How to Choose a Password Manager and Use It Well

When a website is breached, the stolen email and password pairs rarely stay with the original attacker. They are traded and fed into automated tools that try the same combination on email providers, shops, social networks and gaming platforms. This technique, called credential stuffing, only works when people reuse passwords, and it is one of the most common ways ordinary accounts are taken over.

Unique passwords break that chain. If each account has its own long random password, a leak at one service stays contained to that service. The catch is that nobody can remember dozens of random strings, and that is exactly the job a password manager is built to do.

A password manager stores your logins in an encrypted vault that opens with one master password, and often with your fingerprint or face on trusted devices. It generates long random passwords when you sign up or change a password, and fills them in for you when you sign in.

Autofill is also a quiet anti-phishing feature. A manager matches saved logins to the exact website address, so it normally will not offer your bank password on a look-alike domain. If your manager suddenly does not recognise a login page you use often, stop and check the address before typing anything by hand.

Most managers do more than store passwords. Common extras include secure notes for backup codes and recovery details, storage for passkeys, alerts when a saved password appears in a known breach, warnings about weak or reused passwords, and safe sharing with family members or a team.

Encryption comes first. Look for end-to-end encryption, sometimes described as a zero-knowledge design, which means your vault is encrypted on your own device and the provider cannot read it. Published security documentation and independent audits are good signs that a company takes this seriously.

Next, check that the manager works everywhere you do: in the browsers you use and on your phone and computer, with reliable sync between them. The vault itself should support two-factor authentication, ideally with an authenticator app or a security key, so that a stolen master password alone is not enough to open it.

Finally, think about leaving before you join. A good manager lets you export your data in a standard format, so you are never locked in. Read what happens if you forget your master password: some services offer a recovery kit or a trusted contact, while strict zero-knowledge designs may have no recovery at all, which makes a safely stored emergency sheet essential.

Browsers and operating systems now include capable password managers. Google Password Manager is built into Chrome and Android, Apple devices include a password manager that syncs through iCloud Keychain, and Microsoft Edge saves passwords to your Microsoft account. They cost nothing extra, are already on your device and sync automatically within their own ecosystem.

Their limit is that ecosystem. If you pair an iPhone with a Windows computer, or switch between several browsers, a built-in manager may not follow you everywhere comfortably. Standalone managers, including those offered by privacy-focused providers such as Proton, work across platforms and browsers and usually add richer sharing, secure notes and more flexible organisation.

Either choice is far better than reusing passwords. Pick the one you will actually use every day, and avoid splitting your logins across several managers, because that makes it easy to lose track of which copy is current.

Your master password is the one password you must remember, so make it long and memorable rather than short and complicated. A passphrase of several unrelated words is easier to type and much harder to guess than a short string of symbols. Never use it anywhere else.

Turn on two-factor authentication for the manager straight away and store its backup codes or emergency kit offline, for example on paper in a safe place at home. If your manager offers a recovery method, set it up now rather than after you get locked out.

Then adjust a few settings: lock the vault after a short period of inactivity, require the master password or biometrics after a restart, and keep the apps and browser extensions updated so you receive security fixes.

Most managers can import passwords saved in your browser or exported from another manager, usually as a CSV file. That file is plain, unencrypted text, so export it, import it right away and then delete it, including the copy in your downloads folder and in the recycle bin.

After the import, turn off the browser's own password saving if you moved to a standalone manager, so new logins do not end up in two places. Then open the manager's security report and start fixing reused and weak passwords. Begin with your email accounts, since they can reset everything else, then move on to financial, work and social accounts.

You do not need to change everything in one evening. Update each remaining password the next time you sign in to that site, and within a few weeks most of your vault will consist of unique, generated passwords.

Login details that reach you in an email, a shared document or on an order page belong in your manager, not in screenshots or plain notes. Create a new entry with the website address, username and password, and add the recovery email, backup codes and any other setup details in the entry's notes field.

If you bought an account on rStock, the delivered content appears on your order page as a delivery record linked to the order. Copy it into your manager, then change the password to a newly generated one, set your own recovery options and turn on two-factor authentication. Doing this promptly also lets you confirm that everything works while you can still open a dispute within the limited window after delivery. Always use such accounts in line with the brand's terms of use. rStock is not affiliated with any brand named in this article.

Once the account is secured, remove any extra copies you pasted into notes, chats or text files. Your manager should be the single place where the current password lives, which makes it easy to update and hard for anyone else to find.