How to Set Up a Password Manager Without Losing Access

The most common way people lose access to a password manager is not a breach or a forgotten password in isolation. It is a forgotten master password combined with no recovery method set up, on a device that has been replaced or wiped. The password manager then contains every account credential the person owns, and none of it is accessible.

Password managers are the right choice. The alternative, reusing passwords or keeping them in an unencrypted document, is worse. But setting one up badly can create a single point of catastrophic failure. The steps below are ordered to prevent that before it happens.

Choose a Manager and Set the Master Password Correctly

For most people, Bitwarden is the right starting point. It is free for individual use, open-source with published security audits, has browser extensions for all major browsers, and has mobile apps for iOS and Android. 1Password is the strong paid alternative, with a better-polished interface and a family plan option. Avoid LastPass following its 2022 breach, which exposed encrypted vault data along with metadata.

The master password is the single point of access to everything. It should be long, unique, and not used anywhere else. A passphrase works well: four or five unrelated words strung together reach sufficient length while being memorable. Something like "copper-bicycle-lamp-nineteen" is 28 characters and far stronger than a short string of symbols.

The critical step that most setup guides skip: write the master password on paper and store it somewhere physically secure. Not in another app, not in a note on your phone. On paper, in a place you control. A filing cabinet, a lockbox, or with important documents. This is not a security weakness. A written master password that someone would have to physically break into your home to access is a reasonable trade-off against the near-certainty that you will not remember a password you have only used a few times after not logging in for six months.

Set Up Recovery Before You Need It

Before adding a single password to the vault, configure the recovery options. Skipping this step is where most problems originate.

In Bitwarden, the primary recovery mechanism is the master password. There is also an emergency access feature that allows you to designate a trusted contact who can request access to your vault after a waiting period you define. Setting this up requires the other person to have a Bitwarden account, but it provides a meaningful safety net.

Download and store the emergency recovery codes if your manager provides them. Some services offer a one-time recovery code that bypasses two-factor authentication if you are locked out of your second factor. Print this code and store it with your written master password.

Also set up two-factor authentication for the manager itself. Bitwarden supports authenticator apps, hardware security keys and email. An authenticator app such as Ente Auth or Aegis (on Android) is a reasonable choice. Store the backup codes for the 2FA as well, since losing access to your authenticator app while locked out of your vault produces the same catastrophic outcome as forgetting the master password.

Import and Start Using It

Most password managers can import from other managers or from a browser's saved passwords. In Chrome, go to Settings, Autofill and Passwords, and export your saved passwords as a CSV. Bitwarden and 1Password both accept this format. The import takes a few minutes and brings everything across at once.

After importing, go through the existing passwords and flag the ones that matter most: banking, email accounts, anything tied to payment information. Change these passwords first to something strong and unique, generated by the manager. Most managers have a built-in password generator that produces something like a 20-character random string. Use this rather than creating passwords yourself.

Email accounts deserve particular attention because most other account recovery flows route through email. If your email is compromised, recovering other accounts becomes difficult regardless of what password manager you use. Prioritise a strong, unique password and two-factor authentication on every email account you hold.

Common Mistakes Worth Avoiding

Using the same master password as something else removes the primary protection of the master password. If that other account is breached and the password appears in a leak database, it becomes a credential attack vector for the password manager. The master password must be unique.

Keeping the manager only on one device and not enabling sync means a phone or laptop loss can leave the vault inaccessible. Enabling cloud sync stores an encrypted copy on the manager's servers, which means access from any device after login. The encryption is end-to-end: the service cannot read your vault contents. Disabling sync because it feels less secure is a misunderstanding of how the encryption works.

Not updating the vault after changing passwords elsewhere. A password manager is only useful if it reflects current credentials. Any time you change a password manually, update the entry in the vault immediately.

The setup process takes about an hour done properly. The time spent doing it correctly at the start is much less than the time spent attempting to recover access after something goes wrong.