How to Set Up a Password Manager Properly
Pick one manager, give it a long unique master password, and turn on two-step verification before importing anything. Then replace reused passwords account by account, starting with email and banking.
Have this ready
- A manager chosen and installed
- Your current password list or browser export
- A safe place for the recovery kit
Step by step
- 1Choose a manager with a track record, an export option and two-step verification.
- 2Create a long master passphrase of several unrelated words that you have never used elsewhere.
- 3Turn on two-step verification for the manager itself and store the recovery kit offline.
- 4Import the passwords your browser has saved, then check the import for duplicates.
- 5Use the manager's security report to find reused and weak passwords.
- 6Change the reused ones starting with email, banking and government accounts.
- 7Install the browser and phone apps, and keep an encrypted backup of the vault.
Want it done with you?
I can walk you through it in a Magic Box, show you the exact clicks, or do it with you and keep the recording. You log in yourself; I never see your password.
Common questions
Is a browser's built-in manager enough?+
It is better than reuse but weaker on sharing across devices and on features like passkeys and breach reports A dedicated manager is more complete.
What if the manager is breached?+
A well-designed vault stays encrypted. Change the master password, and change any password the breach exposed in plain text.
Should I write the master password down?+
A written copy kept physically secure is more reliable than a master password you cannot remember. Never keep it in a plain file on the same device.