How to choose and start using a password manager
A password manager stores your logins in one encrypted vault, locked behind a single master password, and fills them in for you when you visit a site or app. The point isn't convenience for its own sake — it's what convenience makes possible: a different, long, random password for every account, instead of the same one or two you can actually remember. This guide covers picking one and getting your first passwords into it.
What you'll need: The devices you sign into things on — phone, laptop, tablet — and a few minutes on each to install the app or extension. No existing password manager required to start.
Understand what it replaces
Right now, your passwords probably live in one of three places: memory, a browser's built-in save-password prompt, or a notebook. A password manager replaces all three with a single encrypted vault. You unlock the vault once, with a master password, and it handles the rest — generating new passwords when you sign up for something, and filling in existing ones when you sign in.
Decide between built-in and standalone
Apple, Google, and Microsoft each build a password manager into their platforms already — iCloud Keychain on Apple devices, Google Password Manager in Chrome and Android, Windows Hello and Microsoft Edge's own manager on Windows. These cost nothing extra and need no separate install. A standalone manager — such as Bitwarden, 1Password, or Dashlane — works the same way but independently of any one company's ecosystem, which matters if you move between an iPhone and a Windows laptop, or want your vault to work the same way regardless of which browser you're using.
Pick one and create your account
If you're going built-in, there's no separate sign-up — it's already tied to your Apple ID, Google Account, or Microsoft account. For a standalone manager, go to the provider's website and create an account, which means setting a master password. This is the one password you'll need to remember yourself, so make it long — a short phrase of unrelated words works better than a short string of substituted characters — and don't reuse a password from anywhere else for it.
Install it everywhere you sign in
Add the browser extension to each browser you use, and install the mobile app on your phone. A password manager only helps on the devices it's actually running on — if you sign into email on both a laptop and a phone, it needs to be on both.
Bring in your existing passwords
Most browsers can export saved passwords as a file, and most password managers can import that same file directly into your new vault — the option is usually under a menu called Import or Import passwords in the manager's settings. This moves what you already have in one go, rather than re-entering everything by hand.
Turn on autofill
In the manager's settings, look for an Autofill option and turn it on for your browser and, on a phone, for the operating system itself (usually under the device's own password or autofill settings, pointing at the app you've installed rather than the built-in one). This is what lets the manager fill in a saved login when you tap or click a password field, instead of you copying and pasting it.
Protect the vault itself
Turn on two-factor authentication on the password manager account, if it offers it. The vault holds every other password you own, which makes it worth protecting at least as well as any individual account inside it.
Work through weak and reused passwords
Most managers include a built-in check — often called something like Security, Watchtower, or Password Health — that flags passwords you've reused across more than one account, or ones that are short or otherwise weak. Open it and start with the accounts it flags as reused, since those are the ones where one leaked password exposes more than one account. Replace each with a new, generated password as you go, rather than trying to do all of them in one sitting.
Variations
Most standalone managers offer a family or shared plan, letting you share specific logins — a streaming account, a shared email — with someone else without either of you seeing the other's entire vault. Look for a Sharing or Family option rather than sending a password directly by text or email.
A growing number of sites now offer passkeys — a sign-in method tied to your device's fingerprint, face scan, or PIN, with no password to type or steal at all. Where a site offers one, most password managers can store and use it the same way they store a password, so it's worth accepting a passkey when a site offers to create one rather than sticking with the old password.
Moving from a built-in manager to a standalone one doesn't have to happen all at once. It's fine to import everything into the new one and leave the old one in place, unused, until you're confident the new one is working the way you expect — just make sure autofill is only turned on for the one you actually want filling things in, to avoid it offering the wrong saved password.
Troubleshooting
Most standalone managers cannot recover or reset a forgotten master password for you — it's part of what keeps the vault encrypted even from the provider itself. Check the account recovery options you set up when you created the account, such as a recovery key or an emergency contact. If none were set up and none exist, the vault's contents are generally not recoverable.
Check that autofill is switched on for the specific app or browser you're using, not just the manager overall — these settings are often separate. Also check the saved entry's web address matches the page you're on exactly; a manager won't offer a login saved against one address for a different subdomain or a mobile app with its own sign-in screen.
This is common when importing from a browser that had been saving passwords for years — duplicate entries and passwords for accounts you no longer use tend to come along with the useful ones. Most managers let you sort or search the vault; go through it once after importing and delete anything for an account you've closed or no longer recognise.
Need a calculator rather than a guide? Try Simplicalcs →