Password Manager Setup Guide
One evening, ~2 hours, and password reuse dies forever. This is the single highest-return security project a normal person can do — here is the exact sequence.
Hour 1: Install and import
- Pick one: Bitwarden (free, excellent), 1Password (best UX, paid), or Apple iCloud Keychain (free, Apple-only). Any of the three beats none by miles — decide in five minutes.
- Create the master password: four random words you can type reliably. Write it on paper, stored somewhere safe — this is the one password you memorize.
- Import existing passwords from your browser. Then turn the browser's built-in saver off to avoid split-brain logins.
- Install everywhere: phone, laptop, browser extension. A manager you have to open manually is one you will bypass.
Hour 2: Fix the top 20
Do not boil the ocean. Rotate these first, using the manager's generator (20+ characters, all types):
| Priority | Accounts | Why first |
|---|---|---|
| 1 | Email (all of it) | Email resets everything else — it is the master key to your life |
| 2 | Banking, investing, PayPal | Direct money access |
| 3 | Apple / Google account | Device, photos, location, purchase history |
| 4 | Password-reused stragglers | Run the manager's reuse report; kill every duplicate |
Then: 2FA on the crown jewels
With passwords unique, add authenticator-app 2FA to email, banking, and cloud accounts. Store backup codes in the manager's secure notes. SMS codes beat nothing, but SIM-swap attacks make app codes strictly better — twenty minutes now prevents the worst account-takeover story.
The maintenance rule: new account = generated password + saved immediately, no exceptions. Old reused passwords die as you touch them. In a month, reuse is extinct and logins are faster than before — security that saves time is security that sticks.