How to Use a Password Manager: A Beginner’s Guide

Most people know they should use unique passwords on every website. Almost nobody does it manually. The average person has more than 80 accounts across apps, services, and websites — creating, remembering, and typing a genuinely random 20-character password for each one is not a realistic expectation for any human being. That’s precisely why using a password manager is not just a good habit — it’s the single most impactful security improvement available to a regular internet user, because it makes strong password hygiene automatic rather than effortful. For the bigger picture, our Complete Guide to Online Security and Privacy pulls everything together.

A password manager stores all your credentials in an encrypted vault, generates unique high-entropy passwords on demand, and fills them in automatically when you visit the corresponding website. You remember one strong master password. The manager handles everything else.

Choosing the right password manager

Don’t over-optimise this choice. Spending two weeks researching options while continuing to reuse the same five passwords is worse than picking a good option today and starting immediately. The main categories:

• Cloud-synced managers (Bitwarden, 1Password, Dashlane, NordPass): store your encrypted vault on the provider’s servers and sync it across all your devices automatically. Correct choice for most users.
• Local-only managers (KeePassXC): store the vault file on your own drive, giving you complete control but requiring you to manage syncing yourself across multiple devices.

Bitwarden stands out at the intersection of price (free tier is genuinely capable), security (open-source, independently audited), and ease of use. 1Password is excellent for teams and families. The important thing is picking one and starting — the best password manager is the one you’ll actually use.

The security model matters to understand: all reputable password managers use zero-knowledge architecture — the provider never sees your master password or your unencrypted vault. Your vault is encrypted on your device before it’s transmitted, using your master password as the key derivation source. Even if the provider’s servers were breached, attackers would only obtain encrypted ciphertext mathematically infeasible to decrypt without your master password. This is why choosing a strong, unique master password is the one non-negotiable in using a password manager securely.

Setting up the vault — step by step

These steps use Bitwarden as the example but apply to any reputable cloud-synced manager. The setup takes about 15 minutes and establishes the foundation that everything else builds on.

1. Create your account. Go to bitwarden.com → Create account → enter your email address → enter a strong master password. Use a passphrase — four to six random words strung together, at least 16 characters. “correct-horse-battery-staple” style passphrases are far stronger than complex short strings and much easier to remember. Write this passphrase on paper and store it somewhere physically secure — a locked drawer, a safe, a trusted location separate from your computer. This is the one password you cannot recover if lost.
2. Install the browser extension. Install the extension for your browser from the official extension store. After installation, log in with your account credentials. The extension is what enables autofill — without it, you’d need to open the manager app separately for every login.
3. Install the mobile app. Download the official app from the App Store or Google Play. Log in. Enable biometric authentication (Face ID or fingerprint) — this allows you to unlock the vault on your phone without typing the full master password every time.
4. Import your existing passwords. In Chrome: Settings → Autofill and passwords → Password Manager → three-dot menu → Export. In Bitwarden: Tools → Import data → select “Chrome (csv)” → upload the file. Your existing credentials populate the vault immediately. Delete the exported CSV file from your Downloads folder afterward — it contains your passwords in plain text.
5. Enable two-step login for the vault itself. Settings → Security → Two-step login → set up an authenticator app (Google Authenticator, Authy, or the manager’s own authenticator). This means even if someone obtains your master password, they cannot access the vault without also having your phone. This step is critical and commonly skipped.

Steps 4 and 5 are the most often missed. Importing existing passwords means you can immediately use the manager for sites you already have accounts on — not just new signups. Enabling two-step login for the vault gives the entire credential database a second protection layer beyond the master password.

Using the password manager day to day

Once the vault is set up and the browser extension is installed, day-to-day use becomes frictionless. When you visit a login page, the extension detects the site and offers to autofill credentials — one click and you’re logged in. When you create a new account anywhere, the extension generates a strong unique password and saves it to the vault automatically. Within a few weeks, the vault fills with all your accounts without deliberate effort.

The password generator deserves specific attention. Use at least 20 characters, with uppercase, lowercase, numbers, and symbols. For websites with broken requirements that don’t accept symbols, use letters and numbers only — but push the length to at least 24 characters to compensate. The generated password doesn’t need to be memorable; that’s the manager’s job. Generate the strongest password the site allows and let the vault store it.

One practical feature most guides underemphasise: secure sharing. Services like streaming subscriptions and shared family accounts need passwords that multiple people can access. Bitwarden and 1Password both have shared collections or family vaults — far safer than texting passwords or writing them on a whiteboard. The shared entry updates for everyone simultaneously when the password changes, eliminating the coordination problem of shared credentials.

Feature comparison

Bitwarden Premium at approximately $10 per year is the sweet spot for most individuals — breach monitoring and a built-in TOTP authenticator mean one fewer separate app to manage for security. Emergency access (granting a trusted person access to your vault in the event of incapacitation) is a genuinely important feature that most users don’t think about until they need it.

Keeping the vault secure long-term

The master password is the crown jewel — never store it in the vault itself, never share it with anyone, never reuse it on any other service. If you ever suspect it’s been compromised, change it immediately from a trusted device.

Regular vault audits are where the long-term security value compounds. Bitwarden’s Vault Health Reports, 1Password’s Watchtower, and Dashlane’s Security Dashboard all identify passwords appearing in known data breaches, passwords shorter than a recommended length, and reused passwords. Running this audit every few months and updating flagged passwords to newly-generated ones is the maintenance habit that keeps the security model sound over years of use.

Device security matters as much as vault security. If the device running the manager is compromised — by malware, by keylogger, or by someone with physical access — the vault is vulnerable regardless of server-side cryptographic protections. Keep the device OS and the password manager application updated, use a screen lock on all devices where the manager is installed, and avoid unlocking the vault on shared or untrusted computers.

Our guide on two-factor authentication covers securing your accounts beyond the password manager itself, and our guide on creating strong passwords covers the underlying principles that make a good master passphrase. For independent security audits of Bitwarden’s architecture, Bitwarden’s security documentation covers the encryption implementation in full technical detail.

Common mistakes to avoid

• Storing the master password inside the vault: a circular dependency that defeats the purpose. The master password must exist only in your memory and a physical written backup kept in a secure location.
• Only using it for new accounts: the vault becomes genuinely valuable only when all accounts have unique generated passwords. The fastest approach is reactive migration — when you log into an existing account, generate a new password for it and save it to the vault. Within a month of active use, the most-visited sites will all have strong unique credentials.
• No recovery plan: most managers offer an emergency kit — a printed document containing the account email, master password hint, and two-factor recovery codes. Print this, store it somewhere physically secure (home safe, safety deposit box), and tell a trusted person where it is. If memory fails or a device is lost, the emergency kit is the recovery path.
• Auto-fill-on-page-load enabled: configure the extension to fill only when you click the extension icon or a prompt, not automatically on page load. Auto-fill-on-load can be exploited by phishing pages that capture filled credentials before you can verify the URL. One second of friction in exchange for meaningful protection against this specific attack.

The security improvement from using a password manager properly compounds over time — each generated password replaces a reused one, each breach alert is caught early, and the cognitive load of credential management becomes negligible. It’s consistently rated as the highest-return single action available for improving personal digital security, above even two-factor authentication, because it simultaneously addresses the most common attack vector — credential reuse — and makes every other security practice easier to implement.

Password managers on mobile — what’s different

The mobile experience of using a password manager differs from desktop in a few important ways. On Android and iOS, the manager integrates with the system-level autofill framework rather than a browser extension. In the operating system settings:

• Android: Settings → Passwords & accounts → Autofill service → select the password manager app
• iOS: Settings → Passwords → Password Options → select the password manager app

Once configured, the password manager’s autofill suggestions appear in login fields across all apps (not just browsers) on the device — filling credentials in native iOS and Android apps exactly as it does on web login forms in the browser. This is a significant capability that many users don’t configure, so they end up using the manager only for browser logins and typing passwords manually in apps.

Biometric unlock (Face ID or fingerprint) is particularly important on mobile — without it, every vault access requires typing the full master passphrase on a small touchscreen keyboard, which is slow enough that most users will revert to not using the manager at all. Enable biometrics during the mobile app setup, or immediately if you skipped it during initial configuration.

Migrating between password managers

Switching from one password manager to another — or from a browser’s built-in password storage to a dedicated manager — is straightforward because all major tools support CSV import and export. The migration sequence:

1. Export from the current manager (or browser) as a CSV file
2. Import the CSV into the new manager using its import tool
3. Verify a sample of entries transferred correctly (spot-check 10-15 accounts)
4. Change the master password on the new manager account to ensure it’s not the same as any credential stored in the vault
5. Delete the exported CSV file immediately — it contains all your passwords in plain text
6. Disable or log out of the old manager (don’t delete it immediately — keep it available for a week in case anything was missed)

The migration process typically takes 15-20 minutes for most users. The CSV file is the vulnerability window — the time between export and deletion is the period during which your passwords exist in an unencrypted, easily readable form. Perform the import and deletion in the same session, on a device you trust, and with the Downloads folder cleared immediately after. Related: How to Use 1Password.

Password managers are one of those tools where the barrier to starting feels larger than the actual effort required. The setup is a 15-minute investment that reduces daily security friction for years afterward and eliminates the specific risk — credential reuse across breached services — that represents the majority of account compromises for regular internet users. There’s no strong argument for not using one; there are many strong arguments, backed by consistent security research, for using one well. If this sounds familiar, Password Manager for Teams is worth a look.