02 · Accounts
Set up a password manager
One strong password to remember. Different ones everywhere else, without effort.
Why it matters
Reusing a password lets a breach at one website put other accounts at risk. A password manager makes a different password for each account and stores it for you. You remember how to unlock the manager instead of memorizing every login.
You do not need to move everything today. Start with the manager itself, your email, and one other important account.
The steps
Choose one that works on your devices
- If you use an iPhone, start with Apple Passwords. Open the built-in Passwords app on iOS 18 or later. If you also use a Mac or iPad, you can keep saved passwords in sync with iCloud Keychain. Apple Passwords setup guide
- If you use Android or want another option on iPhone, try Bitwarden. Install Bitwarden Password Manager from your phone's official app store. It's a good fit if you use both Android and Apple devices. Bitwarden mobile setup guide
Choose one as your main password manager and use its setup guide to enable autofill. Start with one login so you can check that saving and filling work before moving more passwords.
Protect the way into it
Set up the screen lock on your device. If the manager needs a master password, make it long and unique: aim for at least 16 characters, such as a randomly generated multiword passphrase. Do not use a quotation, personal facts, or a password from another account.
Enable two-step sign-in if the manager offers it. If it uses your device or browser account instead of a separate master password, protect that account and check its recovery settings too.
Write your recovery plan before adding passwords
Read the manager's instructions for losing a device or forgetting its password. Some managers cannot recover a forgotten master password.
Keep its account address, master password if needed, and any recovery key or emergency kit in a private physical place. Store any codes needed to recover the manager outside the manager too. The only way into your vault must not be locked inside that vault.
Add your email and replace a reused password
Open your email account directly and find its change-password screen. Let the manager generate a new, unique password; use at least 16 characters when the account permits it. Save the correct username, website address and new password in the manager, then complete the change on the email account.
Keep your working email session open. In a private window, test signing in through the real website using the saved entry. Finish the extra sign-in check from guide 01. Correct the saved entry if the test fails.
Do one more account, then stop
Repeat with a financial account or another account you would hate to lose. Check that the manager saves the new password and the next sign-in works. Follow the account's own limits if it rejects the generated password.
Move the rest gradually, prioritizing reused passwords and sensitive accounts. For work accounts, use your employer's approved process rather than copying them into a personal vault.
A password export may be a readable list of your secrets
You do not need an export to start. If you later import passwords from another tool, follow its official instructions on your own device. Keep any export out of email and shared folders; after checking the import, remove the export from the device and its trash. Copies may remain in backups or synced folders, so avoid creating one unnecessarily.
Everyday use
Let the manager fill the login on the correct website. If it unexpectedly refuses to fill, check the address before copying a password into the page. Autofill is useful, but it is not a guarantee that every page is safe.
Keep the manager, browser and device updated. Lock the device when you leave it. Keep account recovery details current.
Common questions
Isn't putting passwords in one place risky?
The vault is an important target, which is why its unlock method, recovery plan and device security matter. A manager helps avoid the widespread problem of weak or reused passwords. It does not make an infected or unlocked device safe.
Can I keep authenticator codes in the same manager?
Some managers support this. It is convenient, but someone who unlocks the vault may get both the password and the code. For your primary email and the manager itself, prefer a separate supported sign-in method. Keep the manager's own recovery codes outside it.
You're done when
Your recovery plan is stored safely, your email has a unique saved password, and you have tested signing in to two accounts. You can finish moving the rest later.
Sources and review
Source check: November 6, 2026. The 16-character target and staged setup are this guide's practical recommendations; follow each account's supported settings.
Do next
03 · Freeze your credit