Be honest: you probably use a handful of passwords across dozens of accounts, with small tweaks, and you remember them because they’re not that strong. Everyone does it, because remembering a unique complex password for every site is genuinely impossible. The problem is that when one site gets breached — and sites get breached constantly — attackers try that same email-and-password combo everywhere else. One leak unlocks your whole life.

A password manager solves this completely. It generates and stores a long, unique, random password for every account, and you only have to remember one master password. It’s the highest-impact security upgrade most people can make, and it’s genuinely not hard to set up.

How a password manager actually works

It’s an encrypted vault for all your logins. You remember one strong master password (the only one you ever memorise), and the manager fills in everything else for you — across your phone and computer. Because you no longer have to remember them, every password can be long, random, and different, which is exactly what makes them uncrackable and breach-proof against reuse attacks.

How to set one up

  1. Choose a reputable password manager — there are well-regarded paid and free options; pick an established, trusted one.
  2. Create a strong master password you’ll remember but nobody could guess — a long passphrase of random words works well.
  3. Install it everywhere — the app on your phone and the browser extension on your computer.
  4. Let it import or save logins as you sign in to sites over the next week or two.
  5. Go through your important accounts (email, bank, socials) and replace weak/reused passwords with generated ones.
  6. Turn on two-factor authentication for the manager itself and for your key accounts.
💡

Your email password is the master key

Fix your email account first. It’s the single most important login you have, because password resets for everything else go through it — whoever controls your email can reset their way into your entire life. Give it a long unique password and strong two-factor authentication before anything else.

Get the master password right

The one thing you must not mess up is the master password, because it protects everything else. Make it long and memorable but unguessable — a passphrase of several random, unrelated words is both strong and easy to recall. Never reuse it anywhere, and if the manager offers a recovery method or backup code, store that somewhere genuinely safe. Forgetting the master password can mean losing access to the vault, by design.

⛔

Don’t keep passwords in your notes app or browser-only

A plain notes file or a spreadsheet of passwords is unencrypted and a disaster waiting to happen. And while browsers can save passwords, a dedicated manager is more secure, works everywhere, and does far more. If you’re currently relying on memory, sticky notes, or a notes file, almost any reputable manager is a massive upgrade.

Round out your security

A password manager plus two-factor authentication stops the overwhelming majority of account takeovers. Pair it with the other basics: turn on two-factor everywhere, know what to do if something goes wrong (see what to do when your account is hacked), and understand the principles behind strong credentials in creating safer passwords. It all ties into a broader privacy and account lockdown.

Checklist

Written by Niharika Parashar

Frequently asked questions

What is a password manager and why do I need one?
It’s an encrypted vault that generates and stores a long, unique, random password for every account, so you only have to remember one master password. You need one because reusing passwords means a single breached site lets attackers into all your other accounts using the same email-and-password combo. A password manager makes every password unique and uncrackable, which is the highest-impact security upgrade most people can make.
How do I set up a password manager?
Choose a reputable, established password manager, create a strong master password you’ll remember but nobody could guess, and install the app on your phone and the browser extension on your computer. Then let it save logins as you sign in over the next week or two, go through your important accounts to replace weak or reused passwords with generated ones, and turn on two-factor authentication for the manager and your key accounts.
What should my master password be?
Long, memorable, and unguessable — a passphrase made of several random, unrelated words works well because it’s both strong and easy to recall. It’s the one password you must not get wrong, since it protects your entire vault, so never reuse it anywhere. If the manager offers a recovery method or backup code, store it somewhere genuinely safe, because forgetting the master password can mean losing access to the vault by design.
Are password managers safe to use?
Reputable, established password managers are widely regarded as much safer than the alternatives most people use — reusing passwords, keeping them in a notes file, or relying on memory. They encrypt your vault so only your master password can unlock it. As with anything, choose a trusted, well-reviewed option, use a strong unique master password, and enable two-factor authentication on the manager itself for an extra layer of protection.
Is it safe to let my browser save passwords instead?
Browser password saving is better than reusing weak passwords, but a dedicated password manager is generally more secure, works across all your apps and devices rather than just one browser, and does far more, like generating strong passwords and flagging breaches. If you currently rely on your browser, memory, or a notes file, moving to a reputable dedicated manager is a meaningful security upgrade.

People also ask