A password manager only earns its keep once your logins are actually inside it, and that move stalls for most people at the same two points: picking a vault and inventing a master password strong enough to be worth the trouble but easy enough to type with a thumb. Budget an hour for the whole job. Work through it in the order below and none of it has to be redone.
Choose the vault by the devices in your house
Feature comparison tables will eat an afternoon and settle nothing. The deciding factor is almost always which operating systems you and your family use.
- Bitwarden — the free plan covers unlimited logins on unlimited devices with no card on file. Premium costs $10 a year and adds built-in one-time codes, 1 GB of attachments and emergency access. Best default for a mixed Windows and Android household.
- 1Password — $2.99 a month billed annually for one person, with more polished apps and better handling of passports and bank cards. The family plan runs $4.99 a month for five people.
- KeePassXC — one encrypted file you sync yourself through Syncthing or a cloud folder. No vendor account, but every backup is your responsibility.
- iCloud Keychain or Google Password Manager — already installed, syncs free, and is genuinely adequate when every device in the house comes from the same vendor. Their weakness is sharing: there is no tidy way to hand a relative one login.
Write the choice down and stop shopping. Moving between vaults later is an export and an import, so a wrong pick costs fifteen minutes, not your data.
Build a master password you can type with your thumbs
Length beats cleverness. NIST’s digital identity guidelines recommend a minimum of 8 characters and treat long passphrases as stronger than short strings stuffed with symbol substitutions, so string together four unrelated words plus a number: copper-harbor-27-tram. That is 22 characters and roughly 60 bits of entropy when the words are genuinely random. Lines from songs, film quotes and famous sentences are the worst possible choice here, because cracking dictionaries are built from exactly those.
Test it before you commit: type it on a phone keyboard, then on a desktop board. If a character needs the AltGr key, drop it. You will type this several times a day for a decade.
Skip the “hint” field that names your dog. Write the password on paper, seal it, and keep it with your passport.
Import the browser passwords, then destroy the export
The export file is the most dangerous object you will create today: a plain-text CSV of every login you own, sitting unencrypted in your Downloads folder.
- Chrome or Edge: open
chrome://password-manager/settings, choose Download file, and confirm with your operating system password. - Safari on macOS: System Settings → Passwords → the ⋯ menu → Export All Passwords, unlock with Touch ID, save to the Desktop.
- In the new vault: Tools → Import data → select the matching format (Chrome CSV, Safari CSV) → upload the file.
- Test three entries at random — one bank, one shop, one with a long generated password — by logging in through the browser extension rather than reading the row.
- Delete the CSV, then empty the Trash or Recycle Bin. On Windows, Shift+Delete skips the bin entirely.
Do not stop at step four because the import “looked fine”. Sitting exports are how most leaks of this shape begin.
Turn on two-factor and print the recovery codes
Two-factor stops a thief who already has your password. Use TOTP — the six-digit rotating code — instead of SMS wherever the site allows it, since a SIM swap defeats text messages.
Keep the authenticator out of the vault. If Bitwarden stores both your passwords and your one-time codes, a single compromised master password hands over everything at once. Aegis Authenticator on Android, or Ente Auth on both platforms, is free and can export its database to a file you control.
Then do the dull part: when a site offers ten recovery codes, print them or copy them onto the card with your master password. Skip it and a lost phone locks you out of your email for a week.
Change the ten accounts that can ruin your month
Nobody needs to touch all 180 logins today. Sort them by damage: primary email first, then banking and card apps, the Google or Apple account that controls your phone, the carrier account (SIM swap again), the tax portal, and anything with a saved card.
For each one, let the vault generate a 20-character password at the moment you log in. Do not pre-generate a batch and paste them in later — that is how entries end up saved against the wrong site. Shopping and forum logins can wait; they get replaced naturally over the next month as you sign in.
Before you stop, run your addresses through Google Password Checkup to catch reused passwords still sitting on sites you forgot you had, and read the password manager habits that actually stick so the vault does not quietly decay. Once the browser extension is pinned to the toolbar with biometric unlock on, the daily cost is one touch of a fingerprint — and a manager you have to open as a separate app is one you will abandon by Friday.
The last item is a different project: passkeys on your phone replace the password entirely on the sites that support them, and they live in the same vault. The standard behind the passphrase advice is NIST SP 800-63B.