If you use the same password for your email and a shopping account, a breach at the shop can put your inbox at risk. Someone with the leaked password may try it elsewhere. Once inside your inbox, they may be able to reset other accounts. The habit that matters most is not memorizing one clever password. It is using a different credential for every account.
Build passwords around uniqueness, not clever substitutions
Password reuse lets a problem at one service spread to others. Adding a site name or number to a shared base word can still leave a recognizable pattern. A password manager makes unique credentials manageable: you remember the password for the vault, and the manager stores the rest.
For accounts that allow them, use the manager’s generator to create long, random passwords. Twenty or more random characters is a reasonable default when a service permits it. If a site imposes a shorter limit, accommodate that site without weakening your other passwords. For a password you must type regularly, several randomly chosen, unrelated words are usually easier to enter than a dense string of symbols. Avoid quotes, lyrics, and personal details.
Changing passwords on a schedule matters less than keeping them unique. Replace one promptly if it has been exposed, reused, shared unintentionally, or linked to suspicious activity. Otherwise, routine changes can encourage predictable variations without fixing the real problem. If your organization requires rotation for work accounts, follow its rules and generate a distinct password each time.
Choose a manager you can maintain
Browser password storage, a dedicated manager, and a locally stored encrypted vault can all work. Consider how many devices you use, whether you need to share credentials, and who will handle backups. A vault you use consistently is more protective than a feature-heavy setup you abandon after a week.
Compare the practical trade-offs
- Browser-based storage: Convenient if you mostly use one browser ecosystem. Check how syncing and device sign-in work, and what someone else using your computer could access.
- Dedicated manager: Often works across browsers and devices, with password generation and secure sharing. Review its recovery options and protect the manager account separately.
- Local encrypted vault: Gives you direct control over the vault file, but leaves synchronization, backups, and file conflicts to you.
Before moving everything, try one or two noncritical accounts on every device you rely on. Create a login, retrieve it without autofill, and make sure you can access the vault after restarting a device. On a work-managed device, check your organization’s policy before installing a manager or syncing work credentials to a personal account.
Use a long, unique master password or passphrase, and do not keep it in an unprotected note. If the manager offers multi-factor authentication, enable it and keep the recovery method accessible if your primary phone is lost. The manager prevents password reuse; it does not make an unlocked device safe to hand over. Lock your screen, install updates, and do not leave the vault open on a shared computer.
Move existing accounts without losing access
Change accounts gradually rather than tackling dozens of logins at once. Start with your primary email, password manager, device platform, and financial accounts, plus any account that can reset or administer others. Move everyday services as you use them.
- Record the account: Save the service name and correct sign-in address in the vault. You may have several email addresses or separate personal and work logins.
- Change the password on the service itself: Reach account settings through a trusted bookmark or by typing the known address. Generate a unique password and save it in the vault.
- Verify the new login: Sign out where practical, then confirm the saved credential works before deleting an older record.
- Check recovery options: Make sure the recovery email, phone number, and backup methods still belong to you.
Importing browser passwords can speed things up, but the entries may include duplicates, outdated passwords, or misleading website names. Treat the import as an inventory, not proof that each login works. If the transfer creates an export file, it may contain readable passwords. Follow the manager’s import instructions, avoid leaving copies in downloads or cloud-synced folders, and delete the temporary file after verifying the import.
Developers also handle credentials that are not ordinary website passwords. Check project policy before putting API keys, database connection strings, or team secrets in a personal vault. Use the approved secrets-management method for shared development systems, and revoke credentials accidentally committed to a repository. A password manager is useful for personal logins, but it does not replace application access controls or secret rotation.
Use autofill carefully
Autofill saves typing and can sometimes flag an unfamiliar sign-in page: a manager may decline to offer a credential when the site does not match. Treat that as a clue, not a guarantee. Similar-looking domains, compromised pages, and differences between managers still require your attention.
Before approving a fill, check the site address and the account you mean to use. Take extra care with sign-in prompts that arrive by email or message. Open the service through a saved bookmark or its app instead of entering a password on a page reached through an unexpected request. If the manager does not offer the credential you expect, inspect the address before copying and pasting it.
Some services legitimately use more than one sign-in domain. Confirm those domains through the service’s settings or documentation before adding them to a vault entry. Do not loosen matching rules broadly just to make an unexpected page autofill. On a shared device, do not save your personal vault in someone else’s browser profile, and sign out when you finish.
Protect recovery paths as carefully as passwords
A unique password will not help if someone takes over the account’s recovery email. Prioritize your primary inbox, enable the strongest sign-in protection you can reliably use, and review its recovery settings. If a service provides backup codes, keep them protected and accessible without the phone or device you use to sign in.
Multi-factor authentication adds a separate check when a password is entered. An authenticator app, security key, or other supported method can limit the damage from an exposed password, though none removes every risk. The blog’s existing post on two-factor authentication compares methods and setup considerations. For password management, the immediate concern is keeping both the extra sign-in method and its recovery path usable.
Picture a lockout: your phone is missing, your laptop is unavailable, and you need the vault on a replacement device. Your manager may require a saved code, an already authorized device, or help from an organization’s administrator. Some vaults cannot restore access if you lose both the master password and recovery materials. Learn the procedure now, and keep printed recovery codes somewhere private and secure—not loose in a laptop bag.
Handle sharing and suspected exposure deliberately
A password sent by chat or email can remain in message history. If a household account must be shared, use your manager’s approved sharing feature if it has one, and limit access to those who need it. At work, prefer individual accounts with assigned permissions. When someone leaves a shared account, change its password and review active sessions and recovery methods.
After a reported breach, identify the affected account. Change its password through the legitimate site or app, then change passwords anywhere else you reused it. If your email or vault is affected, secure it first: review recent activity and recovery details, and sign out unfamiliar sessions where possible. Be cautious of messages pushing you to use a password-reset link; go to the service directly.
Some managers flag passwords found in known breaches or reused within your vault. Those checks help you prioritize, but they cannot identify every exposed credential; an unflagged password may still be compromised. A warning on an imported entry might also refer to a password you have already changed. Check the live account before treating the record as current.
Keep the system workable over time
Name vault entries clearly enough to distinguish multiple logins at the same service. Remove duplicates once you have verified them, and record account-specific details only when they help. Do not keep sensitive security-question answers in an unprotected notes app. If a site still uses security questions, treat the answers as secrets and store them securely if you will need to retrieve them.
Periodically check important accounts for unfamiliar devices, outdated recovery addresses, and reused passwords. You do not have to review every account at once. Next time you sign in to your primary email, confirm that its vault entry works, its recovery address is yours, and you can find any saved backup codes without relying on that same inbox.
