DigiKitSwitching to a Password Manager: A Practical Plan for the First Week
Most of us have used the same two or three passwords for years, with small tweaks, everywhere. The risk shows up when one site has a data breach: every other account using that password is exposed too. A password manager solves this, but the switch can look daunting. The good news is that you do not have to do it all in a day.
Day 1: Choose a manager and set the master password
Browser password managers do the job; separate tools such as Bitwarden, 1Password or KeePassXC are more flexible across browsers and devices. Whichever you pick, the most important step is the master password, the one password you will memorise. A long passphrase of four or five random words is both strong and memorable. Never use it anywhere else.
Day 2: Turn on two-factor authentication
Protect the password manager itself with two-factor authentication. Write down the recovery codes or emergency access details and keep them somewhere safe. Many password managers cannot recover your data if you forget the master password; that is a security feature, not a bug.
Day 3: The five most important accounts
Email, banking, cloud storage, the account your phone is tied to (Apple or Google) and the social network you use most. Change these five to long, unique passwords generated by the manager. Email comes first, because the password-reset links for everything else go there.
Days 4-6: Add as you go
You do not need to hunt down every other account. As you log in to sites, the manager will offer to save them; change each to a strong password at that moment. Within a few weeks, nearly all the accounts you use often will have moved over on their own.
Day 7: Clean up
Look at the manager's security report, which lists reused and weak passwords. Consider closing old accounts you no longer use; a closed account cannot leak. Once old passwords saved in your browser are imported into the manager, delete them so they do not live in two places.
A common worry
"Isn't it risky to put all my passwords in one place?" It is a fair question. A good password manager encrypts your data so that only your master password can unlock it. With a strong master password and two-factor authentication, that setup is far safer than reusing one password across dozens of sites. Before choosing a tool, though, take a look at its security history and independent audit reports.