Almost every account takeover starts the same boring way: a password you reused somewhere shows up in a breach, and attackers try that email-and-password combo on every site that matters. It’s called credential stuffing, it’s automated, and it works precisely because humans reuse passwords. A password manager ends this problem completely — it gives every account its own long, random password that you never have to remember or type. Set one up in the next thirty minutes and you’ve closed the most common door attackers walk through.

While we’re here, we’ll also cover passkeys, the newer login method that’s genuinely better than passwords for the sites that support it.

Why a password manager, not your brain or your browser

  • Your brain can’t create and recall a hundred unique random passwords. So it reuses and patterns them, which is exactly the weakness attackers exploit.
  • Your browser’s built-in saver is fine and far better than nothing — but a dedicated manager works across every browser and device, stores more than passwords, and makes it easy to audit for reused and breached credentials.

The whole model is: you memorize one strong master password (or unlock with your fingerprint/face), and the manager handles everything else — generating, storing, and autofilling a unique password per site.

Pick a manager

Any reputable, well-audited manager is a massive upgrade. Good options:

  • Bitwarden — open source, audited, excellent free tier, works everywhere. The easy default recommendation.
  • 1Password — polished, great family sharing, paid.
  • Proton Pass — from the Proton privacy ecosystem, integrates with their email and aliases.
  • KeePassXC — fully offline and local, for people who want zero cloud. More manual, maximum control.

Avoid managers bundled with adware, and avoid spreadsheets or notes apps — those aren’t encrypted for this purpose.

The 30-minute setup

1. Create your account and master password (10 min)

Your master password is the one key to everything, so make it strong and memorable. The best trick is a passphrase: four to six random words strung together, like correct-harbor-village-antelope-9. It’s long enough to be effectively uncrackable but easy to remember. Write it down on paper and store it somewhere safe (a home safe, a sealed envelope). You cannot recover a forgotten master password on most managers — that’s the point.

2. Install everywhere (5 min)

Add the browser extension on your computer and the app on your phone. Turn on autofill. Now the manager can capture logins as you use them and fill them automatically.

3. Import or capture your existing logins (5 min)

Most managers can import saved passwords straight from your browser. Do that, then let the manager capture anything it missed as you log in over the next couple of weeks.

4. Fix your worst passwords first (10 min)

Open the manager’s security dashboard (Bitwarden calls it Vault Health / Data Breach reports; others have similar). It flags reused, weak, and breached passwords. Don’t try to fix all hundred today. Fix these, in order:

  1. Email — it’s the master key that resets everything else.
  2. Banking and financial accounts.
  3. Anything flagged as appearing in a breach.
  4. Anything reused across multiple sites.

For each, log in, use the manager’s generate button to create a fresh random password, and save it. Twenty minutes of this on your top accounts removes most of your real-world risk.

Turn on two-factor authentication (the other half)

A unique password stops reuse attacks; two-factor authentication (2FA) stops an attacker who somehow gets the password anyway. Turn it on at least for email, banking, and your password manager itself.

  • Best everyday 2FA: an authenticator app (or your password manager’s built-in TOTP) that generates rotating codes.
  • Strongest 2FA: a hardware security key (like a YubiKey) — we cover these on the gear page.
  • Avoid SMS 2FA when you can. Text-message codes can be stolen via SIM-swapping. They’re still better than no 2FA, so use them where that’s the only option — but prefer an app or key.

Passkeys: better than passwords, where available

Passkeys are the emerging replacement for passwords. Instead of a secret you type, your device holds a private key and proves your identity with your fingerprint, face, or PIN. Two things make them a real upgrade:

  • They can’t be phished. A passkey is cryptographically bound to the real site, so a look-alike phishing page simply can’t use it. This defeats the most effective attack there is.
  • There’s nothing to breach. The site only stores a public key, useless to a thief. No password to reuse, leak, or steal.

How to use them without getting confused:

  • When a site (Google, Apple, Microsoft, PayPal, GitHub, and a growing list) offers to “create a passkey,” say yes.
  • Store passkeys in your password manager rather than locking them to a single device — Bitwarden, 1Password, Proton Pass, and Apple/Google all sync passkeys now. That way a lost phone doesn’t lock you out.
  • Keep a password or a second passkey as backup for any critical account, so you’re never dependent on one device.

Passkeys don’t exist everywhere yet, so you’ll use both for a while. That’s fine — a password manager holds both kinds happily.

The payoff

Thirty minutes gets you: a unique, uncrackable password on every account you care about, an alert the next time one of them appears in a breach, phishing-resistant passkeys where they’re offered, and one master password to rule them all. It’s the highest-security-return habit in all of personal privacy and security.

Do it now while you’re thinking about it, then check it off in the privacy checklist.