A password manager is the most practical way for an ordinary person or small team to use a different strong password for every account. To start safely, choose a reputable manager, protect it with a long master passphrase you have never used elsewhere and two-factor authentication, set up an emergency or recovery option, then move your most important accounts first and change their passwords as you go.
The common fear, "all my passwords in one place", is reasonable but usually outweighed by the alternative: reused or weak passwords that leak from other websites. The real risks lie in a weak master password, a lost recovery method and an infected device, and all three can be managed.
Why remembering passwords no longer works
An ordinary adult now has dozens, often more than a hundred, online accounts: email, banking apps, shopping sites, social media, government services, work tools, utilities, schools. Nobody can remember a different strong password for each. So people reuse a few favourites with small variations, or write them in a notebook, a phone note or a spreadsheet called "passwords".
Reuse is the dangerous part. Websites get breached regularly, and leaked email and password lists are traded and tried automatically against other services. If your shopping account password is the same as your email password, a breach at the shop opens your email, and your email can reset everything else.
A password manager solves this by remembering for you. It generates long random passwords, stores them in an encrypted vault, and fills them in when you visit the right site. You remember one strong master passphrase; the manager remembers the rest.
There is a quiet security bonus. A good manager fills passwords only on the website address where they were saved. If you land on a convincing fake page and the manager does not offer to fill, that silence is a warning sign worth paying attention to.
What to look for when choosing one
A long track record and public security information. Prefer managers that explain how they encrypt data, publish independent security reviews and have handled past incidents openly.
Encryption the provider cannot read. Reputable managers are designed so the vault is encrypted on your device with your master passphrase, and the company cannot see your passwords.
Works on all your devices. Phone, computer, and the browsers you actually use. A manager that is missing on one device will push you back to old habits.
Two-factor authentication and passkey support. Protects the vault itself and lets you store passkeys alongside passwords.
Sharing for family or team. Shared folders or vaults let you share the Wi-Fi password or the shop's social account without sending it by chat.
Emergency access or account recovery. A way for a trusted person to get in after a waiting period if something happens to you.
Export options. You should be able to export your data if you ever change provider.
Built-in browser managers are a reasonable start. The password managers built into major browsers and phone platforms are far better than reuse. Dedicated managers add sharing and cross-platform flexibility.
Setting it up step by step
Plan an hour for the first setup, then move accounts gradually over a few weeks.
- Create a master passphrase. Four or more unrelated words, or a long sentence only you would think of, never used anywhere else. Length matters more than symbols.
- Write the passphrase on paper and store it somewhere safe at home. Until you have typed it many times, a written copy protects you from forgetting it. Do not store it in your phone notes.
- Turn on two-factor authentication for the manager account. Use an authenticator app or passkey if available.
- Save the recovery kit or set up emergency access. Most managers offer a recovery key or a trusted contact option. Print or store it offline.
- Install the manager on your phone and computer. Enable autofill in the phone settings and the browser extension on the computer.
- Import or add your most important accounts first. Email, phone platform account, banking-related email, social media, work. Change each password to a new generated one as you go.
- Delete old password lists. Once the manager holds everything, remove the notebook pages, phone notes and spreadsheets, or lock the paper copy away.
Do not try to change every password in one evening. Add each remaining account the next time you log in to it; within a couple of months most will be done.
Sharing safely in a family or small team
Share through the manager, not through chat. Passwords sent in messages stay in chat history on several phones for years.
Create shared folders by purpose. For example "Home" for Wi-Fi, utilities and streaming, "Shop" for the business social and marketplace accounts.
Give each person their own account in the manager. Shared logins to the manager itself defeat the purpose and make tracking impossible.
Use the company's account for business vaults. Then access can be removed when an employee leaves, and the business keeps its credentials.
Change shared passwords after someone leaves. Removing access to the vault does not erase what they may remember or have copied.
Set up emergency access between partners. If one person is ill or worse, the other can reach essential accounts without guessing.
Help older relatives with a simple setup. Fewer accounts, clear names, and a trusted family member as emergency contact work better than a complex structure.
Honest risks and how to handle them
If someone learns your master passphrase and passes your second factor, they get everything. That is why the passphrase must be unique and long, and why the manager account deserves its strongest protection. Never type the master passphrase into any page that arrived through a link in an email or message.
If you forget the master passphrase and have no recovery method, many managers cannot help you, by design, because they cannot read your vault. The paper copy and recovery kit exist for this reason. Check once a year that you can still find them.
A device infected with malware can capture what you type and see what you open. A password manager does not fix an infected device. Keep systems updated, install apps only from official stores, and be careful with browser extensions.
Finally, providers themselves can suffer breaches. Strong encryption with your passphrase is what protects you in that case, which brings everything back to the same point: a long, unique master passphrase.
Frequently asked questions
Is it safe to save passwords in my browser?
For most people it is much safer than reusing passwords, especially if the browser account has two-factor authentication and the device has a screen lock. Dedicated managers add better sharing and work across different browsers.
What makes a good master passphrase?
Long, unique and memorable: several unrelated words or a personal sentence nobody could guess. Avoid song lyrics, famous quotes, names and dates connected to you.
What happens if the password manager company is hacked?
With a well-designed manager, attackers get encrypted vaults that are very hard to open if your passphrase is long and unique. Change the master passphrase and the most important passwords if the provider recommends it.
Should I store bank PINs in a password manager?
Card PINs are better memorised and never written next to the card. Online banking passwords can be stored like any other, protected by the manager's strong security.
How do I share the shop's accounts with staff safely?
Use a business vault owned by the shop, give each staff member their own account, share only the folders they need, and change shared passwords when someone leaves.
