Using Your Password Manager Day to Day

A password manager is an app that creates, stores, and fills in your passwords for you. You remember one password, the master password, and the app handles everything else. This guide covers the daily habits that make that work safely.

It assumes you have already set up your email accounts and your password manager account using the Email Setup Guide.

Words Used in This Guide

                    Vault: the locked storage area inside your password manager where everything is kept.
Master password: the one passphrase that unlocks your vault.
Autofill: when the app types your email address and password into a website for you.
Browser extension: a small add-on for your web browser that connects it to your password manager.
Two-step sign-in: a second proof, such as a security key, needed along with your password. It is also called 2FA or MFA.
Passkey: a sign-in method that replaces a typed password with a secure key stored on your device, unlocked with your fingerprint, face, or screen lock.
2FA (two-factor authentication): sign-in that needs exactly two kinds of proof, for example your password plus a security key. A "factor" is just a kind of proof.
MFA (multi-factor authentication): sign-in that needs two or more kinds of proof. 2FA is one type of MFA, and in everyday use people often use the two terms to mean the same thing.
Authenticator app: an app on your phone that shows a six-digit code that changes every 30 seconds. You type the code in after your password as a second proof. It is far better than no second step, but a security key is stronger.

                

1. Set Up Your Devices

Install the password manager app on your computer and on your phone.
Add the password manager's browser extension to the web browser you use most.
Sign in on each device with your Password manager email and your master password.
Turn on two-step sign-in (2FA) for your password manager account, using a security key if the app supports one. Also turn on passkey sign-in if the app offers it. Then check that the second step works on each device you have set up.

Why: Your master password is the key to everything. A second step or a passkey adds protection if someone ever learns or guesses it, and makes it much harder for a thief to reach your vault. Save the recovery codes for this on paper, never inside the vault they protect.

Turn on automatic locking, so the vault locks itself after a short time with no activity and whenever the computer goes to sleep.
Turn off the password saving that is built into your web browser, so the password manager is the only place your passwords are kept.

Why: Passwords saved in a browser are often easier for someone to view if they get hold of your computer. One place to guard is safer than two.

When you create a new account, ignore any password your browser suggests. Use the password your password manager creates instead.

Warning: If you accept a password suggested by your browser, the browser saves it, and if you are signed in to Chrome, it can be saved in your Google account too. That puts the password in a second place outside your vault. Anyone who breaks into that account, or sits down at your unlocked computer, could see it.

Your password manager would have no copy, so its security report cannot check that password, and you could end up with two different versions or lose track of it. Every password the browser keeps is a gap in your plan to guard one place only.

2. Know What Goes in the Vault

Put in the Vault

Sign-in details for websites and apps.
The passphrases and recovery codes for your Money, Family, Social and shopping, and Junk emails.
Other private notes you want locked away, such as software license keys or Wi-Fi passwords.

Keep Out of the Vault (Paper Only)

Your master password.
The passphrases and recovery codes for the Rescue email and the Password manager email.
The recovery codes for your password manager's own two-step sign-in.

3. Create a New Account the Safe Way

Follow these steps every time you sign up for something new.

Pick the email address that fits: Money, Family, Social and shopping, or Junk. Never use the Rescue email or the Password manager email.
Read the site's password rules before you create anything. They are usually shown near the password box. Look for the minimum and maximum length, the kinds of characters required (such as numbers or symbols), and any characters that are not allowed.
Click the password manager's icon and choose to create a new password. Open its generator settings and match them to the site's rules: set the length as long as the site allows and turn on only the character types it accepts.
Accept the long, random password it makes. Do not change it by hand to something easier to type. If the site rejects it, adjust the generator settings and create a new one.
Save the new login when the app offers. Check that the saved entry has the right website address and email.
If the site asks security questions, such as your mother's maiden name, do not answer truthfully. Make up a random answer and save it in the notes of that vault entry.
If the site offers two-step sign-in, turn it on (see section 5).

If a site only allows a short password: Use the longest one it allows, and be extra sure to turn on two-step sign-in for that account.

Why: Every account gets its own password, so a break-in at one website cannot open your other accounts. Real answers to security questions can often be found online, but random ones cannot.

Passkeys

If the site offers passkeys, turn one on as well. A passkey can act as your second step, and some password managers can store the passkey for that website. That can be more convenient than carrying a hardware security key. If the site lets you choose where to save the passkey, ask yourself two questions first.

Do you sign in from more than one device? Then your password manager is a good place to save the passkey, because it will be available on every device where you use the manager.
Is this a financial account? Then a hardware security key is the wiser choice. A physical key cannot be copied from far away, and keeping it separate from your vault means one break-in cannot open both.

4. Sign In Each Day

Go to the website and click in the sign-in box.
Click the password manager's suggestion and choose the right login. It fills in your details for you.
If the app does not offer to fill in your details on a site you know you have saved, stop. Check the web address carefully. You may be on a fake copy of the site.
When you step away from your computer or finish for the day, lock the vault.

Why: The app only fills in details on the exact address you saved. When it stays silent, that is often your first warning of a fake website.

Avoid typing passwords by hand or copying them from other places. Let the app fill them in.
Never sign in to your vault on a shared or public computer.
Many phone apps let you unlock the vault with a fingerprint or your face. That is fine for convenience, but the master password remains the real key, so keep it memorized.

5. Turn On Two-Step Sign-In

A password alone can be stolen. A second step makes a stolen password useless by itself.

A security key is highly recommended for all of your email accounts, and especially for your Rescue email, Password manager email and Money email, and for every other financial account. Use one whenever the site allows it.
If a site does not support security keys, use an authenticator app on your phone as a temporary measure, and look for a provider that does support security keys. Avoid text-message codes when there is another choice, because phone numbers can be taken over by criminals. To see why an app is only a temporary measure, read the authenticator app box in Part 3 of the Email Setup Guide.
When a site shows recovery codes, save them in the vault entry for that site.

6. Replace Your Old Passwords

You do not need to fix everything in one day. Work in short sessions of about 15 minutes, and start with the accounts that matter most.

First

Any account that holds money, including banks, investments, and cryptocurrency.

Then

Social media and shopping accounts.

Finally

Everything else. Each time you sign in to an old account, take a minute to change its password.

Use your password manager's security report to find passwords that are weak, reused, or have appeared in a data breach.
While you are changing a password, also change the account's email address to the one that fits it. For example, move a bank account to your Money email.

7. Everyday Safety Habits

Guard the master password. Type it only into the password manager's own sign-in screen. The company will never ask for it by email, phone, or text.
Do not click links in alarming messages. If an email says there is a problem with an account, go to the website yourself instead of using the link.
Share carefully. To give a family member a password, use your manager's sharing feature. Never send passwords by text or email.
Do not photograph or screenshot your vault or your recovery codes.
Keep everything updated. Install updates for your password manager, your devices, and your web browser.
Lock your devices. Use a screen lock on your computer and phone.

8. Regular Check-Ups

Monthly (about 5 minutes)

Open the security report. Fix any reused, weak, or breached passwords.

Every 3 Months

Sign in to the Rescue email so it never goes inactive.

Every 6 Months

Give your four everyday emails (Money, Family, Social and shopping, and Junk) fresh passwords. They are the accounts most likely to be targeted, and your password manager makes them easy to update. Save each new password in its vault entry.

Once a Year

Make sure your paper backups are still readable and in their safe place. Check that your spare security key still works. You might also consider a fresh passphrase for the Rescue email and the Password manager email. They are the best protected, so this is optional, and it means a new Diceware passphrase and a new paper copy.

9. When Something Goes Wrong

A Website Tells You It Was Breached

Change that site's password right away, using a new one from the password manager. Watch the linked email address for strange messages.

Your Phone or Computer Is Lost or Stolen

Lock or erase it using the device's built-in find feature. Sign in to your password manager from another device and sign out of the lost one if the app lets you. If you think anyone could know your master password, change it.

You Think Your Master Password Has Been Exposed

From a device you trust, change the master password immediately. Then change the passwords on your Money accounts first, then your emails, then everything else. Also confirm that nobody has changed the settings on your Rescue email.

You Forget Your Master Password

The company usually cannot recover it for you. Use your paper backup. This is why practicing it during setup matters.

You Lose a Security Key

Use your spare key to sign in. Remove the lost key from your accounts, then buy a replacement and register it.

A Sign-In Alert You Did Not Expect

Do not click anything in the message. Go to the website directly and check your account.

10. Plan for the Unexpected

If something happened to you, could a trusted person get into what they need? Consider telling someone you trust where your paper backups are kept and what they are for. If your password manager offers an emergency access feature, look at how it works and decide whether to set it up.