How to Choose and Set Up a Password Manager
What a password manager does, the features to look for, and a simple first-day setup plan so you can start using unique passwords today without feeling overwhelmed.
A password manager is the single most practical tool for account security. It creates long, unique passwords for every site, remembers them, and fills them in for you. You only need to remember one strong password. If you have been reusing passwords because remembering dozens is impossible, this is the fix.
What a password manager does
- Generates long random passwords for each account.
- Stores them encrypted in a "vault".
- Fills them in on websites and apps, and syncs across your phone and computer.
- Warns you about reused, weak or leaked passwords.
- Helps against phishing: it will not auto-fill your bank password on a fake lookalike site, which is a useful warning sign.
Features to look for
| Feature | Why it matters |
|---|---|
| Strong encryption and a good track record | Your vault must stay unreadable even to the provider. |
| Two-step verification on the vault | Protects the manager if your main password leaks. |
| Works on all your devices | Phone, computer and browsers you actually use. |
| Security check | Finds reused and breached passwords. |
| Recovery options | A way back in if you forget the main password. |
| Sharing and emergency access | Useful for families. See sharing passwords with family. |
| Passkey support | Ready for the next generation of sign-in. See what is a passkey. |
Your phone or browser may include a built-in manager. Those can be a good start; see is it safe to save passwords in your browser?
A first-day setup plan
- Install the manager from the official app store or website, on your phone and computer.
- Create a strong main password: a long passphrase of four random words that you use nowhere else. See how long a password should be.
- Turn on two-step verification for the manager.
- Save the recovery details it offers, such as a recovery key, somewhere safe offline.
- Change your email password to a new unique one generated by the manager.
- Do the same for banking and your main social media.
- Stop there for today. Update the rest as you log in to each site over the coming weeks.
Do not try to change everything in one evening. Securing your top five accounts on day one makes the biggest difference. See moving from old passwords to a password manager.
Common worries
"What if the password manager is hacked?"
Reputable managers encrypt your vault so that stolen data is useless without your main password. Using a strong, unique main password and two-step verification makes this even safer. The risk is far smaller than the risk of reused passwords.
"What if I lose my phone?"
Your vault syncs, so you can log in on another device. Make sure you have your recovery details and two-step backup options. See losing your phone with your authenticator.
Beware of fake password manager alerts. If you get an email saying your vault needs "verification", paste it into CyberWatch AI Scan and open the app yourself instead.
For the full picture, read our complete guide to identity theft and account security.
Frequently asked questions
Is it safe to keep all my passwords in one place?
A reputable password manager encrypts your passwords and protects them with your main password and two-step verification. It is far safer than reusing passwords or writing them in an unprotected note.
What happens if I forget my main password?
Many password managers cannot recover it, by design. Set up the recovery options they offer, such as a recovery key or emergency contact, and store them safely.
Should I choose a free or paid password manager?
Either can be fine. Look for a reputable provider with strong encryption, two-step verification, syncing across your devices and a good security track record.
Sources
- Creating Strong Passwords and Other Ways To Protect Your Accounts, US Federal Trade Commission
- Top tips for staying secure online, UK National Cyber Security Centre
- Secure Our World, US Cybersecurity and Infrastructure Security Agency
