Before you start
- Choose a product with a clear track record and documentation.
- Protect the vault with a unique master password.
- Enable a second factor and save recovery codes.
- Replace reused passwords gradually, starting with email.
What to evaluate before choosing
Look for a manager that explains how it protects the vault, lets you export your data, publishes security updates, and supports your devices. Autofill, breach alerts, and secure sharing are helpful, but they do not replace transparent security design.
A synchronized service and a local vault can both work. The best option is one you can keep updated, recover, and use every day without returning to password reuse.
Prepare vault recovery
- Read the recovery procedure before migrating accounts; it varies by product.
- Keep your emergency kit and recovery codes in a protected place separate from the vault.
- Check how to regain access if you lose your phone or second factor.
- Test access on another device you own. Never disclose the master password or enter it into support forms.
Protect the master password
Your master password should be unique, long, memorable to you, and unpredictable to everyone else. Never reuse it for email or social media. Enable multi-factor authentication and keep recovery codes somewhere separate and protected.
Set automatic locking and treat biometrics as a local convenience. Biometrics do not replace a strong master password or a recovery plan.
- Keep the app and browser updated.
- Review connected devices and sessions.
- Create a protected export only if you can store it safely.
Migrate without solving everything in one day
Start with primary email, financial accounts, social networks, and work accounts. Generate a different password for each one and let the manager fill it. Replace other reused credentials as you encounter them.
CSV exports and some text formats may be unencrypted. Avoid shared folders; deleting a file does not guarantee deleting backups or synced copies.
What to do after a password breach
Change the affected credential and every reused copy immediately. Close active sessions, check email forwarding rules, review recovery methods, and enable a second factor. A breach at one service does not mean the manager was breached; reuse is usually the larger risk.
Check your vault and devices
- Check support for your systems, export, recovery, MFA, automatic locking and update documentation.
- Start with one account. Verify autofill on the correct domain and synchronization before continuing.
- CSV exports and some text formats may be unencrypted. Avoid shared folders; deleting a file does not guarantee deleting backups or synced copies.
Password manager FAQ
Are password managers safe?
They greatly reduce password reuse. Choose a reputable product, keep it updated, and protect it with a master password and a second factor.
What if I forget the master password?
It depends on the product. Understand recovery before migrating and keep recovery codes or an emergency kit in a safe place.
Can I use the manager built into my browser?
It can be practical when well protected and synchronized. Evaluate export, recovery, cross-device support, and security alerts.