How to Use a Password Manager

A password manager is an application that stores your logins in an encrypted vault and fills them in automatically across browsers and devices. It generates a different password for every account, so you only have to remember one master password while every site gets a unique, strong credential. This guide walks through choosing a manager, setting a strong master password, turning on two-factor authentication for the vault, importing your logins, generating unique passwords, and switching on autofill.

Why Does a Password Manager Matter?

A password manager matters because it removes password reuse by storing a unique credential for every account in one encrypted vault. The reasons below explain its role:

• It ends reuse. The manager generates a different password for every site, so one breach cannot unlock your other accounts.
• It encrypts the vault. Logins are protected with AES-256, and a zero-knowledge design encrypts them on your device, so a stolen vault file stays unreadable without the master password.
• It fills logins automatically. Autofill enters credentials on the matching site and refuses phishing domains that do not match the stored web address.
• It syncs across devices. The encrypted vault is available on your desktop, browser, and phone, so passwords stay consistent everywhere.

Reused passwords drive credential-stuffing attacks, where leaked credentials are tested across many sites. A password manager ends reuse, which removes the condition those attacks depend on. The wider set of account defenses appears in computer security basics.

How Do You Get Started With a Password Manager?

Getting started takes six steps: choose one manager, set a strong master password, turn on two-factor authentication, import your logins, generate unique passwords, and enable autofill. Each step builds on the one before:

• Choose one manager. Pick a manager that covers the devices and browsers you use, then install its desktop app and browser extension from the official site or app store.
• Set a strong master password. Use a long passphrase of unrelated words, at least 16 characters, since this is the only password you must memorize and the one that unlocks everything.
• Turn on 2FA for the vault. Add a second factor in the security settings, using an authenticator app or a FIDO2 security key, so a stolen master password alone cannot open the vault.
• Import your logins. Bring saved passwords in from your browser or old manager, then delete the exported file because it stores passwords in plain text.
• Generate unique passwords. Open the built-in generator, set the length to 16 or more characters, and replace each reused password starting with email and banking.
• Turn on autofill. Enable the browser extension and the phone autofill setting so the manager fills credentials on the matching site with one tap.

The rest of this guide expands each step. Once the vault is set up, signing in to any site becomes a single tap while every account keeps its own unique password.

Which Type of Password Manager Should You Choose?

There are three types of password manager: a dedicated app, your browser’s built-in manager, and your operating system’s keychain. They differ in how strongly they protect the vault and how widely they autofill:

A dedicated app gives the strongest protection because of its zero-knowledge design and works the same across every browser and operating system. The built-in options are convenient and improving, but they trade cross-platform reach and some security for that convenience.

How Do You Set a Strong Master Password?

Installing the manager and setting a strong master password creates the one credential that unlocks the entire vault. The steps below set it up:

1. Download the manager from the official site or app store, then install the desktop app and the browser extension.
2. Create an account, or for KeePass create a new local database file.
3. Set a master password using a long passphrase of unrelated words, since this is the only password to memorize.
4. Confirm the master password reaches at least 16 characters, because it protects every stored login.
5. Record a recovery method the manager offers, such as an emergency kit or recovery code, since most managers cannot reset a forgotten master password.

Build the passphrase with the method in the guide to creating a strong password. Because it is the single key to the vault, its strength sets the strength of everything inside.

How Do You Enable Two-Factor Authentication on the Vault?

Two-factor authentication on the vault adds a second barrier so a stolen master password alone cannot open it. The steps below enable it:

1. Open the manager account or security settings.
2. Select Two-step login or Two-factor authentication.
3. Choose an authenticator app and scan the QR code, or register a FIDO2 security key.
4. Save the backup or recovery codes the manager provides in a separate offline location.
5. Sign out and back in to confirm the second factor is requested.

The vault holds every other password, so protecting it with a second factor is the highest priority. The full process appears in the guide to setting up two-factor authentication.

How Do You Import or Add Existing Logins?

Importing existing logins moves your saved passwords into the vault so the manager holds every account in one place. The steps below transfer them:

1. Export saved passwords from the browser or old manager to a CSV file.
2. Open the manager Import tool and select the matching source format.
3. Upload the CSV file and confirm the imported entries.
4. Delete the exported CSV file immediately, since it stores passwords in plain text.
5. Add any account missing from the import manually by saving its login on the next sign-in.

A browser prompt to save a login also adds the entry to the vault automatically as you visit sites. The exported CSV must be deleted, because it holds your passwords unencrypted on disk.

How Do You Generate Unique Passwords for Each Site?

Generating a unique password for each site replaces every reused or weak password with a random string the manager stores. The steps below replace them:

1. Open the manager password generator and set the length to 16 or more characters.
2. Sign in to an account and open its change-password page.
3. Generate a new random password and paste it into the new-password field.
4. Save the change so the manager updates the stored entry with the new password.
5. Repeat for important accounts first, starting with email, banking, and the manager recovery email.

A built-in audit, such as 1Password Watchtower or the Bitwarden reports, lists reused and weak passwords so the highest-risk ones get replaced first. Each generated password is unique, so one breach stays contained to a single site.

How Do You Set Up Browser and Mobile Autofill?

Autofill lets the manager enter your username and password automatically on the matching site across browsers and phones. The steps below enable it:

1. Install the manager extension in each browser and pin it to the toolbar.
2. Sign in to the extension with the master password and second factor.
3. On a phone, open the manager app, then enable it under the device autofill or password settings.
4. Allow autofill so the manager appears as a fill option on login screens.
5. Test autofill on one site to confirm the credentials populate correctly.

Autofill matches the stored web address before filling, so the manager refuses to enter a password on a phishing domain that does not match. This domain check adds protection beyond convenience, and it is one more reason to keep autofill on. The same caution applies whenever you browse privately on shared devices.

Can a Password Manager Store Passkeys?

Yes. Since 2024 the major password managers store passkeys in the vault and sync them across your devices, the same way they handle passwords. A passkey is a phishing-resistant login that replaces the password on supporting sites, and managers are adding it fast:

• Bitwarden and 1Password store passkeys. Both let you create, save, and use passkeys directly from the browser extension, with the passkey kept in the vault and synced to every device.
• Bitwarden can also unlock the vault with a passkey. It supports passkey login to the vault itself through a FIDO2 security key, which removes the master password from that step, a feature 1Password has not yet matched.
• Cross-platform sync is the 2026 focus. The goal is to create a passkey on one device and use it on another, and Apple’s iOS 26 added the ability to export passkeys to third-party managers.
• Passkeys sit beside passwords. A manager holds both, so you can adopt passkeys on sites that support them while keeping passwords for the rest in the same vault.

Passkey support is now a baseline feature rather than a difference between managers. The login method itself is covered in the guide to setting up two-factor authentication.

Password Manager Feature Comparison

What Common Mistakes Should You Avoid?

Several habits reduce the protection a password manager provides. The mistakes below recur when people start using one:

• Setting a weak master password. The master password protects the whole vault, so a short or reused one undermines every stored login.
• Skipping vault 2FA. Without a second factor, a stolen master password opens the entire vault.
• Leaving the import CSV on disk. The exported file stores passwords in plain text and must be deleted after import.
• Keeping reused passwords after import. Importing old logins still leaves reuse until you regenerate each one.
• Forgetting the master password with no recovery. Most managers cannot reset it, so a recorded recovery method is required.

Last Thoughts on Using a Password Manager

Using a password manager comes down to one habit change: you stop remembering many passwords and start remembering one. Install a single manager, set a strong master password, turn on two-factor authentication for the vault, import your logins, and let the generator give every account its own unique password. Because the vault is encrypted on your own device with zero-knowledge encryption, the provider cannot read it, and autofill matches the real web address so it also refuses phishing pages.

The vault depends entirely on its master password, so give that one credential the strength described in the guide to creating a strong password and never reuse it. A password manager is one core step among many practical how-to walkthroughs, and the full set lives in the PC tutorials hub.

Key Takeaways:

• Choose one manager that fits your devices; a dedicated app gives the strongest, zero-knowledge protection.
• The master password is the one credential you must never lose and never reuse, since it unlocks everything.
• Turn on two-factor authentication for the vault so a stolen master password alone cannot open it.
• Use the built-in generator to give every account a unique 16-plus character password and end reuse.
• Delete the import CSV after transfer, because it holds your passwords in plain text.
• Modern managers store passkeys and sync them across devices, so you can adopt phishing-resistant logins in the same vault.

Frequently Asked Questions (FAQs)