Password managers: how to start without losing everything

The thing that stops most people from starting a password manager isn’t skepticism — it’s the fear of getting locked out of everything mid-switch. Done in the right order, that doesn’t happen.

Pick one, and know that any of the mainstream options is fine

Bitwarden is a solid free option. The password manager built into your browser or operating system (Chrome, Safari, Windows) is also genuinely fine for most people and has the advantage of already being there. The biggest security gain comes from using any password manager consistently, not from which specific one you pick.

The one rule that prevents getting locked out

Your master password — the one password that unlocks the manager itself — needs to be something you will never forget and never store digitally anywhere else. Write it down on paper and keep that paper somewhere safe (not taped to the laptop). This is the single point of failure in the whole system, so treat it differently from every other password you own.

Starting without redoing everything at once

1. Install it and let it import passwords already saved in your browser — most managers do this automatically, which gives you a working starting point instead of a blank slate.
2. Secure your email first. It can reset almost every other account, which makes it the highest-value target to protect. Change its password to a strong, unique one and let the manager generate and remember it.
3. Then banking and anything with stored payment information.
4. Then everything else, gradually — as you naturally log into a site, let the manager generate a new unique password instead of using the old reused one. You don’t need to sit down and change fifty passwords in one evening.

What happens when you’re on a new device

This is the part people worry about most. Install the same password manager on the new device and sign in with your master password — everything syncs. This is exactly why the master password matters so much: it’s the one thing you truly cannot lose.

Add two-factor authentication once passwords are handled

A password manager solves reuse; two-factor authentication solves what happens if a password leaks anyway. Turn it on for email first, then anywhere else that offers it — an authenticator app is stronger than a text message, but a text code beats nothing.

When it’s worth having someone set it up with you

If the idea of migrating everything still feels daunting, we can sit down and do it together — it’s usually faster and less intimidating with someone walking through it than doing it alone at 11pm worried about locking yourself out. Part of the security support we provide across Manhattan.