What it actually is
Think of it as an encrypted vault that opens with one password and holds all the others. A well-built manager encrypts the vault on your own device before anything is synced, so the company running the service stores a scrambled file it cannot read. The manager also fills in logins for you, and it matches them to the exact web address. On a lookalike site built to steal your bank login, the manager offers nothing, and its silence is the warning.
Choosing one
There are three kinds. The manager built into your phone or browser is free and perfectly sound if all your devices come from one company. A standalone service works across every phone, computer and browser, which matters if you mix them. An offline vault file that you sync yourself suits people who enjoy that sort of thing. Whichever you pick, look for published independent security audits, two-factor authentication on the vault itself, and an export function, so that you can leave whenever you like.
The master password
This is the one password you still have to remember, so make it long rather than clever. Four or five unrelated random words, around twenty characters or more, is both strong and typeable. It must never have been used anywhere else. Most services cannot reset it for you, by design, so write it on paper and keep the paper wherever you keep your passport. Print any recovery code the service offers and store it in the same place.
Moving in
- Install the manager on your phone and your computer, and add its extension to your browser.
- Import the passwords your browser has already saved, then turn off the browser's own saving so that you are not keeping two sets.
- Change the passwords that matter most first: your email, your bank, your main phone or cloud account, and anything holding a card number.
- Let the generator do the work, at sixteen to twenty random characters for each site.
- Let everything else migrate as you log in over the next month, then run the manager's built-in audit and fix whatever it flags as reused or weak.
What else belongs in it
The vault is also the right place for the WiFi password, two-factor backup codes, software license keys and the combination to the bike lock.
Tip Treat security questions as extra passwords. Answer them with random words from the generator and save the answers in the entry's notes, because your first pet's name is on your social media and a random phrase is not.
