Setting up a password manager without locking yourself out

CISA’s consumer advice asks for passwords of at least 16 characters, random, and unique to each account — and then, sensibly, recommends a password manager, because nobody produces two hundred of those by hand. The tool is not the hard part. The hard part is arranging things so that the day you lose your phone is not also the day you lose every account you own.

The problem a manager actually solves

It is not that your passwords are too simple. It is that there are too many of them, and the human response to that is reuse. Reuse converts one company’s breach into access to your other accounts.

A manager removes the reason to reuse. Every account gets a long random string, because remembering it is no longer your job. That single change does more than any complexity rule ever did — which is why NIST replaced complexity rules with blocklist screening against known-compromised passwords.

Choose the master password first

Decide on your master password before you install anything, because it is the one credential the tool cannot help you with. Make it a passphrase of several unrelated words, at least 16 characters, and used nowhere else.

Work out how you would get into your accounts if your phone vanished. That answer needs to exist before you move your passwords into a single place, not after.

Check your primary email account first. It is the reset route for everything else, so it needs its own strong password and its own second factor regardless of what the manager does.

The setup, in order

1. Install the manager and set the master passphrase. Write it on paper once and store the paper somewhere you would keep a passport. This is the only password you should ever write down.
2. Turn on a second factor for the manager itself, choosing a passkey or security key if offered, an authenticator app if not.
3. Save and store the account recovery material the manager gives you — a recovery key, emergency kit or set of one-time codes. Print it. Keep it separate from the device.
4. Import saved passwords from your browser, then run the manager’s reuse and breach report if it has one.
5. Fix reuse first, not weakness. Change the duplicates before you change the short-but-unique ones.
6. Work down your accounts in order of what they unlock — email, then banking, then everything else — generating a new long random password for each.
7. Leave a small number of passphrases memorised: the master password, your email, and your computer login.

How to check it worked

• Log out of the manager entirely and log back in using only the master passphrase and your second factor. If you cannot, you have not finished setting it up.
• Sign in to one important account on a second device using the vault, to confirm the sync is real and not just local.
• Confirm your recovery material is somewhere you can reach without the device the manager is installed on.
• Check that no account still lists a password hint or a security question as a fallback. NIST prohibits verifiers from offering either; where a site still does, leave them empty.
• Confirm you have not scheduled yourself a rotation reminder. NIST prohibits verifiers requiring periodic changes, and changing good passwords on a calendar makes them worse, not better.

Where a password manager stops helping

It does not make your logins phishing-resistant. NIST states that passwords are not phishing-resistant, and a manager holding a perfect 40-character string does not change that if you are persuaded to paste it into a fraudulent page. A manager that autofills only on matching domains does help here, since it will decline to fill on a lookalike site — treat a refusal to autofill as a warning rather than a glitch.

It does not protect the account behind it. If the master password is reused elsewhere, the vault inherits that weakness.

And it is not a substitute for a second factor. CISA’s ranking still applies: a passkey or security key on your critical accounts, an authenticator app where that is unavailable, SMS only when nothing else is offered.

Sources: CISA — four easy steps to stay safe online · NIST SP 800-63B-4, Digital Identity Guidelines · CISA — implementing phishing-resistant MFA · CISA — multi-factor authentication

Reviewed 27 August 2026 by the CyberArtical editorial team against primary guidance from CISA and NIST. Security guidance changes over time; where our earlier version of this page said something different, we say so in the article rather than editing it out quietly.