Password manager setup: twenty minutes that saves your digital life
The single highest-leverage security change a non-technical person can make is adopting a password manager. Here is how to set one up in one sitting.
Reusing passwords across sites is the single most common root cause of account takeovers. Password managers solve this by generating a unique strong password for every site and storing them encrypted behind one master passphrase. Twenty minutes to set up, pays dividends for life.
Choosing one
Any mainstream manager is dramatically better than no manager. 1Password, Bitwarden, Dashlane, iCloud Keychain (if you are fully Apple), and Google Password Manager (if you are fully Chrome) all work. Pick based on which ecosystem you spend most time in; the cross-device sync experience matters most day-to-day.
Set up the master passphrase
Three or four random dictionary words with a number and symbol: "correct-horse-battery-staple-9!" is both more secure and more memorable than "C0mpl3x#2024". Never reuse this passphrase anywhere else. Write it down on paper and store in your home safe or similar — this is the one password you cannot recover.
Enable the browser extension and mobile app
The extension autofills passwords on the right domain and refuses to autofill on wrong domains — this is the single biggest phishing defence. The mobile app lets you fill passwords inside other apps.
Migrate your top 20 accounts
Email, main bank, work accounts, shopping, social media, phone carrier, utilities. For each: log in with the old password, go to account settings, change the password, let the manager generate and store a new 20-character random one. Target: 20 accounts in week 1, the rest trickle in as you log into them.
Turn on 2FA for the critical ones
Email, bank, work accounts, and the password manager itself. Store the 2FA codes in a different mechanism than the password manager (authenticator app or hardware key) — otherwise you have a single-point-of-failure.
Share wisely
Family plans let you share specific credentials (home Wi-Fi, streaming subscriptions) without exposing your personal ones. Never share credentials by text or screenshot — use the manager's share feature.