First password manager: where to start

The password manager stores the login data in a secure safe. When logging in, you select the saved entry instead of remembering the password. This allows each account to have its own random password, including one that you cannot recite from memory.

The biggest change is not to install the application. It is to abandon one "good password" used for everything. Start with a small test to make a habit of saving changes.

Select a solution that fits your devices

A built-in manager can suffice if you use one ecosystem. A separate application can be more convenient when you work on different systems and browsers. Check three things before setting up an account:

• Can you read the passwords on your phone and computer that you actually use?
• How will you regain access after losing your phone or forgetting your main password?
• Can you export entries if you want to change suppliers later?

Download the application or extension from the link on the manufacturer's official website. Do not install several managers at once: overlapping write windows will make it difficult to determine where the password has hit.

Secure the password vault itself

If the application requires a main password, use a long, unique phrase created by a trusted password manager. Do not use a quote, song text or phrase from an example in the guide.

Writing a copy on a paper hidden in a safe place may be a reasonable security against forgetting. A card taped to the monitor is not. Read the recovery rules: not every supplier can restore access to encrypted data.

Enable 2FA for the manager if available. Keep his recovery code out of this safe, too. Otherwise, you may need access to the manager to regain access to the manager.

Change password to one account

The first attempt is to select the account to which you have a running recovery. When you get to know the service, take care of the mail and important services.

1. Log in to change your password. Keep this session open.
2. Generate a new password in the manager. Save it in the correct entry, along with the service address and user name.
3. Approve the change to the service. Check if the manager has a new version already — filling in the form does not always update the record.
4. Open the second window and sign in with a new password. Finish the previous session only after success.

If you have an error, do not delete the entry. Check your account name, page address and password history if the manager makes it available.

What to do with the old passwords?

Add more accounts when using the Internet. First, change the passwords you want to repeat and those you suspect to be disclosed. Import saves existing passwords; does not change them in the service. A hundred imported entries with the same password still need to be arranged.

When importing, watch the CSV file: often contains passwords with open text. Do not send it by email and don't leave it in a folder synchronized with the cloud. After checking the import remove unnecessary copies according to the supplier's instructions.

When autofilling doesn't offer anything

First check the address. No hint can be derived from another subdomain form, but it can also help notice a fake page. Do not copy the password instinctively to any site that asks for it.

At the end, lock and unlock the manager, then check the access on the second device if you plan to use it there. A successful start means that you can use the stored data and you know where to look for help when losing access.