A password manager is the single highest-return security change most people can make. It's more effective than antivirus, more effective than any setting you can toggle, and it takes an afternoon.
The reason it matters is arithmetic. You have well over a hundred accounts. You cannot remember a hundred strong unique passwords, so you reuse them. When any one of those services is breached — and services are breached constantly — attackers take the leaked email-and-password pairs and try them everywhere else. That technique works because reuse is nearly universal.
A password manager makes every password unique, so one breach stays one breach.
How they work
The manager stores your credentials in an encrypted vault. You unlock the vault with one master password. Everything else is generated, stored, and filled in for you.
The encryption is done on your device, before anything is sent anywhere. In a properly designed manager, the provider stores an encrypted blob they cannot read — they don't have your master password and can't derive it.
The consequence: if you forget your master password, nobody can recover your vault. Not the company, not support. This is a feature, and it's also the thing that requires planning, covered below.
Choosing one
The differences between reputable options matter less than actually using one. Things worth checking:
Independently audited. Reputable managers commission and publish security audits. Look for recent ones.
Works everywhere you are. Browser extensions for your browsers, apps for your phone and computer. If it doesn't fill passwords on your phone, you'll work around it, and workarounds defeat the purpose.
Sync across devices, encrypted end to end.
Emergency access or a documented recovery process, so someone you trust can reach your accounts if something happens to you.
A sensible business model. Free tiers are common and fine; understand whether the free version does what you need across all your devices, since that's a frequent limitation.
Open source is a genuine plus but not a requirement. Audited closed-source managers are widely used and well regarded.
Built-in options — the password managers included in operating systems and browsers — are much better than they used to be and are a legitimate choice, particularly if you live entirely in one ecosystem. Their weakness is cross-platform use and sharing. If you use a mix of devices, a dedicated manager is easier.
Self-hosted options exist for people who want the vault on their own hardware. Real benefits, and you become responsible for its backup and availability.
Setting it up
The master password
This is the one password you'll memorize, and it protects everything.
Use a passphrase, not a complicated short password. Four or five random words — genuinely random, not a phrase from anywhere — is both stronger and far easier to remember than a short string of symbols. Something like harbour-stapler-quiet-mandolin.
The words must be random. Chosen words follow patterns; a phrase from a book is in the attacker's dictionary. Some managers will generate a passphrase for you, or you can roll dice against a word list.
Never reuse it anywhere. This password exists for one purpose.
Write it down and store it physically. This is contrary to decades of advice and it's correct here. The realistic threat to your master password is that you forget it, not that a burglar searches your home for it. Write it on paper and store it somewhere secure — a safe, a locked drawer, with important documents.
The emergency kit
Most managers give you a recovery key or emergency kit at setup. Print it. Store it with the master password.
Without this, a forgotten master password means a permanently inaccessible vault. People do this to themselves regularly.
Two-factor on the vault
Turn it on. The vault is the highest-value target you own.
Use an authenticator app or a hardware key. And note the circular problem: if your authenticator codes are inside the password manager and the manager requires a code to open, you've locked yourself out of both. Keep the manager's own two-factor separate from the vault — a hardware key, or an authenticator app whose recovery codes are stored physically.
Migrating: the realistic plan
Don't try to change 200 passwords in one sitting. You'll stop after twenty.
Step 1: Import what's saved in your browser. Every manager can import from browsers. This takes five minutes and captures most of your accounts immediately. They'll be weak and reused, and they'll be inventoried, which is the first step.
Step 2: Run the security audit. Every manager has one. It shows reused passwords, weak passwords, and credentials that have appeared in known breaches. This gives you a prioritized list.
Step 3: Fix the critical ten first. In this order:
- Your primary email — everything else resets through it
- Your password manager (already done)
- Banking and financial accounts
- Your phone and computer accounts
- Cloud storage
- Anything with your payment details saved
- Social media
- Work accounts
- Anything holding personal data about others
- Your domain registrar, if you own domains
Email first, always. Whoever controls your email controls everything reachable by password reset.
Step 4: Change the rest as you go. Don't schedule it. Each time you log into a site over the coming months, change the password then. Within a few months the important ones are all done, and the dormant accounts don't matter much.
Step 5: Delete accounts you don't use. Migration is when you find out how many you have. An account you don't need is a breach you don't need.
Using it properly
Let it generate passwords. Don't type your own. Twenty characters, all character types, unique per site. You'll never see them and never need to.
Store more than passwords. Software licence keys, wifi passwords, passport numbers, insurance policy references, account numbers, secure notes. Anything you currently keep in a document called passwords.docx — which is the thing this replaces.
Use the sharing feature for household or business credentials, rather than sending passwords in messages. Shared credentials can be revoked and rotated centrally.
Check the audit quarterly. New breaches surface; the manager will tell you which of your accounts appeared in them.
Don't email or message passwords. Ever. They persist in searchable archives for years.
The objections
"What if the company is breached?" Vaults are encrypted with keys the company doesn't hold. A breach exposes encrypted blobs. This has happened, and the practical exposure depended on individual master password strength — which is why the passphrase advice matters. Even in that scenario, you're better off than with reused passwords everywhere.
"What if I'm locked out?" This is the real risk, and it's why the written master password and printed recovery kit exist. Handle it at setup.
"I have a system in my head." Password systems based on a pattern plus the site name are broken by anyone who obtains two of your passwords. They feel unique and aren't.
"It's one point of failure." It's a concentrated point of failure with strong protection, replacing a hundred weak points. That's a trade worth making, and the concentration is why the vault gets two-factor and a strong master password.
Emergency access
Set this up while you're thinking about it.
Most managers offer emergency access: a trusted person can request access, and if you don't decline within a set period, they receive it. Configure it for a partner, a family member, or a business co-owner.
Where that isn't available, put the master password and recovery kit in a sealed envelope with your important documents, and tell one person where to find it.
This matters more than it seems. Increasingly, everything a family needs after a death or incapacity — accounts, subscriptions, documents, photos, the business — sits behind one vault. Without a plan, that vault is a locked door with no key.
The one-hour version
- Choose a manager and install it everywhere
- Create a four-word random passphrase; write it on paper
- Print the recovery kit; store both together somewhere secure
- Turn on two-factor for the vault
- Import from your browser
- Run the audit
- Change your email password first, then the critical ten
- Set up emergency access
- Change the rest opportunistically over the coming months
Step 7 is the one that matters most. If you get an hour in and stop, having a unique strong password on your email account is already most of the benefit.
Next in this series: Two-Factor Authentication Explained, and Which Type Is Safest