How to Set Up a Password Manager: A Step-by-Step Beginner’s Guide

Setting up a password manager is quick, but order matters: secure the vault before you fill it. Choose the type, create the account, protect it with a strong master password and two-factor authentication, save recovery paperwork offline, install it everywhere, then import and replace weak passwords. Steps draw on Bitwarden Help and 1Password Support. For background, read Password Managers Explained: How They Work and Whether You Need One.

Step 1: Choose built-in or standalone

Decide where your vault will live first. Apple-only? Apple Passwords with iCloud Keychain is already there — Apple Support says it makes passwords and passkeys available on all approved devices. Chrome and Android only? Google Password Manager saves passwords to your Google Account across devices when signed in, per Google Chrome Help. Mixed devices, or family vaults? Choose a standalone app such as Bitwarden or 1Password. See Built-In vs Standalone Password Managers: Which Is Right for You? — but do not stall: a built-in set up today beats a standalone never installed.

Step 2: Create the account

Create the account on the provider’s official website or app, using an email you control — ideally your main email, because recovery messages go there. This is when the vault and its keys are created on your device. Bitwarden describes its design as zero-knowledge: you alone hold the keys that decrypt your vault data, encrypted locally before anything reaches its servers. Verify your email if asked.

Step 3: Choose a strong master password — a passphrase

Your master password unlocks everything else, so make it a passphrase: several random words together. The EFF’s guide recommends selecting a minimum of six words for a password manager master password, using dice and a word list to choose randomly, because people are poor at unpredictable choices alone. A long phrase of unrelated words resists automated cracking, yet is easier to remember and type than a short cluster of symbols. Never reuse another password here.

Step 4: Save your emergency and recovery kit offline

Save the provider’s recovery material offline. 1Password asks you to save an Emergency Kit at account creation: a PDF with your account details and a place to write your account password. It advises printing a copy to keep in a safe deposit box or with your passport, with your password written in. Treat recovery codes the same way: paper stored securely at home — not a phone photo, not a cloud file. In a zero-knowledge design the provider cannot reset your master password; this is your way back in.

Step 5: Turn on two-factor authentication for the manager itself

Before adding any real password, turn on two-factor authentication (two-step login) for the manager account. Bitwarden lists advanced two-step login in every account, and 1Password supports it too. Prefer an authenticator app or hardware key over texted codes; the EFF notes they are harder to redirect. Save backup codes alongside your Emergency Kit.

Step 6: Install the manager on your phone and browser

Install the manager where you sign in: its mobile app, and its browser extension or built-in setting on your computer. On iPhone, turn on iCloud Keychain if you chose Apple Passwords, plus AutoFill Passwords and Passkeys. For a standalone manager, enable it as the autofill provider in phone settings and add its extension to each browser. Sign in everywhere with the same account, confirm the vault syncs, and set it to lock automatically.

Step 7: Import the passwords your browser already saved

Now move existing logins in. Bitwarden’s help describes the flow for Chrome and Edge: open the browser’s password settings, choose Export Passwords and Download file, saving a comma-separated values (CSV) file; then in Bitwarden choose Tools, then Import, pick your vault and format, choose the file, and select Import. Data is encrypted locally before reaching the server. Critically, Bitwarden instructs you to delete the exported file afterwards — it holds passwords in readable form. 1Password likewise documents importing, including via CSV. So: export, import, check a few logins arrived, then delete the file.

Step 8: Let the manager save and update logins as you browse

Work in one direction now: let the manager fill or save each sign-in, generate passwords for new accounts, and update saved entries when sites make you change passwords. Google Chrome Help describes the same habit — Chrome asks to save a new password, and a generated password is saved automatically — and Apple describes Password AutoFill entering saved passwords and passkeys for you. Then turn off your browser’s separate save prompts.

Step 9: Change your most reused and weakest passwords first

Do not fix every account in one sitting. Change your email password first — whoever controls your email can reset almost everything else — then banking, then shopping and social accounts. Apple’s Passwords app alerts you to easily guessed, reused or leaked passwords, and Google Password Manager’s Checkup reports exposed and weak passwords: use those lists as your queue. For each account, generate a fresh, unique password.

Step 10: Add passkeys where they are offered

When a site offers a passkey, accept and save it in your manager. Apple describes passkeys as a replacement for passwords that is more convenient and more secure, uniquely generated per account and less vulnerable to phishing; Google Password Manager can save passkeys too. Keep the password as backup where allowed.

Common first-week mistakes to avoid

Five mistakes undo most of the benefit: reusing an old master password; skipping the recovery kit; leaving the export file in Downloads; keeping two managers active; and trying to replace every password in one session, then giving up. A steadier finish is what the Password Manager Security Checklist: 10 Settings to Check Today helps you maintain.

What this means

What this setup changes is who does the remembering. Before, security depended on your memory, so passwords stayed short, familiar and repeated — no human can hold hundreds of unique, random passwords. After setup, memory is responsible for only one long passphrase, and software handles generating, storing, filling and warning. That is why step order matters more than brand. A vault protected by a six-word passphrase, two-factor authentication and a printed recovery kit is strong even with only ten logins on day one. A vault with three hundred imported passwords but a reused master password and no recovery paperwork is fragile.

Compared with the alternatives, this process avoids two dead ends. Tracking unique passwords yourself — notebook, spreadsheet or memory — either collapses back into reuse or creates a single unencrypted list that can be copied or lost. Putting setup off until you have chosen the theoretically best manager leaves you exposed meanwhile; built-in options from Apple and Google are credible starting points, and moving to a standalone later is a documented export-and-import task, not a restart. The decision is reversible; a breach exploiting a reused password is not.

For US readers, the impact is measured at the next incident, not in today’s convenience — although sign-in does get faster once autofill works everywhere. The next time a retailer or streaming service announces a breach, your response shrinks to changing one generated password for that one site. Your email, bank and shopping accounts are not implicated, because they never shared it. That is the point of the hour this guide asks for: a one-time setup that turns future breaches from a household emergency into a minor chore, provided you keep the passphrase private, the recovery kit offline, and the manager as the single, trusted place where all of your passwords actually live from now on.

Bottom line

Order is the whole game: strong passphrase, two-factor authentication, printed recovery kit — then fill the vault. A half-filled, well-protected vault beats a full one guarded by a password you reuse somewhere else.

Read Next

• Password Managers Explained: How They Work and Whether You Need One
• Forgot Your Master Password? What Actually Happens Next

Sources

• Electronic Frontier Foundation, Surveillance Self-Defense — Creating Strong Passwords (accessed 7 November 2026)
• Bitwarden — Import from Chrome, Edge, & Chromium Browsers (accessed 7 November 2026)
• 1Password Support — Get to know your Emergency Kit (accessed 7 November 2026)
• Apple Support — Use the Passwords app to create, manage, and share passwords and passkeys (accessed 7 November 2026)