How to Manage Your Passwords: Choosing Where to Store Them and How to Switch

Nothing gets fixed until you stop relying on memory

If you follow the recommended advice, each password becomes a long random string, and you need a different one for every service. Remembering that many while meeting both conditions isn't realistic for any human. Reusing passwords isn't laziness; it's the natural result of a system that depends on memory.

• Remember only one: the master password that opens your vault
• Store the rest: generate a password for each service and save it straight away
• Don't type them either: letting autofill do it prevents typos and stops you entering passwords into fake sites

Set up this way, a leak at one service leaves all the others untouched. If you reuse passwords, on the other hand, the leaked combination gets tried on other services one after another and the damage spreads. Changing how you manage passwords does more good than making any single password stronger.

Comparing where to store passwords

You'll sometimes hear that saving passwords in the browser is dangerous, but it is far safer than carrying on reusing passwords. Its real weakness is less about security and more about convenience: it may not work if your phone and computer use different browsers, and it can't fill in logins inside apps. When it gets inconvenient, people drift back to easy-to-remember passwords.

How to create a master password

Because it's the key to your vault, this is the one password you must remember. It also has to be a string you don't use anywhere else. To combine memorability with strength, a passphrase of unrelated words works better than a random jumble of symbols.

• String together 4 or more unrelated words. The less it reads like a sentence, the better
• Avoid anything that can be looked up: birthdays, names of family or pets, addresses
• Never use it for any other service. Keep it for the master password only
• Writing it on paper is fine, as long as you keep it somewhere separate from your devices
• No need to change it regularly. Change it only if you suspect it has leaked

Avoid famous quotes or lines from films or anime as they are. Attackers keep lists of well-known phrases. The words must be your own choice and must not form a meaningful sequence. How to choose the words and how many you need is covered in how to create a passphrase.

Steps to move your current passwords

Try to change everything at once and you'll run out of steam halfway. Work through them in order of importance, spread over a few days.

1. 1

   1. Install a password manager and choose your master password

   Install it on every device you use and set up the browser extension. Get it to the point where autofill works before moving on.

2. 2

   2. Change your email password first

   Email is the hub used to reset passwords for other services. Until it's secure, locking down everything else doesn't mean much.

3. 3

   3. Change payment, banking and social media passwords

   These come next because the potential damage and impact are greatest. Use a generator to create a new string with the length and character types you want, paste it in and save it.

4. 4

   4. Import what's already saved in your browser

   You can export the browser's saved-password list and import it into the password manager. Once imported, delete the passwords stored in the browser and turn off its saving feature so you don't manage them in two places.

5. 5

   5. Make sure the exported file is gone

   The export file lists your passwords in plain text. When the import is done, delete it and empty the trash or recycle bin too.

6. 6

   6. Change the rest as you use them

   There's no need to chase down services you rarely log into. Replace each password the next time you sign in, and within a few months they'll all be updated.

Preparing so you never get locked out

Centralising your passwords also concentrates the impact if you lose access to that one place. On the day you start, take care of these three things.

1. 1

   Keep recovery codes on paper

   Print the password manager's recovery key and the backup codes for two-factor authentication, and keep them somewhere separate from your devices (a document folder at home, for example). A screenshot stays on the device, so it doesn't count as a backup.

2. 2

   Sync to two or more devices

   With only a phone or only a computer, losing that one device locks you out. With two, you can recover if you lose either.

3. 3

   Let a family member get in during an emergency

   Many password managers have an emergency access feature that lets a chosen person in after a waiting period. If yours doesn't, tell someone you trust just where the recovery key is kept.

Finally, installing a password manager doesn't make you safe by itself. The benefit only comes once the stored passwords have been replaced with a different random string for each service. Treat migrating and regenerating as two separate jobs, and do both.

FAQ

Is my browser's built-in password saving good enough?

It's much safer than continuing to reuse passwords. But it may not work across different browsers or on login screens inside apps, and when that gets inconvenient it's easy to slip back into old habits. Choose based on whether autofill works on every device you use daily.

What happens if I forget my master password?

Most password managers don't keep your master password, so you lose access to everything stored. Print the recovery key or code right after setting up, and keep it somewhere separate from your devices. If you've already forgotten it, you'll need to reset your password on each service.

Should I change my passwords regularly?

If you use a different random password for each service, regular changes are considered unnecessary. Do change a password when you're notified of a breach, when you've entered it on a phishing site, or when you take over an account that was shared with someone else.

Should I change all my passwords right now?

Going in order of importance is fine. Change your email first, then payment, banking and social media, and replace the rest the next time you log in. Trying to do everything at once usually stalls and leaves you half-finished.