How to Set Up a Password Manager in 15 Minutes

People put off setting up a password manager because it sounds like a bigger project than it is. It's seven short steps, most of them under three minutes each, and you can realistically be done before your coffee gets cold.

Step 1: Pick one (2 minutes)

Any reputable password manager works far better than none, options like Bitwarden (free tier is usable), 1Password, or Google's built-in manager if you're already fully in the Chrome/Android ecosystem, are all reasonable. Bitwarden is a common recommendation for a first-timer because the free tier has no meaningful feature gate and it works across every platform, browser, and phone OS.

Step 2: Install the browser extension and phone app (3 minutes)

Install the browser extension on whatever browser you use most, and the mobile app on your phone, then sign in with the same account on both. This pairing is what makes autofill work everywhere, not just in one place, install just one and you'll end up not using it consistently.

Step 3: Create and physically write down your master password (2 minutes)

Your master password is the one password you'll remember and type, everything else gets generated and stored. Make it a random-feeling but memorable phrase of 4 to 5 unrelated words rather than a short complex string, length matters more than symbol-stuffing for this one password. Write it down physically and store that paper somewhere safe, not digitally, because if you're ever locked out with no recovery method, everything inside becomes unrecoverable.

Step 4: Import existing passwords from your browser (2 minutes)

If you've been letting Chrome or your phone save passwords, most password managers have a one-click import from browser-saved passwords, found in the manager's settings under Import. This gets you a working baseline immediately instead of starting from zero.

Step 5: Turn on autofill and turn off the browser's own saving (2 minutes)

Enable autofill in the password manager's extension settings, then disable your browser's native password saving so you're not maintaining two separate, conflicting stores. This step is easy to skip and is exactly why people abandon password managers, without autofill it feels like more work than just typing a remembered password.

Step 6: Fix your worst reused passwords first (3 minutes to start, ongoing)

Most password managers include a security or breach check that flags weak and reused passwords. Don't try to fix everything today, start with your email account and anything financial, generate a new unique password for each using the manager's built-in generator (aim for 16+ random characters where the site allows it), and let the rest happen gradually as you log into other sites over the coming weeks.

What to Do If You Manage Passwords for a Family or Small Team

Most password managers offer a family or team plan with secure sharing features, letting you share specific logins, like a streaming account or a shared utility bill login, without ever revealing the actual password in plain text to the other person. Worth setting up if you're currently sharing passwords over WhatsApp or a shared notes app, which leaves an unencrypted copy sitting in your chat history indefinitely.

Handling Sites That Block Password Manager Autofill

A small number of sites, particularly some Indian banking and government portals, disable autofill or paste functionality on their login fields for security reasons. In these specific cases, copying the password from the manager and pasting it manually, or using the manager's browser extension's built-in copy button instead of the autofill feature, works around the restriction without compromising the underlying security benefit.

Why Biometric Unlock Doesn't Weaken the System

Using fingerprint or face unlock to open the password manager app itself is a convenience layer on top of the master password, not a replacement for it. The underlying vault remains encrypted with your actual master password, and biometric unlock can typically be disabled or requires falling back to the master password after a device restart or a set time period. The strong master password is still doing the real security work underneath.

Step 7: Store your 2FA codes and set up account recovery (1 minute)

Most password managers can also store TOTP authenticator codes alongside the password for each site, so a single autofill handles both. Separately, set up the manager's own account recovery option (an emergency contact, recovery code, or biometric backup depending on the app) so losing your phone doesn't lock you out permanently.

What Happens If the Password Manager Company Itself Gets Breached

Reputable password managers use zero-knowledge encryption, meaning your vault is encrypted and decrypted locally using your master password before it ever leaves your device, so even if the company's own servers were breached, an attacker would only obtain encrypted data they can't practically decrypt without your specific master password, which the company itself never has access to at any point.

What to Do About Passwords Saved in Old Browsers or Devices

Passwords left sitting in an old phone's browser or a laptop you no longer use represent a genuine loose end even after switching to a proper manager. Signing into those old browsers one more time to export or delete saved credentials closes a gap that migrating to a new tool alone doesn't address.

Checking Whether Your Manager Supports Passkeys Yet

A growing number of sites now support passkeys as a passwordless alternative, and most major password managers already store and sync these alongside traditional passwords. Worth checking your manager's own passkey support once it's set up, since this is likely to matter more over the next few years, not less.

Why a Password Manager Doesn't Replace Common Sense on Public Computers

Autofill convenience should stop the moment you're on a shared or public computer, a library terminal, a hotel business center. Logging in manually and clearing the session afterward, rather than letting a browser extension autofill on a device you don't control, avoids leaving credentials accessible to whoever happens to use that exact same shared machine next.

By the end of step six you've got one autofill login that works everywhere, passwords you never have to think up or remember again, and a standing check against future breaches — and everything past that point happens passively, a site at a time, as you go about using the internet normally.