The single biggest upgrade to your online security isn't a clever password — it's a password manager. It lets every account have a long, unique, random password without you memorising any of them, which closes the door on the most common way accounts get hacked: password reuse.
This guide covers how to set up and actually use a password manager, so you go from reusing a handful of passwords to having a strong, unique one everywhere.
What you need
- ✓A reputable password manager (browser-based or a dedicated app).
- ✓One strong master password you'll remember.
- ✓A little time to import and clean up your existing logins.
Step-by-step
- 1
Choose a password manager
Pick a reputable, well-reviewed password manager. Most work across your devices and browsers with an app and a browser extension. The important thing is that it's trustworthy and you'll actually use it — a good one you use beats a perfect one you don't.
- 2
Create one strong master password
This is the one password you must remember, and it protects all the others, so make it strong — a long passphrase of several random words. Never reuse it anywhere else, and if the manager offers it, turn on two-factor authentication for the vault too.
- 3
Import or add your existing logins
Most managers can import passwords saved in your browser, or you add accounts as you log in. Get your important accounts in first — email, banking, social. The manager stores them encrypted behind your master password.
- 4
Replace weak and reused passwords
Now the payoff: go through your accounts and, using the manager's generator, replace weak or reused passwords with long, unique random ones. The manager remembers them, so there's no downside to every password being different and complex.
- 5
Use autofill to log in
With the browser extension, the manager fills your username and password automatically on the right site. This is also a phishing safeguard — it won't autofill on a fake lookalike domain, so if it doesn't offer to fill, check the URL.
- 6
Store more than passwords, and back up access
Use it for secure notes, card details and 2FA codes too. Set up account recovery (an emergency kit or recovery code) and store it safely — because if you lose the master password, a good manager genuinely can't recover your vault for you.
Examples
- Someone reusing one password across 30 sites moved to unique generated passwords in an afternoon — one breach can no longer cascade across their accounts.
- The manager declining to autofill on a convincing fake login page tipped the user off to a phishing attempt.
Tips
- →Your master password is the one that matters — make it a long, unique passphrase.
- →Turn on 2FA for the vault itself for extra protection.
- →Use the generator so every account gets a unique, strong password.
- →Autofill only works on the real site — a no-fill is a phishing warning.
- →Set up and safely store recovery in case you forget the master password.
Common mistakes
- A weak master password. It guards everything — use a long, unique passphrase and 2FA on the vault.
- Reusing the master password elsewhere. Keep it unique to the manager so a breach elsewhere can't expose your vault.
- Not replacing old reused passwords. Use the generator to make each account unique — that's the whole point.
- No recovery set up. Store recovery codes safely; a good manager can't reset a forgotten master password.
Conclusion
A password manager turns 'I reuse a few passwords' into 'every account has a strong, unique one' — with only a single master password to remember. Set it up, protect the vault with a strong passphrase and 2FA, replace your old passwords, and use autofill. It's the highest-impact security move most people can make.