Guides Do this now

Setting up a password manager properly

The highest-value hour in personal security. Here is the order that avoids the usual mistakes.

7 min read  ·  Last reviewed 11 August 2026  ·  Written for people looking after their own devices

The order that avoids the usual mistakes Choose one on every device you use Master passphrase long, written down safely Second factor before you fill it Import, then triage email and banking first
Turn on the second factor before importing: the vault becomes the most valuable account you own the moment it holds anything.

Pick one and commit

Browser-built, standalone, or the one bundled with a security suite - all are better than reuse. The important part is that it is available on every device you use, or you will keep a mental exception list and that is where reuse creeps back.

The master password is different

It is the one password you must remember and the one you cannot store in the manager. Make it a long passphrase - several unrelated words - rather than a short complex string. Length is what resists guessing.

Write it down and store it somewhere physically safe. For this one password, paper in a drawer at home is a reasonable answer, and a far better failure mode than losing access to everything.

Turn on the second factor immediately

The vault is now the most valuable account you own. Protect it with an authenticator app or a security key before you put anything in it.

Import, then triage

Import the passwords saved in your browser. The manager will then show you reused and weak ones. Do not try to fix all of them - work in this order: email, banking and payment, anything holding an address or card, then the rest as you happen to sign in.

Let it generate from now on

Every new account gets a generated password. You are no longer choosing passwords, which removes the human patterns that guessing lists are built on.

Plan for the bad day

Understand the recovery route before you need it. Some managers offer an emergency kit or recovery code - print it. Some offer a trusted contact. Know which applies to you, because for most managers there is genuinely no way in if you lose the master password.

Store more than passwords

Backup codes for your other accounts, software licence keys, and recovery codes all belong here. Anything you would otherwise keep in a note on your phone is better off in the vault.