Setting Up Your Password Manager

After Setup: Hardening and Maintaining Your Vault

Getting your passwords into a manager is only the first stage. The real security gains come from what you do in the following weeks, once the vault becomes part of your daily routine.

Build a strong master password

Your master password is the one secret the whole system depends on, so treat it differently from everything else. A passphrase of several random, unrelated words is easier to remember and harder to crack than a short string of symbols. Never reuse it anywhere, and avoid song lyrics, quotes or personal details. Many people write it down once and keep that paper somewhere physically secure at home until it is memorised.

Plan for recovery before you need it

Most managers offer an emergency kit, recovery codes or a recovery key. Save these offline, because with many zero-knowledge services the provider cannot reset your master password for you. If your manager supports emergency access or a trusted contact, consider setting it up so a family member can reach critical accounts if something happens to you.

Run a vault health check

Once your logins are imported, use the built-in security report most managers include. It typically flags:

• Reused passwords: change these first, starting with email, banking and cloud storage.
• Weak or short passwords: replace them with generated ones of 16 characters or more.
• Exposed credentials: accounts that appear in known breaches should be changed immediately.

Your email account deserves priority, since it can usually reset every other password you own.

Clean up old habits

After migrating, turn off your browser's built-in password saving so credentials do not live in two places, and delete any exported CSV files, which store passwords in plain text. Remove old notes, spreadsheets or sticky notes that held logins.

Use autofill as a phishing check

Autofill matches the saved website address. If your manager refuses to fill a login on a page that looks like your bank, stop and check the URL; that hesitation is often your first warning of a phishing site. For the latest scams doing the rounds, keep an eye on our threat feed.

Finally, schedule a quick review every few months. If you would like help or want to compare setups with others, bring your questions to one of our meetups.