How to Set Up a Password Manager — For You or a Small Team

Pick your manager

Our two recommendations, compared in full in the 1Password vs Bitwarden head-to-head: Bitwarden Bitwarden if you want the genuinely free option that's still excellent, or 1Password 1Password if you'd rather pay for the most polished, hand-holding version — the better pick for families and teams who won't tolerate anything fiddly. Either is a good decision; the wrong decision is staying on reused passwords while you deliberate. Create your account on the provider's official site.

Bitwarden's official site → · 1Password's official site →

Create your master password — a passphrase, not a password

The master password is the one password you'll still type yourself, and it unlocks everything else, so it has to be both strong and memorable. The trick that achieves both is a passphrase: several random words strung together, like a short nonsense sentence — random words you can picture as a silly scene are far easier to remember than a short jumble of symbols, and much harder for a computer to guess because of their length. What to avoid: names, birthdays, song lyrics, quotes, and anything you've used anywhere else. Type it into the sign-up, then write it down on paper and keep that paper somewhere safe at home while it settles into memory. That paper is a temporary safety net, not a long-term system — most providers also give you a recovery code during setup; save that with the same care.

Install the app and the browser extension everywhere

Install the manager on your phone and your computer, and add its extension to your browser (an extension is a small add-on that plugs into the browser). The extension is what fills in passwords on websites for you, and it's what will offer to save new ones. Sign in on each device with your master password. From here on, when a login form appears, the manager does the typing.

Import the passwords your browser already saved

Your browser has probably been saving passwords for years. Both of our picks can import that list: you export a file from your browser's password settings, then import that file into the manager. Treat that exported file as what it is — every password you own, in plain text. Import it, confirm the logins appear in your vault, then delete the exported file from your computer (and empty the trash). Afterwards, turn off your browser's own "save passwords" offer so new passwords go to the manager, not back to the browser.

Turn on two-factor for the manager itself

Two-factor authentication (often shortened to 2FA) means signing in needs a second proof beyond your password — usually a code from an authenticator app on your phone, an app whose only job is generating those codes. Protecting the vault this way means a stolen master password alone still isn't enough to get in. Turn it on in the manager's security settings now, before you start depending on it, and save any recovery codes it gives you alongside your master password note.

Change passwords in the safe order: email, banking, then the rest

Your imported passwords are mostly the old, reused ones — the manager remembering them is step one, but replacing them is the point. Don't try to fix everything in one night. Go in this order:

First, your email account. Email is the master key to your life: password resets for nearly everything else land there. Give it a brand-new unique password (let the manager generate one — a long random string it creates and remembers for you) and turn on its two-factor if it isn't already.

Second, banking and money accounts. Same treatment: fresh generated password for each, one at a time.

Then, everything else, a few at a time. Work down the list whenever you next sign in to each site. Within a few weeks, every important account has its own password — and a breach at any one site stops being a skeleton key to all the others.

For a team or family: share through vaults, never by message

Both picks let you organize logins into collections — Bitwarden calls them collections within an organization; 1Password calls them vaults. In plain terms, they're shared folders of logins: you put the shared shop account, the business social logins, or the household streaming and utility accounts into a shared folder, invite each person with their own account, and everyone signs in with their own master password. Three habits make this work: each person gets their own login to the manager (never one shared master password for the whole team); only share the folders someone actually needs; and when someone leaves a team, remove their access and change the shared passwords they could see — in the manager, that's a five-minute job instead of an archaeology project. This replaces the spreadsheet, the sticky notes, and passwords sent over text message, all of which are how small teams usually get breached.