passwords with a password manager, and says passwords should be at least 16 characters long. CISA also acknowledges the obvious problem: it is impossible to remember a unique strong password for every account. That is the job the manager takes over.
What it protects you from
- Password reuse. A unique password for every site means one breach stays contained.
- Weak passwords. The generator produces long, random strings nobody could guess.
- Phishing, partly. Most managers only fill passwords on the genuine website address. If the autofill does not appear on a login page, that is a warning sign the site may be fake.
- Lost notebooks and sticky notes. Your passwords are encrypted rather than written on paper.
What it does not protect you from
A password manager does not stop malware on an infected computer, and it cannot help if you hand over your master password to a scammer. Pair it with two-factor authentication and up-to-date software.
The types of password manager
| Type | Examples of where it lives | Good for | Limits |
|---|---|---|---|
| Built into your browser or phone | Browser password settings, phone keychain | Simplicity; already installed | Can be awkward across different brands of device |
| Dedicated app, cloud-synced | A standalone service with apps for every device | Families and mixed devices; sharing | Usually a subscription |
| Dedicated app, local only | An encrypted file on your own device | Maximum control | You manage syncing and backups yourself |
Built-in managers have improved a great deal and are a big step up from reusing passwords. If everyone in your household uses the same brand of phone and computer, they may be enough. If you mix brands, need to share passwords, or run a small team, a dedicated cross-platform manager is usually easier.
Features that matter
When comparing options, look for these.
Strong encryption and a clear security model
Reputable providers publish how their encryption works and commission independent security audits. Look for a statement that they cannot see your vault contents, often described as “zero-knowledge” design.
Apps for every device you use
Phone, tablet, laptop and every browser in your household. A manager that does not fill passwords on one of your devices will tempt you back into old habits.
Two-factor authentication on the vault
The vault itself should support two-factor authentication, ideally with an authenticator app, passkey or hardware key.
Sharing
Family plans let you share selected passwords, such as the streaming account or the Wi-Fi password, without sharing everything. Business plans let a team share logins with permissions and remove access when someone leaves.
Breach and weak-password alerts
Many managers flag reused, weak or exposed passwords. That report becomes your to-do list.
Passkey support
Passkeys are a newer login method that replaces passwords on supporting sites. A manager that can store and sync passkeys is better prepared for the next few years.
Emergency access
Some managers let you name a trusted person who can request access to your vault after a waiting period. This matters more than most people realise.
Remember one strong master password. Let the app remember the rest.
Choosing a master password
Your master password is the one password you must memorise, so make it long and memorable rather than short and complicated. A passphrase of four or five unrelated words, such as a random string of everyday words with spaces or hyphens, is easier to remember and type than a jumble of symbols, and its length makes it strong. CISA’s guidance of at least 16 characters is easy to exceed this way.
- Do not reuse it anywhere else
- Do not base it on personal details such as names, birthdays or addresses
- Write it down once, on paper, and keep it somewhere secure at home until you have memorised it
Setting it up in one evening
1. Install the app everywhere
Install the manager on your phone and computer, and add the browser extension to each browser you use.
2. Create the vault and turn on two-factor authentication
Set your master password, then immediately enable two-factor authentication for the vault. Save the recovery codes or recovery kit somewhere safe offline.
3. Import existing passwords
Most managers can import passwords saved in your browser. Do the import, then turn off the browser’s own password saving so you do not end up with two half-updated lists. Delete the exported file afterwards, because it is unencrypted.
4. Fix the important accounts first
Do not try to change every password tonight. Start with the accounts that unlock others:
- Main email
- Banking and payment apps
- Phone carrier account
- Cloud storage and photo accounts
- Work accounts and domain registrar, if you run a business
For each, log in, change the password to a new generated one, and let the manager save it.
5. Work through the rest over a few weeks
Each time you log in somewhere, let the manager replace the old password with a generated one. Within a month or two, most of your accounts will be updated without a dedicated session.
Sharing with family or a team
Families
Create a shared folder or vault for household accounts: utilities, streaming services, insurance portals, the Wi-Fi password. Keep personal accounts private. Teach children to use the manager as soon as they have their own accounts.
Small teams
Give each person their own account in a business plan, and share only the logins they need. When someone leaves, removing their access is one click, and you know exactly which shared passwords to change.
Planning for emergencies
If you were suddenly unavailable, could your partner or executor get into the household accounts? With a password manager, everything is in one place, which is good for them only if they can get in.
- Set up the manager’s emergency access feature if it has one
- Or store the master password and recovery kit in a sealed envelope with your will or important documents
- Tell one trusted person where to find it
Common worries, answered
“What if the password manager company is hacked?”
It is a fair question, and breaches of password manager companies have happened. This is why the security model matters. With a well-designed manager, your vault is encrypted on your device with a key derived from your master password, so stolen vault data is very hard to use without that password. A long, unique master passphrase and two-factor authentication on the vault are your protection. Keep an eye on the provider’s security announcements and change your master password if they advise it.
“Isn’t it putting all my eggs in one basket?”
In a sense, yes. But the alternative for most people is a handful of reused passwords, where one leaked password opens many accounts. A single strongly protected vault is a much smaller risk.
“What if I forget the master password?”
Most managers cannot reset it for you, by design. Use the recovery options the manager offers, keep the recovery kit offline, and practise typing the passphrase daily for the first few weeks.
Password manager checklist
- Manager chosen and installed on every device and browser
- Long master passphrase created and not reused anywhere
- Two-factor authentication on the vault
- Recovery kit stored offline
- Browser passwords imported, export file deleted, browser saving turned off
- Email, banking, phone carrier and cloud passwords changed
- Shared family or team folder set up
- Emergency access arranged
- Weak and reused password report reviewed monthly
Takeaway
A password manager turns CISA’s advice of long, random, unique passwords into something a normal person can follow. Choose one that works on all your devices, protect it with a strong passphrase and two-factor authentication, fix your most important accounts first, and plan for someone else to get in if they ever need to.
