How to Set Up a Password Manager and Stop Reusing Passwords

This guide is for anyone who uses the same few passwords everywhere, keeps them in a notebook or a phone note, or dreads the forgot password link. You will learn what a password manager does, how to choose one, how to set it up safely with a strong master password, and how to replace your old reused passwords one account at a time. General information, not professional advice.

Why Reusing Passwords Is the Real Risk

Websites and companies are hacked regularly, and lists of email addresses and passwords from those breaches are traded online. Criminals then use automated tools to try those same email and password pairs on hundreds of other sites, such as email providers, online shops, banks and social media. This is called credential stuffing. If you reuse a password, one breach at a small website you barely remember can give someone access to your email, and from there, almost everything else.

The solution is simple to say and hard to do by memory alone: every account needs its own unique, strong password. Most people have dozens or even hundreds of accounts, and nobody can remember that many random passwords. That is exactly the problem a password manager solves.

What a Password Manager Does

A password manager is an app that stores all your passwords in an encrypted vault. You unlock the vault with one strong master password, and often with your fingerprint or face on your phone. The manager then fills in your usernames and passwords on websites and apps for you, creates new random passwords when you sign up for something, and keeps everything in sync across your phone, tablet and computer.

• Generates long, random passwords so you never have to invent one.
• Remembers them so you do not have to.
• Fills them in automatically on the correct website, which also helps protect you from fake lookalike sites.
• Warns you about weak, reused or breached passwords.
• Stores other private details, such as secure notes, membership numbers and two-factor recovery codes.

Reputable password managers use strong encryption so that, in most designs, even the company that runs the service cannot read your vault. That is also why your master password matters so much: in many cases, if you forget it, the company cannot reset it for you. You will set up recovery options in the next sections.