Most people already know they should use a password manager. The advice has been given so many times that it has stopped registering. And yet reused passwords remain the most common way ordinary accounts get broken into, because the gap is not awareness. It is that setting one up feels like a large, boring project with an uncertain payoff.
It is actually a small project, provided you do it in the right order. The mistake almost everyone makes is trying to move every account at once, which turns a half-hour job into an exhausting afternoon and a manager they quietly abandon.
Why Reused Passwords Are the Real Problem
Companies get breached. It is routine, and it will keep happening. When it does, the attacker ends up with a list of email addresses and passwords.
The next step is automated: try those same combinations on hundreds of other services. If your email password is the same as the one from the forum that got breached, that forum’s security is now your email’s security. And your email is the account that can reset every other account you own.
This is why “my password is very strong” misses the point. A long, complicated password that you have used in four places offers no protection at all once one of those places leaks it. Uniqueness matters more than complexity, and uniqueness across dozens of accounts is impossible without a tool.
What a Password Manager Actually Does
It stores your logins in an encrypted vault, unlocked by one master password that only you know. It fills them in for you, and it generates new random ones when you need them.
The encryption happens on your device before anything is sent anywhere, which means a reputable provider cannot read your vault and has nothing useful to hand over if it is breached itself. Your master password is never uploaded. This is also why nobody can recover it for you if you forget it, which is the one genuine responsibility the system puts on you.
Choosing One
The differences between the well-regarded options matter far less than actually using one. That said, a few things are worth checking:
- It works everywhere you do. Browser extensions on your computer and an app on your phone, at minimum. A manager that is awkward on your phone will not survive contact with real life.
- Published security audits. Established options commission independent reviews and publish them.
- A clear track record. How has the company handled problems in the past? Every provider has had something go wrong. What matters is whether they disclosed it promptly and fixed it.
- Export that works. You should be able to get your data out in a standard format. This is your escape hatch, and you want to know it exists before you commit.
- Price you will keep paying. Several strong options are free for personal use. Paid tiers mostly add family sharing and extras. Do not let the decision stall over a few pounds a month.
The manager built into your browser or phone is a legitimate starting point too. It is less flexible and harder to move away from, but it is enormously better than reusing passwords, and it is already there.
Setting Up Without Burning Out
Step one: create a master password you can actually remember
This is the only password you will memorise, so make it a good one. The most practical approach is four or five unrelated words strung together, which is long, easy to recall, and hard to attack. Avoid anything drawn from public information about you.
Write it down on paper and keep it somewhere genuinely safe until it is in your muscle memory. Losing your master password means losing your vault, and paper in a drawer at home is a reasonable risk compared to that.
Step two: install it everywhere before you add anything
Browser extension, phone app, tablet if you use one. Do this first. If filling passwords is inconvenient on any device you use daily, you will work around the manager instead of with it.
Step three: add passwords as you use them, not all at once
This is the part that makes the difference. Do not sit down with a list of eighty accounts.
Instead, let normal life do the work. Every time you log into something over the next few weeks, save it to the manager as you go. Within a month you will have captured everything you genuinely use, and the accounts you never touched were not worth the effort anyway.
Step four: fix the important ones deliberately
There are a handful of accounts where a unique password matters far more than the rest, and these are worth twenty minutes of focused attention:
- Your primary email, because it controls everything else
- Your phone or computer account
- Banking and payment services
- Anywhere your card details are stored
- Any account used for work
Change each of these to a generated password now. Then turn on two-factor authentication for each, which matters just as much as the password itself.
Step five: let it replace the rest over time
When the manager flags a reused or weak password on a site you are already logged into, fix it then. Spreading the work over months is what makes it sustainable.
Habits That Make It Stick
Always generate, never invent. Once the manager is remembering them, there is no reason for a password to be memorable. Use the generator every time.
Store recovery codes in the vault. Two-factor recovery codes, security question answers, and account numbers all belong there rather than in a note on your desktop.
Use the security check. Most managers scan your vault for reused, weak, or breached passwords. Run it occasionally and work through what it finds.
Do not fight the autofill. If a site behaves oddly, save the login manually rather than giving up and typing something you will remember.
The Two Real Risks
Forgetting your master password. Nobody can help you. Write it down, store it safely, and set up whatever emergency access feature your manager offers.
Your device being compromised. A manager cannot protect an unlocked vault on a machine someone else controls. Keep your devices updated, use a screen lock, and set the vault to lock itself after a period of inactivity.
Neither of these is a reason to avoid a password manager. They are reasons to set it up properly once, which takes about half an hour and then quietly protects you for years.