How to Use a Password Manager Safely
Share this post
How to Use a Password Manager Safely
Most people have dozens of accounts and reuse a few passwords across them. That's the real danger: when one site leaks, criminals try the same email and password on email, shopping and banking sites. A password manager fixes this by creating a strong, different password for each site and filling it in for you - so you only have to remember one.
What a Password Manager Does
- Remembers every username and password, encrypted.
- Creates long random passwords when you sign up or change a password.
- Fills them in on websites and apps, on your computer and phone.
- Warns you about passwords that are weak, reused or found in known data breaches.
- Often stores passkeys, the newer sign-in method that replaces passwords on sites that support it.
Step 1: Choose One
You probably already have one built in:
| Option | Works best if you use | Where to find it |
|---|---|---|
| Google Password Manager | Chrome and Android | Chrome settings, or passwords.google.com |
| Apple Passwords / iCloud Keychain | iPhone, iPad, Mac | The Passwords app on newer iOS and macOS versions; earlier versions in Settings > Passwords |
| Microsoft Edge password manager | Edge on Windows | Edge Settings > Passwords (Profiles > Passwords in some versions) |
| Standalone managers (for example Bitwarden, 1Password and others) | A mix of Windows, Mac, Android, iPhone and browsers, or shared family passwords | Official app stores and the maker's own website |
A built-in manager is a good, free choice if all your devices are from one "family". If you use an iPhone with a Windows PC and Chrome, a standalone manager usually works more smoothly across all of them. Download it only from the official app store or the maker's own site - fake password manager apps exist.
Step 2: Protect the Manager Itself
The manager now holds the keys to everything, so it needs the strongest protection you have.
- A strong main password. For built-in managers, that's your Google, Apple or Microsoft account password. For a standalone manager, it's the master password. Use a long passphrase - four or more random words - that you don't use anywhere else.
- Turn on two-step verification for that account. See how to turn on two factor authentication for Google, Microsoft and Apple.
- Set up recovery. Many standalone managers can't reset a forgotten master password. Save their recovery code or "emergency kit" somewhere safe and offline - printed and stored at home, for example.
- Lock your devices with a PIN, password or fingerprint/face. Anyone who can open your unlocked phone may be able to open your passwords too.
Step 3: Move Your Passwords In
- Browser passwords: most standalone managers can import from Chrome, Edge, Firefox and Safari. Follow the manager's own import guide.
- Passwords in notes, spreadsheets or notebooks: add them as you go - each time you sign in to a site, let the manager save it.
- After importing from a file, delete the export file (and empty the Recycle Bin): it contains all your passwords in plain text.
Step 4: Replace Weak and Reused Passwords
Open the manager's security check (Password Checkup in Google Password Manager, Security Recommendations in Apple Passwords, Password Monitor / Password health in Edge, or the "health" or "watchtower" report in standalone managers).
Start with the accounts that matter most:
- Your email (it can reset every other password),
- banking and payment accounts,
- social media and shopping accounts with saved cards.
For each: go to the site, change the password, and let the manager generate the new one. See how to check if your email was in a data breach for accounts that have already leaked.
Everyday Safety Tips
- Let the manager fill the password. If it doesn't offer your saved login on a page that looks like your bank, check the address - it may be a fake site. This makes a password manager a good defence against phishing (how to spot a phishing email).
- Never type your master password into a site or pop-up that asks for it out of the blue, and never share it on the phone. No real support team needs it.
- Keep the manager app and browser updated.
- Use passkeys where a site offers them - they can't be phished or reused.
- On a shared PC, don't let the browser save passwords to a shared profile; use your own Windows account or profile.
Common Questions About Safety
"What if the password manager company is hacked?" Reputable managers encrypt your vault so that the company can't read it without your master password. That's why a strong, unique master password and two-step verification matter so much. Keep the manager updated and follow any security notices from its maker.
"Isn't writing passwords in a notebook safer?" A notebook at home is safe from online attackers, but people who use one tend to reuse short passwords, and it doesn't work on the go. If you do keep one, store it securely at home - never a list in your phone's notes app or an unencrypted file.
Frequently Asked Questions (FAQ)
Is it safe to keep all my passwords in a password manager?
For most people it's much safer than reusing passwords or keeping them in a note. Reputable managers encrypt your passwords, and the main account is protected by a strong password plus two-step verification. The bigger risk is reusing one password on many sites.
Is the password manager in my browser good enough?
For many people, yes. Google Password Manager, Apple's Passwords and the manager built into Microsoft Edge create strong passwords, fill them in and warn about leaked ones. A standalone manager is worth it if you use a mix of devices and browsers or want to share passwords with family.
What happens if I forget my password manager's master password?
It depends on the manager. Built-in managers use your Google, Apple or Microsoft account recovery. Many standalone managers cannot reset a forgotten master password at all, so set up their recovery options and keep an emergency kit or recovery code in a safe place.
Should I still use two-step verification with a password manager?
Yes. Turn on two-step verification for the password manager account itself and for important accounts like email and banking. A password manager protects against reused and weak passwords; two-step verification protects against stolen ones.
Comments