Before you start
Setting up a password manager goes more smoothly when you prepare first. Gather the few things below before you begin.
- Use a device you trust, with an up-to-date operating system and browser.
- List the accounts you want to move, such as email, banking, shopping and social accounts.
- Choose a private spot where you can write down recovery details without anyone watching.
The steps in order
Work through these steps in sequence. Each step depends on the step before it, so avoid skipping ahead.
- Choose a strong master passphrase.
- Create the vault.
- Import your existing passwords.
- Turn on two-factor authentication.
- Store your recovery details in a separate, secure place.
- Install the browser extension in each browser you use.
- Replace every reused password, starting with the most sensitive accounts.
Creating the vault with a strong passphrase
The master passphrase is the single password that unlocks your vault, which is the encrypted store where the manager keeps everything else. Choose a long phrase of unrelated words that you can remember but that nobody could guess from your public profiles. Length matters more than symbols, so several random words usually beat a short word with a few characters swapped.
Do not reuse this passphrase anywhere else. Write it down and keep it somewhere physically secure. Many providers cannot recover a forgotten passphrase for you, so check the provider's documentation before you begin.
Next, create the vault in the manager and import your existing passwords. Most managers can import from a file exported by another manager, or from the list your browser keeps. Delete the exported file as soon as the import finishes, because it holds every password in plain text.
Two-factor authentication and recovery details
Two-factor authentication adds a second check, such as a code from an authenticator app, before the vault opens. Some providers also offer passkeys, which replace a password with a key stored on your device. Check the provider's documentation for the methods it supports and how to set them up.
Recovery details are what let you get back into the vault if you forget your master passphrase or lose your device. Many providers offer a recovery code, an emergency kit or a trusted contact. Write the code down, then store it apart from your device, such as in a locked drawer.
Installing the extension and cleaning up reused passwords
Install the browser extension in each browser you use, then unlock it with your master passphrase. Review each suggestion it makes before you accept it, especially on any account you do not recognize.
Reused passwords are the main reason a single breach can spread to other accounts. Start with the most sensitive accounts, such as email and financial accounts. Generate a long, random password for each account, then replace the old password in that account's settings. Work through the rest over time rather than rushing.
What to do if it fails
If the import stalls or skips entries, check that the export file matches the format your manager accepts. Then import a smaller batch so you can see which entries cause the problem. Avoid running the same import again without a change, because duplicate entries build up quickly.
If the extension will not fill in a password, check that it is unlocked and that the address matches the entry you stored. If you are locked out, use your recovery details rather than guessing. Recovery works differently with each provider, so read its documentation before you ever need it.
Where this matters when choosing a provider
Setup is easier with a provider that supports the features you need, such as an import tool, passkeys and two-factor authentication. Compare how each option handles recovery, since that is where many people run into trouble. Read the guide on how to choose a password manager before you decide, then look at the password manager comparison for an overview.