AptKeysTools · Passwords and sign-in
Using a password manager
A password manager creates, stores and fills in a different strong password for every account, so one data breach can't unlock the rest. You remember a single master passphrase of 4 to 7 unrelated words. Good free options exist, including ones built into browsers. Set it up in this order: choose a reputable one, make the master passphrase, turn on two-step sign-in, then replace your email and bank passwords first with random 16+ character ones. Write the master passphrase down and keep it somewhere physically safe; most managers can't recover it.
You'll need
- Your phone and computer
- A quiet half hour
- A safe place for one written-down master passphrase
What to know
- Choose a reputable password manager. Many good ones are free, including those built into browsers; dedicated managers often add stronger security features and work better across devices. Compare reviews from a trusted source like Consumer Reports.
- Look for "zero-knowledge" design: the company can't see your passwords and never stores your master password.
- Create the master passphrase: 4 to 7 unrelated words, like CISA's example "Horse Purple Hat Run Bay Lifting." Spaces are fine. Don't use that example itself.
- Turn on two-step sign-in for the password manager right away.
- Install its browser extension and phone app so it can autofill and sync.
- Replace your most important passwords first: email, social media and financial accounts. Let the manager generate each one: at least 16 characters, random, and unique.
- Let the rest come over time. Save passwords as you log in, or import them all at once.
Watch out Reusing a password, even with a letter or symbol added, is risky. If one account is breached, that password becomes a skeleton key to the others. In CISA's example, one reused password let a hacker into someone's email and start a $700 bank transfer.
Dad note One great password you remember, and a vault for all the rest.