Password Manager Security Checklist: 10 Settings to Check Today

A password manager only protects you as well as the settings around it. Two documented examples show why the details matter: Bitwarden says two-step login protects your vault if someone gets hold of your master password, by requiring authentication from another source when you log in, and 1Password says to use a different authenticator app for your 1Password account itself, because storing that code inside 1Password would be like putting the key to a safe inside the safe. Work through this list against the model in Password Managers Explained: How They Work and Whether You Need One, check each item off honestly, and fix the worst gaps first.

1. Use a strong, unique master passphrase

Your master password is the one password you still have to remember, so make it a passphrase you do not use anywhere else. Why it matters: every other item in the vault depends on this one secret, and reuse means a breach at an unrelated site could be tried against your manager. How to check: ask whether you could have typed this same password into any other service, ever. If yes, change it while you are signed in, using the manager’s own change flow, then update your written copy the same day. Test it by signing out and back in on one device before you sign out everywhere.

2. Turn on two-factor authentication for the manager account

Why it matters: a second factor limits the damage if the master password alone is guessed, phished or copied. Bitwarden documents its setup path as Settings, then Security, then Two-step login in the web app, with methods including a FIDO2 WebAuthn credential such as a hardware key, an authenticator app, and email, and it notes that FIDO2 and authenticator methods are free for all users on that page. 1Password documents its path on 1Password.com as Manage Account, then More Actions, then Manage Two-Factor Authentication, then Set Up App, and tells you to write down the secret shown next to the QR code and store it somewhere safe. How to check: sign in on the web, open the security settings, and confirm a second factor is actually listed as active, not just planned. Prefer an authenticator app or a hardware key over SMS where the service offers that choice, and never store the manager’s own code only inside the manager it protects.

3. Save your recovery kit offline

Why it matters: recovery routes only work if you prepared them while you could sign in. 1Password’s Emergency Kit is a PDF with your sign-in address, email, Secret Key and a place to write your account password, and 1Password advises printing a copy for a safe deposit box or storage with a passport or birth certificate. Bitwarden users should likewise save any two-step login recovery material the service gives them and keep a written master password copy. How to check: physically put your hand on the printed kit or sealed envelope today. If you cannot find it, regenerate or re-save it while signed in, print it, write the current password on it, and tell a trusted person where it is. A kit saved only in the vault it is meant to rescue is not a recovery plan, a problem explored in Forgot Your Master Password? What Actually Happens Next.

4. Shorten the auto-lock timeout

Why it matters: an unlocked vault on a lost, stolen or briefly borrowed device is an open vault. A short auto-lock timeout limits that window without making daily use painful. How to check: open the manager’s settings on each phone and computer you use and look for the vault timeout or auto-lock setting. Set it to a short period that you will actually tolerate, lock the device and wait to confirm it behaves as set, and require the master password or a strong device unlock after a restart. Keep the setting generic across brands: menus differ, but every major manager exposes a timeout, and a timeout set to never is a failed check.

5. Use biometric unlock only on your own devices

Why it matters: Face ID, Touch ID, Windows Hello and Android biometrics are convenient ways to unlock a vault without typing, and 1Password’s recovery guidance shows they can also be a lifeline if you forget a password. The risk is scope: biometric unlock should only exist on devices you personally control, with your own face or fingerprint enrolled. How to check: list every device where the manager unlocks with your face or finger. Remove the manager, or turn off biometric unlock, on shared family computers, work machines you do not control, and old phones you no longer carry. Confirm no one else’s fingerprint or face is enrolled on a device that can unlock your vault.

6. Run the weak and reused password audit and fix the worst first

Why it matters: storing passwords does not fix passwords that are already weak, reused or exposed. Both major managers audit this for you. 1Password’s Watchtower, opened from the sidebar, tells you about breaches, weak passwords and reused passwords, and groups reused items by the password they share. Bitwarden’s vault health reports, opened from Reports in the web app, include Reused Passwords and Weak Passwords reports, and Bitwarden notes those reports run locally on your client so unencrypted data is not sent to Bitwarden. How to check: run the audit today, sort by the worst category first — exposed, then reused on email and financial accounts, then weak — and change a small batch completely rather than skimming all of them. Re-run the audit to prove the count fell.

7. Turn on breach alerts where offered

Why it matters: a password that was fine when you saved it can become dangerous after a site you use reports a breach. Watchtower is built around this idea: 1Password says it continually updates Watchtower as breaches are reported so you can change account details right away, and its categories include compromised websites and vulnerable passwords that were exposed in a data breach. Bitwarden’s reports likewise include an Exposed Passwords view in its health reporting. How to check: open the audit or privacy settings in your manager, confirm breach or Watchtower checking is enabled where a toggle exists, and act on any current compromised-website item by changing that site’s password on the site itself, not just dismissing the banner.

8. Update the app and the operating system, with auto-update on

Why it matters: the manager, the browser extension and the operating system are all part of the security chain, because autofill and passkeys run through them. An old extension on a new browser, or an unpatched phone, undermines careful vault settings. How to check: open your app store or the manager’s About screen on each device, confirm the manager is current, and turn on automatic updates for the app and the operating system where the device offers it. Then restart the browser once so extension updates actually apply. You do not need to chase version numbers in a checklist like this; you need the update switch on and no pending update left waiting.

9. Review shared vaults and remove people who no longer need access

Why it matters: sharing is useful until it outlives the reason for it. A former roommate, an ex-partner, an old contractor or a grown child who now has their own household may no longer need a shared streaming, Wi-Fi or household login, and every extra person is another device and another recovery path for those items. 1Password’s recovery page is a reminder of how powerful household roles are: a family organizer can recover accounts for other family members, so organizer status itself should be held only by people who should still have it. How to check: open each shared vault or family list, read every name, and remove anyone you cannot explain in one sentence. Check organizer and administrator roles separately from ordinary sharing.

10. Store passkeys in the manager and keep one backup login method

Why it matters: passkeys remove a password that can be phished, but an account with only one passkey on only one device creates a lockout risk. Storing passkeys in the manager lets them sync with the vault: Bitwarden says passkeys saved in Bitwarden are synced between devices where you use Bitwarden, and 1Password’s Watchtower can show logins where a passkey is available but not yet saved. How to check: pick one important account that offers a passkey, create it and save it in the manager, then sign in with it once to prove it works. Keep one backup login method for that account, such as its password stored in the vault plus its second factor, until you are confident the passkey works on your phone and your computer. The setup steps in How to Set Up a Password Manager: A Step-by-Step Beginner’s Guide will help if you are doing this during a first setup.

What this means

For a US reader, this checklist means your password manager should be judged less by its brand and more by ten observable settings you can verify in one sitting. Most account takeovers do not require defeating strong encryption. They use a reused password, a vault left unlocked, a second factor that was never turned on, a shared vault that still includes the wrong person, or a recovery kit that does not exist when it is needed. Each item above closes one of those ordinary doors. None of them requires buying anything new, and most take minutes once you are signed in.

The comparison that matters is between your vault today and your vault after this pass. Before, you may have had strong passwords stored inside a weakly protected container. After, the container itself has a unique passphrase, a second factor stored outside it, a printed recovery route, a short lock timeout, biometric unlock limited to your own hardware, and an audit report with a falling number of exposed and reused items. That is a different risk profile, even though the app icon on your phone looks exactly the same. It is also a fair way to compare managers if you switch: ask whether the new service lets you do all ten things clearly, not whether its marketing page uses the word secure more often.

Make this a habit with a test, not a feeling. Once you finish, sign out, lock your phone, hand it to yourself as if you were a stranger, and see what opens. Try to find your recovery kit with your hands. Open Watchtower or Reports again and read the numbers out loud. If a family member shares your vault, ask whether they still should. Security that survives those small physical tests is the kind that will survive a lost phone at an airport or a breach headline about a site you joined years ago and forgot. Run the whole list again after any big change: a new phone, a move, a breakup, a new job, or a family member leaving the household. That is when sharing lists and recovery plans quietly go stale, and a ten-item check is cheap insurance against discovering it during a lockout.

Bottom line

Judge your manager by ten settings you can verify in one sitting, not by its brand. Run the checklist today; most account takeovers walk through an open setting, not through broken encryption.

Read Next

• Password Managers Explained: How They Work and Whether You Need One
• Passkeys Explained: How They Work and Why They Are Replacing Passwords

Sources

• 1Password Support — Turn on two-factor authentication for your 1Password account (accessed 7 November 2026)
• Bitwarden — Two-Step Login Methods (accessed 7 November 2026)
• 1Password Support — Use Watchtower to find account details you need to change (accessed 7 November 2026)
• Bitwarden — Vault Health Reports (accessed 7 November 2026)