Password managers explained: set one up in 15 minutes (step-by-step)

Why a password manager beats your memory

Human brains can't remember 100 unique, random passwords — so we reuse a few, or we write them in a notes app, or (worst of all) in a browser autofill with no master password. A password manager generates passwords like 9#kQ2$vLx!7zP for every site, stores them in an encrypted vault, and fills them in for you. You only ever need to remember one strong master password — the key to the vault itself.

Step 1: Pick a reputable password manager (3 minutes)

Choose a well-known manager with a strong security record, regular third-party security audits, and support on all your devices (phone, computer, browser). Look for features like end-to-end encryption, a built-in password generator, and secure sharing for family members. Free tiers from reputable providers are fine to start; paid plans usually add family sharing and extra features.

A solid pick to start with

If you don't want to research the whole market yourself, NordPass (from the team behind NordVPN) is a strong starting point: end-to-end encryption, a built-in password generator, apps on all your devices, and a 30-day money-back guarantee. Start on the free tier to learn the ropes, then upgrade if you want the full feature set. (Affiliate link — I may earn a commission at no extra cost to you.)

Step 2: Create your account and master password (2 minutes)

Sign up on the provider's official website, then choose your master password — the one password you must memorize. Make it long and unique: a passphrase of four or five random words (correct-horse-battery-staple style) is both strong and memorable. Write it down on paper and store it somewhere safe at home until it's firmly in your memory. Some managers use a master password plus a unique account key — save that key somewhere secure too, because losing it can lock you out permanently.

Step 3: Install the apps and browser extension (3 minutes)

Install the manager's app on your phone and the browser extension on your computers. This is what makes the whole system effortless — the extension will offer to save and fill passwords as you log in around the web. Enable biometric unlock (fingerprint or face) on your phone so you're not typing the master password dozens of times a day.

Step 4: Turn on two-factor authentication for the vault (2 minutes)

Your password manager now guards everything, so protect it accordingly. Enable two-factor authentication (2FA) on your manager account using an authenticator app, and store the backup/recovery codes somewhere offline — a printed sheet in a drawer is perfect. This step is non-negotiable: a vault protected by a master password alone is a single point of failure.

Step 5: Import your existing passwords (3 minutes)

Most managers can import passwords directly from your browser's built-in password storage — check the manager's settings or help page for the import option. Once imported, run the manager's security report (often called a password health check or audit): it will flag reused, weak, and breached passwords across your accounts.

Step 6: Fix your most important accounts first (2 minutes today, rest over time)

Don't try to fix everything in one sitting. Start with your email — it's the master key to resetting everything else — then your bank, then social accounts. For each one, use the manager's generator to create a new unique password and save it. Change a handful of accounts per day and you'll be fully upgraded within a week or two. Your email and banking passwords should be changed first and never reused anywhere else.

Common worries, answered

• "Isn't it risky to put all passwords in one place?" It's far less risky than reusing passwords. The vault is encrypted on your device, and even the provider can't read it — a design called zero-knowledge encryption. One strong, 2FA-protected vault beats a hundred reused passwords every time.
• "What if the company gets hacked?" Reputable managers have survived breaches precisely because of that encryption — attackers got scrambled data they couldn't read. It also means your master password must be strong, since it's the only key.
• "What if I forget my master password?" That's why you wrote it down. Recovery options are deliberately limited (that's the security working as intended), so keep that paper backup.

The bottom line

Fifteen minutes of setup buys you a lifetime of never reusing a password again. Start with your email and banking accounts today, work through the rest over the coming week, and your accounts will be in the top tier of security for almost no ongoing effort.

Disclosure: This post contains affiliate links. If you buy through them, I may earn a commission at no extra cost to you.