Password Managers Explained: How to Choose One (and Set It Up Right)
If you reuse passwords, you’re not alone — but it’s also one of the fastest ways accounts get taken over.
A password manager fixes that by doing one job really well: creating and storing strong, unique passwords so you don’t have to.
This guide walks you through choosing one and setting it up in a way that actually improves your security (not just your convenience).
What a password manager really does
A password manager stores your logins in an encrypted “vault.” You unlock the vault with one strong master password (and ideally 2FA), then it can:
- Generate long random passwords
- Autofill logins in apps/sites
- Store secure notes (recovery codes, license keys)
- Alert you about reused or breached passwords
How to choose a password manager (simple checklist)
You don’t need the “perfect” one — you need one you’ll use.
1) Cross-device support
If you use phone + laptop, choose a manager that works on both (mobile app + browser extension).
2) Good autofill (especially on mobile)
This is the difference between “I use it” and “I stopped after a week.”
3) Strong 2FA options
Prefer:
- Passkeys (if supported)
- Authenticator app 2FA
- Hardware key support (nice to have)
Avoid relying on SMS as your only option.
4) Emergency access / recovery
Look for a clean recovery story:
- Trusted contacts
- Recovery key
- Family/team plan recovery options
5) Sharing, if you need it
If you share logins with a spouse or team, pick one with secure sharing instead of texting passwords.
The setup that matters (do this once)
Step 1: Create a master password you can remember
A good master password is long and memorable.
Example pattern: a sentence you won’t forget + a small twist.
- Bad:
Password@123 - Better:
CoffeeOnSundaysTastesBetter!
Step 2: Turn on 2FA for the password manager
This protects the vault even if your master password leaks.
- Best: passkey / hardware key
- Great: authenticator app
- Okay: SMS (better than nothing)
Step 3: Import your existing passwords (then clean up)
Most managers can import from Chrome/Edge/Safari.
After import, do a cleanup sprint:
- Replace any reused password first
- Then replace anything that looks weak (short, dictionary words)
Step 4: Save recovery codes inside the vault (and one offline copy)
When you enable 2FA for Google/Microsoft/Meta, you get recovery codes.
- Store them as a secure note in the vault
- Keep one offline copy (printed or on an encrypted drive)
Step 5: Set the vault to lock automatically
A good balance:
- Lock after 5–15 minutes of inactivity
- Require biometrics on mobile
Common mistakes (and easy fixes)
“I keep the same master password everywhere.”
Don’t. Your master password must be unique.
“I disabled 2FA because it was annoying.”
Try using biometrics or passkeys to make it painless.
“I still reuse passwords for ‘unimportant’ sites.”
Those sites are often used to pivot into your important accounts via password reuse.
Quick starting plan (30 minutes)
- Install the manager on phone + browser.
- Enable 2FA.
- Change passwords for: email, Apple/Google, bank, social, work accounts.
- Let the manager generate passwords going forward.
FAQs
Are password managers safe?
Reputable ones use strong encryption. In practice, unique passwords + 2FA is much safer than reusing passwords.
What about writing passwords down?
For a few accounts, a paper notebook can be okay if it’s physically secure — but it doesn’t scale and won’t generate unique passwords.
What if the password manager goes down?
Most have offline access on your device. Also, keep critical recovery codes backed up.
Related reading
-
2FA Done Right: SMS vs Authenticator Apps vs Passkeys (What to Use)
-
Public‑WiFi Safety: What’s Actually Risky (and How to Protect Yourself)