Which password should I change first?

Your email account. It is used to reset passwords on other services, so securing it protects everything downstream. Follow with banking, cloud storage, and government accounts.

Is it safe to store recovery codes in the password manager?

Yes for day-to-day access, but keep a paper copy somewhere else as well. If the vault itself becomes unavailable, the online copy cannot help you.

Do password managers work without an internet connection?

Most have an offline mode with a local encrypted copy. Check that the app can unlock and fill entries with the network off before you rely on it while travelling.

Should I use a passkey instead of a password?

Use passkeys where a service offers them; they resist phishing and remove the password from the login. Keep the password manager as the place that stores and syncs them.

Set Up a Password Manager in a Week

A password manager only helps once it holds the logins you actually use, and that migration is where most attempts stall. Doing it in one sitting invites mistakes; spreading it across a week gives you time to verify each account and keep a way back in. This is the order that keeps you signed in while the vault fills up.

Laptop on a table showing a padlock security screen — IMG Photo: Pexels.

Day one: install and protect the vault

Choose a manager that runs on the devices you own and has a browser extension. Install it on the computer you use most, then create the master password. Length beats complexity here: a long phrase you can type accurately is stronger and more usable than a short string of symbols you will forget.

Write the master password on paper and store it somewhere physically secure, not in a note on the same device. Enable biometric unlock if the app supports it, but keep the typed password as the fallback. The vault is only as safe as the recovery path you have not tested yet.

Day two: import what you have

Most browsers can export saved passwords to a file. Import that file into the manager, then delete the export file securely once the import is confirmed. Do not leave a plain-text password list in the downloads folder, even temporarily.

Expect duplicates and old accounts. The import is not a cleanup step; it is a census. Leave the duplicates for the last day, and use today to check that each entry opens the site it belongs to.

Day three: secure email first

Email is the reset key for almost everything else, so it gets the first new unique password. Change it inside the manager, confirm the login works in a private window, and only then move to banking and government accounts. Work down from the accounts that can reset others to the ones that cannot.

Replace reused passwords as you go rather than all at once. A reused one exposed in an old breach is a risk today; a single account with a weak password can wait until tomorrow without changing the plan.

Day four: add two-factor properly

A password manager removes reuse, but a stolen password still opens the account. Turn on two-factor authentication, preferring an authenticator app or a security key over text messages where the service offers the choice. Store the shared secret or the recovery codes inside the vault as you enrol each account.

Not every account needs the same protection. Prioritise email, banking, cloud storage, and any account that can spend money or reset another. The CISA guidance on strong passwords at cisa.gov explains the length and reuse rules that the manager makes practical.

Laptop and phone showing a security app prompt — IMG Photo: Pexels.

Day five: test the recovery path

Recovery is the part people skip. Print or write the recovery kit, including the master password hint, the emergency access details, and the backup codes for critical two-factor accounts. Store the paper away from the computer. Then test one recovery in a controlled way so you know the process works.

Recovery codes deserve their own plan, including where they live and what happens if a phone is lost. We cover that in two-factor recovery codes.

Day six and seven: clean and settle in

Delete duplicate entries, close accounts you no longer use, and remove saved passwords from the browser once the manager is trusted. Keep the extension installed and let it offer to save new logins, but review the suggestion before accepting it; a mistyped entry is worse than no entry.

One long master password, stored offline.
Unique password for every account, generated by the manager.
Two-factor on email, money, and cloud storage first.
Recovery kit printed and tested.
Browser password store emptied after migration.

A week is enough to move the accounts that matter. The rest can follow as you use them, and the habit of generating instead of inventing is what keeps the vault useful.

What to do when a site refuses to cooperate

Some old services reject long generated passwords or block paste. Use the manager's option to generate a shorter value within the site's limits, record it, and move on. If a site cannot support two-factor or a modern password, treat it as a site to replace, not a reason to weaken the rest of your vault.