Set up a password manager - the one change that fixes the most
Reusing the same password is the single thing that turns one leaked website into every account you own. A password manager ends that - it remembers a different strong password for everything, and you remember one. It’s free, it takes about twenty minutes to start, and after that it saves you time rather than costing it. You don’t need to move everything over at once - start the vault, fix the few that matter, and let the rest fill in as you go.
Pick one you’ll actually use
The best manager is the one you’ll stick with. If you want no extra apps, the one already built into your phone and browser is a fine place to start - iCloud Keychain on Apple, Google Password Manager on Android and Chrome. If you’d rather have one that works the same everywhere - phone, laptop, any browser - Bitwarden is free, open-source, and does the job well.
Honest note: stick to names like these. Avoid the no-name “free password saver” browser add-ons you’ve never heard of - this is the one app that holds the keys to everything.
Bitwarden · free and open-source →Create one master password - and make it a good one
This becomes the only password you have to remember, so make it long and unlike anything you use elsewhere. Use six words chosen at random, ideally by rolling dice against the EFF word list (the Diceware method), for example copper donkey velvet harbour lantern moss. Six random words are far stronger than three or four a person picks - and this is the one password that guards everything.
Honest caveat: if you forget the master password, no one - not even the company that makes the manager - can recover your vault. That’s exactly why it’s private, but it means the backup matters: write it once on paper and keep it somewhere safe at home, not on a sticky note stuck to the laptop.
EFF · dice-generated passphrases →Install the app and the browser bit
Put the manager’s app on your phone and its extension in your browser, then switch on unlock by fingerprint or face so you’re not typing the master password all day. Now it can offer to fill your logins and save new ones as you sign in.
Import what’s already there - don’t redo it by hand
Most managers can import the passwords your browser has been quietly saving for years. Do that first. Then - this bit matters - turn off your browser’s own offer to save passwords, so everything lives in one place instead of two half-full ones.
Fix the worst three first
Don’t try to change everything in one sitting. Change the passwords on your email, your bank, and anything else that really matters to fresh, unique ones using the manager’s built-in generator. Those few cover most of your risk; the rest you can update naturally the next time you log in to each site.
This is the step the rest of your plan stands on - locking down your email next needs a strong, unique password to live in here first.
Put a second lock on the manager itself
Add two-step sign-in to the password manager - an app code, not a text message. It’s the one vault that protects all the others, so it earns the extra lock.
Set up a way back in
Save your recovery or emergency code somewhere safe - ideally with your passport and other important papers. If you ever lose your phone, this is what gets you back into everything. Worth a yearly glance to check it still works.
“Isn’t putting all my passwords in one place risky?”
It feels that way, but it’s backwards. The real risk is reuse: one leaked site today unlocks everything that shares that password. A manager’s vault is encrypted - even the company running it can’t read what’s inside - and a breach of one website no longer spreads to the rest. One strong lock on a solid vault beats fifty weak locks you reused.
“Do I need to pay for one?”
No. The built-in managers are free, and Bitwarden’s free tier covers everything a normal person needs. Paid tiers (1Password, Bitwarden Premium) add family sharing and a few extras - nice, not necessary. Don’t let “free” make you think it’s second-best; here it genuinely isn’t.
Last checked: 16 October 2026. App menus move around - if a setting isn’t where we say, tell us.