Password manager: how to get started step by step

Why bother with a password manager

The real weakness of passwords isn't that they're short – it's that people reuse them. When one service is breached, criminals try the same email and password everywhere else. The FTC's advice is blunt: if you reused a leaked password, or a similar one, on other services, change it there too. Nobody can remember dozens of different strong passwords, though.

That's the problem a password manager solves. According to the UK's National Cyber Security Centre (NCSC), a good one will:

• generate a strong, unique password for each account and remember it,
• only autofill on the correct website – it won't offer your bank password on a convincing fake, which helps against phishing,
• sync across your devices, so you can log in from your phone or laptop,
• in many cases, warn you when a password has been breached or leaked.

1. Choose the type of manager

The NCSC says saving passwords in your browser is safe on your own devices, as long as automatic security updates are switched on for both the browser and the operating system. It works best if you use the same browser or system everywhere. The FTC suggests reading expert reviews before choosing a third-party manager. The key point is the same either way: any password manager beats one password everywhere.

On a public computer – in a library, college or hotel – the NCSC says you should never let the browser save your password. On a shared family computer, think about who else could get into your accounts; if in doubt, don't save.

2. Pick your primary password

The primary (master) password unlocks everything else, so:

• Make it long. The NCSC recommends combining three random words – long enough to be strong, easy enough to remember. You can create one with our password generator in passphrase mode; it's generated entirely in your browser.
• Don't use it anywhere else – not even for your email.
• Don't rely on swapping letters for symbols (0 for o, 3 for e). The NCSC points out that criminals know these tricks too, so they add little strength while making the password harder for you to remember.
• Find out how recovery works before you need it. You must remember the primary password. Many managers offer recovery options such as hints or emergency access through a trusted contact; some don't. If yours gives you recovery codes, keep them offline – on paper somewhere safe at home, for example.

3. Turn on two-step verification

Protect the password manager account – or, if you use your browser's built-in manager, the Google, Apple or Microsoft account it's signed in to – with two-step verification (2SV). The NCSC explains that even if a criminal learns your primary password, they still won't be able to get in.

Choose the strongest method the service offers. The FTC calls codes sent by text or email the least secure type of two-factor authentication and recommends an authenticator app or a security key where available. Store any backup codes somewhere safe, ideally offline.

4. Move your passwords over – gradually

You don't have to change everything in one evening. A sensible order:

1. Email. It can reset the password for almost everything else, which is why the NCSC asks for a strong password used only for email. Give it a new random password from the manager and turn on 2SV.
2. Banking and payments – your bank, PayPal, any account with a saved card.
3. Accounts that shared a password with another site, especially any you know were caught up in a breach.
4. Social media and the shops you use most.
5. Everything else – change it as you go, whenever you next log in. The manager will offer to save the new password.

Passwords you only keep in the manager don't need to be memorable, so make them long and random. The exceptions are the few you have to type from memory (the primary password, the login to your computer) – for those, three random words work better.

5. What next

• Use passkeys where you can. The NCSC recommends making passkeys your first choice of login; for accounts that don't support them, stick with a strong, unique password plus 2SV.
• Act on breach warnings if your manager shows them, and change the affected password.
• Keep things updated – your browser, operating system and the password manager app.
• If something has already gone wrong, follow our guides Account hacked: what to do or Entered your details on a phishing site.