Password Manager Best Practices
Choose, set up, and live with a password manager without locking yourself out.
A password manager generates and stores unique, strong passwords for every site, locked behind one master password you memorise. Pick a provider with end-to-end encryption, set a long passphrase, enable 2FA, and store an emergency recovery method offline.
Key takeaways
- One unique password per site, generated by the manager.
- The master password should be a long passphrase — never reused anywhere.
- Enable 2FA on the manager itself.
- Plan an offline recovery method before you need it.
Why a manager beats memorising
Humans recycle passwords; we can’t help it. A manager removes the temptation by generating unique 20+ character passwords for every site and filling them in for you.
Choosing one
Look for end-to-end encryption (the provider can’t read your vault), a recent third-party audit, and clear export options. Open-source options like Bitwarden are well-regarded; commercial options like 1Password offer polished interfaces and family plans.
Setting your master passphrase
Four to six unrelated words is easier to remember than a short string of symbols and just as strong. Don’t reuse the master passphrase anywhere else, ever.
Recovery planning
Store an encrypted backup of your vault, a paper copy of recovery codes in a safe, or designate an emergency contact within the app. Plan this on day one — not after you’ve been locked out.
Frequently asked questions
Is it safe to put all passwords in one place?
Yes, when the vault is end-to-end encrypted. The risk of password reuse is much greater than the risk of a well-built manager being breached.
Browser-built-in password managers — good enough?
Better than reuse, but dedicated managers offer cross-device sync, secure sharing, and stronger recovery.
What if the company goes out of business?
Export your vault periodically. Most managers offer encrypted exports.
Sources & further reading
We cite primary sources whenever possible. Below is the reference list relevant to this category. Specific facts in this article are checked against vendor documentation and the sources we link to inline.
Related guides
Phishing Attacks: How to Spot and Avoid Them in 2026
The single most common way ordinary people lose money online — and how to recognise it.
Read article → CybersecurityTwo-Factor Authentication: A Complete Beginner’s Guide
The single most effective security upgrade most people can make in five minutes.
Read article → CybersecurityRansomware Protection for Home Users: A Practical Guide
Backups, updates, and a few simple habits that prevent the worst day of your digital life.
Read article →