A password manager is the single most impactful security tool most people aren't using. Here's exactly how to choose one, set it up, import your existing passwords, and start using it — in under an hour.
Security experts have recommended password managers for over a decade, yet surveys consistently find that fewer than 40% of Americans use one. The gap between knowing you should use a password manager and actually setting one up is real — the initial setup feels daunting, and the fear of 'putting all your eggs in one basket' is understandable. This guide addresses both concerns and walks you through setup in a way that's practical for non-technical users.
Choosing a password manager: for most users, 1Password ($3/month) or Bitwarden (free, open-source) are the top recommendations. 1Password has the most polished interface, excellent browser extensions, and strong family sharing features. Bitwarden is free for individuals, open-source (independently audited), and has all the core features most users need. Dashlane and Keeper are strong alternatives with additional features like dark web monitoring. Avoid LastPass — it suffered multiple serious breaches in 2022 that exposed encrypted password vaults, and its security practices have been widely criticized.
Setting up your master password: your master password is the one password you must memorize — it decrypts your entire vault. Make it a 6-7 word Diceware passphrase (example: 'correct-horse-battery-staple-river-moon'). Write it on paper and store it somewhere physically secure — a safe, a lockbox, or with a trusted person. Do not store it digitally anywhere. Do not use a master password you've used before. This is the one password that must be both memorable and never written in any digital form.
Importing your existing passwords: most password managers can import passwords from your browser (Chrome, Firefox, Safari) or from other password managers. In Chrome, go to Settings > Passwords > Export. In 1Password, go to File > Import. In Bitwarden, go to Tools > Import Data. After importing, review the list — you'll likely find dozens of accounts you'd forgotten about. This is a good time to identify which accounts use the same password (your password manager will flag these) and prioritize changing them.
Installing browser extensions: the browser extension is what makes a password manager practical for daily use. Install the extension for your primary browser (Chrome, Firefox, Edge, Safari) and log in with your master password. The extension will auto-fill credentials when you visit sites in your vault. When you create a new account on any site, the extension will offer to generate a strong random password and save it automatically. This is the workflow that makes password managers effortless once set up.
The first week: don't try to change all your passwords at once — it's overwhelming and leads to abandonment. Instead, change passwords opportunistically: whenever you log into a site, let your password manager generate a new strong password and save it. Within a few weeks, your most-used accounts will have strong unique passwords. Prioritize changing passwords on your most sensitive accounts first: primary email, banking, investment accounts, healthcare, and social media. Enable 2FA on these accounts at the same time. Within a month of consistent use, your security posture will be dramatically improved.
Safety 1st Editorial Team
This article is credited to Safety 1st Editorial Team. Safety 1st Consumer Protection has republished this content with attribution.