How to Use a Password Manager

A password manager flips the hardest problem in personal security into an easy one: instead of memorising dozens of unique passwords, you memorise exactly one strong master password, and the app generates, stores, and autofills everything else behind AES-256 encryption. This guide covers choosing a manager, building a master password that actually resists cracking, wiring up autofill on your phone and browser, migrating your existing logins without a painful weekend, and the specific mistakes that quietly undermine people who think they are protected.

Choosing a manager that fits how you live#

The right pick depends on your devices and budget far more than on marketing.

• Bitwarden is open source, and its free tier syncs unlimited passwords across unlimited devices, which is unusual and generous. Premium is around $10/year and adds an integrated TOTP authenticator, breach reports, and emergency access.
• 1Password has no free tier (roughly $36/year individual, about $60/year for a family plan), but its Secret Key model means your account needs both your master password and a 128-bit key stored on your devices, so a stolen master password alone is useless.
• Proton Pass, from the Proton Mail team, is open source with a usable free tier and built-in email aliases.
• Apple's Passwords app / iCloud Keychain and Google Password Manager are free and already built into your phone and browser. They work well if you live entirely in one ecosystem, but feel weaker when you mix an iPhone with a Windows PC, or Android with Safari.
• KeePassXC is free and fully local: your vault is a single .kdbx file you sync yourself. Maximum control, more manual effort.

The common mistake here is chasing the theoretically "best" app. Any reputable, independently audited manager you will actually open every day beats a superior one you abandon after a week.

Building a master password that holds up#

Your master password is the one secret the company usually cannot reset for you, so it has to be both memorable and genuinely hard to crack. Length beats complexity: a five- or six-word passphrase such as copper-lantern-drifts-past-quiet-harbor is far stronger and easier to type than Xk9$2m!. Modern managers then stretch that phrase with key-derivation functions like PBKDF2 (Bitwarden defaults to 600,000 iterations) or Argon2id, which slows any brute-force attempt to a crawl.

The rules that actually matter#

• Use four to six random words, ideally chosen with the EFF long wordlist rather than words you would personally gravitate to.
• Never reuse it anywhere else, not even a lightly edited variation.
• Write it once on paper, store it somewhere physically secure such as a locked drawer or home safe until it is in muscle memory, then destroy the note.

Do not store the master password inside the vault it unlocks, and do not drop it into a note on your phone. Both defeat the point.

Wiring up autofill so it just works#

Autofill is what makes a manager effortless, but you have to enable it in two places.

On iPhone or iPad: Settings > General > AutoFill & Passwords (on older iOS, Settings > Passwords > Password Options), then toggle on your manager. Turn off iCloud Passwords if you want a single source of truth.

On Android: Settings > Passwords, passkeys & accounts, then choose your preferred provider. The path varies by manufacturer and version; on some phones it lives under Settings > System > Languages & input > Autofill service.

In your browser: install the manager's extension and pin it to the toolbar. Then switch off the browser's own password saving so the two do not fight. In Chrome that is Settings > Autofill and passwords > Google Password Manager, where you turn off "Offer to save passwords."

Set the generator to at least 16 characters with symbols for any site you never type by hand. From then on, when you land on a login page, the extension recognises the domain and offers to fill. That domain check quietly protects you from phishing too, because it will not autofill a lookalike address like paypa1.com.

Migrating without a painful weekend#

You do not need to convert every account at once. Work top-down.

1. Import your existing saved passwords. Most managers accept a CSV export (in Chrome: Google Password Manager > Settings > Download / Export passwords). Import it, then delete the file, because that CSV is plain-text and unencrypted.
2. Run the built-in health report (Bitwarden's Reports, 1Password's Watchtower, Dashlane's Password Health). It flags reused, weak, and breached passwords, usually by cross-checking the Have I Been Pwned database of known leaks.
3. Fix the top of the list first: email, then banking, then anything storing your card. Replace each with a freshly generated password.
4. Let the rest fill in naturally. Each time you log in over the next few weeks, save and upgrade that password.

Email is priority one, because it is the password-reset point for nearly everything else. Whoever controls your inbox can reset their way into your other accounts, so a unique, strong email password plus 2FA is the single highest-value change you can make.

Locking down the manager itself#

A vault holding every password is a high-value target, so protect it harder than any individual account.

• Turn on two-factor authentication for the manager. Prefer a TOTP authenticator app, or better, a hardware security key such as a YubiKey or any FIDO2 key, over SMS codes, which are exposed to SIM-swap attacks.
• Use biometrics to unlock (Face ID or fingerprint) on your phone, so daily access is fast without you ever weakening the master password itself.
• Save your recovery materials. 1Password generates an Emergency Kit PDF containing your Secret Key, which you should print. Bitwarden and many others issue one-time recovery codes when you enable 2FA. Keep these offline; if you lose them and forget your master password, your data is generally unrecoverable by design.
• Adopt passkeys where offered. Managers increasingly store and sync passkeys, the FIDO2/WebAuthn standard that replaces passwords with phishing-resistant keys tied to the real domain.

Common mistakes that quietly undo the benefit#

• Weakening the master password to make it "easy to remember." That single choice is the whole ballgame.
• Enabling 2FA everywhere except on the manager itself, leaving the vault as the soft spot.
• Never saving the recovery kit, then getting permanently locked out after a phone upgrade.
• Storing all your TOTP 2FA codes in the same vault as the passwords they protect. It is convenient, but it collapses two independent factors into one. A fair trade for low-stakes logins, a poor one for your bank or email, where a separate authenticator app or hardware key is safer.
• Trusting the browser's built-in saver and a manager at the same time, so passwords land in two places and drift out of sync.
• Emailing or screenshotting a password to move it between devices. Put it in the vault instead.

FAQ#

Is it safe to keep all my passwords in one place?#

Yes, when it is a reputable manager using end-to-end, zero-knowledge AES-256 encryption, because the company stores only scrambled data it cannot read. The realistic risk is not the vault being cracked; it is a weak master password or missing 2FA, and both of those are fully in your control.

What happens if I forget my master password?#

With true zero-knowledge managers like Bitwarden, 1Password, and KeePassXC, the company cannot reset it, so you fall back on your recovery code, Emergency Kit, or a designated emergency contact if you set one up. This is exactly why saving those recovery materials during setup is non-negotiable rather than optional.

Should I pay, or is a free manager enough?#

Bitwarden's free tier is genuinely sufficient for most people, and Apple's or Google's built-in managers are fine within a single ecosystem. Paying (roughly $10 to $60 a year) buys conveniences like integrated 2FA, breach alerts, family sharing, and smoother cross-platform use, all worth having but none of them required to be secure.

Are password managers better than passkeys?#

They are complementary, not competing. Passkeys are more phishing-resistant and are the better choice on any site that supports them, but plenty of services still require a password. A good manager stores both and syncs your passkeys across devices, so you are covered either way.