Guides Do this now
Setting up a password manager properly
The highest-value hour in personal security. Here is the order that avoids the usual mistakes.
Pick one and commit
Browser-built, standalone, or the one bundled with a security suite - all are better than reuse. The important part is that it is available on every device you use, or you will keep a mental exception list and that is where reuse creeps back.
The master password is different
It is the one password you must remember and the one you cannot store in the manager. Make it a long passphrase - several unrelated words - rather than a short complex string. Length is what resists guessing.
Write it down and store it somewhere physically safe. For this one password, paper in a drawer at home is a reasonable answer, and a far better failure mode than losing access to everything.
Turn on the second factor immediately
The vault is now the most valuable account you own. Protect it with an authenticator app or a security key before you put anything in it.
Import, then triage
Import the passwords saved in your browser. The manager will then show you reused and weak ones. Do not try to fix all of them - work in this order: email, banking and payment, anything holding an address or card, then the rest as you happen to sign in.
Let it generate from now on
Every new account gets a generated password. You are no longer choosing passwords, which removes the human patterns that guessing lists are built on.
Plan for the bad day
Understand the recovery route before you need it. Some managers offer an emergency kit or recovery code - print it. Some offer a trusted contact. Know which applies to you, because for most managers there is genuinely no way in if you lose the master password.
Store more than passwords
Backup codes for your other accounts, software licence keys, and recovery codes all belong here. Anything you would otherwise keep in a note on your phone is better off in the vault.