Accounts and passwords
How to set up a password manager, step by step
By Brennan Decker. Published . Last reviewed . Every fact links to its source.
The short answer
Pick one, create a long main password you’ll remember, and turn on two-step login for it (NCSC). Then bring in the passwords your browser already saved, and install it on your phone.
After that, let it make a new, different password each time you sign up or change a password (CISA).
Before you start
Set aside a quiet half hour at home, on your own computer. NCSC says not to save passwords on shared or public computers (NCSC). Have your phone nearby.
Step 1: Choose one
- All Apple devices? The free Passwords app is already on your iPhone, iPad, and Mac, and syncs with iCloud Keychain (Apple).
- Android phone or Chrome browser? Google Password Manager is built in (Google).
- A mix, like an iPhone and a Windows laptop? A standalone app such as 1Password or Bitwarden can sync across different browsers and devices (NCSC).
NCSC suggests thinking about which devices you use, whether you’d pay or want free, and extras like sharing passwords with family or breach alerts (NCSC). CISA suggests reading reviews from a trusted source before you pick (CISA).
Step 2: Make your main password
- Make it long. CISA suggests a memorable passphrase made of several random words (CISA).
- Use it only here. It’s the one password you have to remember, so don’t reuse it (CISA).
- Set up a recovery option now. Many apps offer hints or emergency access through someone you trust (NCSC). Bitwarden says it can’t reset a forgotten master password (Bitwarden). 1Password also gives you a Secret Key and an Emergency Kit to keep safe (1Password).
Step 3: Turn on two-step login
Find two-step login (also called two-factor authentication or 2FA) in the password manager’s security settings and turn it on. NCSC says this keeps out someone who learns your main password (NCSC). Our 2FA guide walks through the options. If you use Apple Passwords or Google Password Manager, this means turning on 2FA for your Apple Account or Google Account.
Step 4: Bring in the passwords your browser saved
- Export your saved passwords from your browser as a .CSV file. Your browser’s help pages explain how (Google).
- Import that file into your new password manager. 1Password and Bitwarden both have import tools (1Password, Bitwarden), and Google can import a .CSV at passwords.google.com (Google).
- Delete the .CSV file when you’re done. It holds your passwords in plain text, and Google’s instructions end with deleting it (Google).
Step 5: Set it up on your phone
- Install the app and sign in with your main password.
- Turn it on for autofill. On Android, choose your password manager as the autofill service in Settings. On iPhone, choose it in AutoFill settings (Google).
- Using Apple Passwords? Keep your devices updated so the Passwords app and iCloud Keychain sync (Apple).
Step 6: Fix your most important passwords first
Start with email, banking, and shopping accounts (CISA). Change each to a new password the app creates, and fix any it flags as weak, reused, or leaked (CISA, Apple). You don’t need to do them all in one day.
Common questions
Do I have to pay for a password manager?
No. CISA says some are free, like the ones built into web browsers (CISA). Some standalone apps also have free versions (NCSC).
Is it safe to import my passwords?
Yes, on your own computer. Just delete the exported .CSV file afterward (Google).
What if I forget my main password?
Set up recovery options at the start. NCSC says many password managers offer hints or emergency contacts (NCSC).
Should I keep letting my browser save passwords too?
Pick one place to keep them so they don’t get out of sync. NCSC says browser saving is fine on your own devices (NCSC).
This page is general information, not legal or financial advice. If money already left your account, call your bank or card company first.