How to start using a password manager (without the hassle)

Most stolen accounts aren't the result of sophisticated attacks but of reused passwords: one website suffers a breach, and attackers try that same password on your email, bank and social media. The fix is a different, long password for every service — and the only realistic way to manage that is a password manager.

#What a password manager is

It's an app that stores your passwords encrypted and fills them in for you on websites and apps. You only need to remember one: the master password. It also:

• Generates long, random passwords.
• Warns about weak, reused or leaked passwords.
• Syncs between computer and phone.
• Helps you avoid phishing: it only fills in your details on the correct domain.
• Often stores passkeys too. See what are passkeys.

#Is it safe to keep all your passwords in one place?

The usual question. For the vast majority of people, it's far safer than the alternative — reusing passwords or writing them down unprotected. Reputable managers encrypt your data on your device with your master password. To keep the risk low:

• Use a strong master password you don't use anywhere else.
• Turn on two-factor authentication for the manager. See how to set up 2FA.
• Choose a manager with a good reputation and frequent updates.

#Types of password manager

If all your devices are in one ecosystem, the built-in manager may be enough. If you mix Windows, Android, iPhone or Mac, a standalone manager is usually more convenient.

#Creating a strong master password

Current guidance, such as NIST's in the US, prioritises length over forced complexity. A good option is a passphrase of several random words:

• Example structure: four or five unrelated words, with a separator.
• Avoid famous quotes, song lyrics or personal details.
• Never reuse it anywhere else.
• Write it on paper and keep it somewhere safe at home until you've memorised it.

#Getting started without overwhelm

1. Install the manager on your computer (browser extension) and phone.
2. Import passwords already saved in your browser, if the manager supports it.
3. Start with critical accounts: main email, banking, your Google, Apple or Microsoft account, social media. Replace each password with one the manager generates.
4. The rest, gradually: each time you sign in to a service, change its password to a new, unique one.
5. Check the security report to find reused or leaked passwords.

#Good practices

• Turn on auto-lock after a few minutes of inactivity.
• On your phone, unlock with fingerprint or face.
• Be careful on shared devices.
• Store your accounts' recovery codes in the manager's secure notes too.

#The bottom line

A password manager lets you have a unique, long password for every service while remembering only one. Pick a built-in or standalone manager to suit your devices, create a long passphrase as your master password, protect it with two-factor authentication and start with your most important accounts. If you've already had a problem, see what to do if your account is hacked.