Password manager basics sound like a weekend project, and that is exactly why many people never begin. Here is the good news: you do not have to move every login you own. You need one strong passphrase, your five most important accounts, and about 20 minutes.
A password manager is a locked notebook that fills in the blanks
A password manager keeps your logins in an encrypted vault, which means the contents are scrambled and unreadable without the key. It does three jobs:
- Stores your usernames and passwords in one place.
- Creates long, random passwords so you don't have to invent them.
- Fills them in on the right websites, and usually only the right ones. If you land on a lookalike fake site, the manager typically won't offer your login, which is a quiet bonus.
The real reason to bother is reuse. When one website leaks its passwords, attackers often try the same email and password on other places: your email, your bank, your shopping accounts. Reusing a password turns one leak into several break-ins. A manager makes a different password for every site painless, because you never have to remember them.
There is a fair worry here: isn't putting everything in one place risky? It's a reasonable question. The vault is encrypted, and only your master password opens it. For most people, that is a much better position than the same few passwords scattered across dozens of sites. But no tool is a guarantee. If someone learns your master passphrase, or your device is infected with malware, the vault can be exposed. That is why the setup steps below include a second check.
Pick one that fits how you already use your devices
You don't need a feature checklist as long as a contract. Look for these:
- It works on your phone and your computer, and fills in logins on both.
- It has a clear way to recover your account if something goes wrong.
- It is updated regularly and has been independently reviewed, meaning outside security experts have examined it.
Built-in options are the ones inside your phone or browser. They are the easiest start, since there is nothing new to install. If you stay within one brand of phone and one browser, they are a reasonable choice, and I would take one over doing nothing. They can get awkward if you switch between device types or want to share logins.
Standalone apps work across nearly everything and tend to handle sharing better. The cost is one more app to learn. My view: if your devices are a mix, or you want to share with family, choose a standalone app. If you live in one ecosystem and want the least friction, the built-in one is fine.
A free tier can be enough for one person. Features and limits change, so check the current plans yourself rather than trusting an old list.
Set it up in 20 minutes by starting with five accounts
- Install it on your phone and your computer.
- Create your master passphrase. Choose three or four unrelated words you can remember, such as lantern pickle orbit canyon (make your own; don't use that one). Never use it anywhere else. Write it down once on paper and keep it somewhere safe at home.
- Turn on two-factor authentication for the vault. That is a second check, like a code from an authenticator app, on top of your password. It means a stolen passphrase alone isn't enough.
- Replace five passwords. Start with your email, your bank, your phone account, your main shopping site and your social media. For each one, open its change-password page, let the manager generate a new password, and save it. Do email first, since password resets for other accounts usually land there.
- Add as you go. Each time you log in somewhere new, let the manager save or update the login. Over a few weeks, the vault fills itself with the accounts you actually use.
That is the whole start. Nothing else is due today.
Keep it working: recovery, sharing and what to do when you slip
Set up recovery now, while things are calm. Many managers can't reset your master passphrase, precisely because they never know it. Depending on the service, you may get a recovery key or recovery codes instead. Read what yours offers, and store any key on paper alongside your written passphrase.
For family, use a shared vault or folder for things like streaming accounts, rather than texting passwords around. Texts sit in message history for years, and a shared folder can be updated in one place.
And if you slip? Say you reuse an old password on a forgotten forum. That is fine. Protect the important accounts first and improve over time. When an old login surprises you, let the manager update it.
Here is your next step: pick your manager today, write down your passphrase, and change your email password before you close the app. The other four can wait until tomorrow.