Setting Up a Password Manager: Your First-Time Setup Guide

You have decided to use a password manager. Good. Now you need to set it up without breaking your existing logins, without losing access to critical accounts, and without creating a second mess on top of the first one.

This is the practical walkthrough. I will walk you through installation, vault setup, account migration, and the configuration decisions that actually matter. You will end up with a working system that protects your accounts and does not require a PhD to operate.

Choose Your Password Manager

You need to pick one before you can set it up. The major options are 1Password, Bitwarden, Dashlane, and NordPass. All four use zero-knowledge encryption, meaning the company cannot read your vault even if they wanted to. NIST recommends password managers as the most practical way to manage unique passwords across accounts.

If you are starting from zero and want the path of least resistance, NordPass offers a clean interface, cross-device sync, and breach monitoring in one package. I am linking to it because it works and because this site earns a commission if you sign up through that link. You can also choose any of the others. The setup process is similar across all of them.

Free tiers exist for all four. Free works fine if you only need one device. Paid plans (around $3-5 per month) add sync across devices, family sharing, and breach alerts. Most people need sync. Pay for it.

Install the Software

Download the desktop app and browser extension from the official site. Do not search for it in your browser and click the first result. Type the URL directly or use the link I provided above. Fake password manager sites exist, and they look convincing.

Install the desktop app first. This gives you a standalone vault that works even if your browser crashes or an extension breaks. Then install the browser extension for Chrome, Firefox, Safari, or whatever you use. The extension talks to the desktop app and fills passwords automatically.

During installation, you will create your master password. This is the one password you will need to remember. It protects everything else in your vault. Make it strong. Make it unique. Do not reuse a password you have used anywhere else, ever.

A strong master password is at least 16 characters. Use a passphrase built from random words, not a sentence you would actually say. "Correct horse battery staple" is the famous example, but do not use that one because everyone knows it. Generate your own. The EFF offers a Diceware word list if you want true randomness. Roll physical dice, pick words from the list, string them together.

Write down your master password. Put it somewhere secure. A locked drawer. A safe. A sealed envelope in a filing cabinet. Do not store it digitally. Do not email it to yourself. Do not put it in a note on your phone. If you forget your master password, you lose access to your vault permanently. Most password managers cannot recover it because of the zero-knowledge architecture.

Set Up Two-Factor Authentication on Your Password Manager

Before you put anything in your vault, enable two-factor authentication (2FA) on the password manager itself. This adds a second layer of protection beyond your master password. If someone gets your master password, they still cannot access your vault without the second factor.

Use an authenticator app (Authy, Google Authenticator, Microsoft Authenticator) or a hardware security key (YubiKey, Titan Key). Do not use SMS. Text message codes can be intercepted. CISA recommends phishing-resistant authentication methods like authenticator apps and hardware keys.

The password manager will show you a QR code during 2FA setup. Scan it with your authenticator app. The app generates a six-digit code that changes every 30 seconds. Enter the code to confirm. Save the backup codes the password manager provides. These let you regain access if you lose your phone or security key. Print them or write them down. Store them with your master password.

Start With Your Most Critical Accounts

Do not try to migrate every account at once. You will burn out halfway through and give up. Start with the accounts that matter most. Work through the rest over the next few weeks.

Critical accounts first:

Your primary email (the one you use for password resets)
Your password manager account itself
Banking and financial accounts
Work email and work systems
Any account with payment methods stored

For each account, log in the old way (with your current password), go to the account settings, and change your password. Let the password manager generate a new one. Most managers default to 16-20 character random strings with uppercase, lowercase, numbers, and symbols. That is fine. Use it.

The password manager will offer to save the new password. Let it. The entry goes into your vault. The next time you visit that site, the manager will fill the password automatically.

If the site has a password strength meter that complains about the generated password, ignore it. The meter is wrong. A 16-character random string is stronger than any password the meter thinks is good. Some sites have absurd password rules (must be exactly 8 characters, must not contain symbols, must start with a letter). For those sites, adjust the generator settings to match the rules, then generate a password that fits.

Configure Autofill Settings

Autofill is how the password manager fills passwords without you typing them. It works in browsers and mobile apps. You need to configure it once, then it runs automatically.

In your browser extension settings, enable autofill. Most managers let you choose between autofill on page load (the password appears as soon as the page opens) or autofill on click (you click the password field first). I recommend on click. Autofill on page load can trigger on phishing sites that mimic legitimate login pages. On click gives you a moment to check the URL.

On your phone, enable autofill in your operating system settings. On iOS, go to Settings > Passwords > AutoFill Passwords, and select your password manager. On Android, go to Settings > System > Languages & Input > Autofill Service, and select your password manager. Install the mobile app if you have not already. The app syncs with your desktop vault automatically.

Enable biometric unlock (fingerprint or face recognition) on your phone. This lets you unlock the password manager without typing your master password every time. The biometric data stays on your device. It does not sync to the cloud. If someone steals your phone, they still need your master password to access the vault on a different device.

Organize Your Vault

Password managers let you organize entries into folders or categories. Use this. A flat list of 200 passwords is unusable. Create folders for different contexts: Work, Personal, Banking, Shopping, Streaming, and similar. Move entries into the appropriate folders as you add them.

Most managers also let you tag entries. Tags work like folders but more flexible. An entry can have multiple tags. Use tags for accounts you access frequently (tag: "daily"), accounts with shared access (tag: "family"), or accounts that require extra security (tag: "critical"). You can filter your vault by tag later.

Some managers offer a "favorites" feature. Use it for the five or six accounts you log into most often. Favorites appear at the top of your vault and in the browser extension dropdown. This saves you from scrolling through 200 entries to find your work email.

Handle Shared Accounts

If you share accounts with a partner, family members, or roommates, do not share your master password. Most paid password manager plans include family sharing or team features. Each person gets their own vault and their own master password. You create a shared folder for joint accounts (streaming services, utilities, joint bank accounts). Everyone with access to the shared folder can see and use those passwords.

Set up family sharing through your password manager's account settings. Invite family members by email. They install the password manager, create their own master password, and accept the invitation. The shared folder appears in their vault automatically. When you update a password in the shared folder, the change syncs to everyone.

If you are on a free plan that does not include sharing, you have three options: upgrade to a paid plan, use a separate shared vault that everyone knows the master password to (not ideal, but workable), or manually share passwords through a secure channel when needed (worst option, but sometimes necessary).

Migrate Existing Passwords

You have your critical accounts set up. Now you migrate the rest. This is the tedious part. There is no shortcut. You have to go through each account, reset the password, and save the new one in your password manager.

Work through your accounts in batches. Ten accounts per session. Do not try to do 100 at once. You will make mistakes. You will get tired. You will miss accounts.

If you have been using your browser's built-in password manager (Chrome, Safari, Firefox), export those passwords and import them into your dedicated password manager. Most managers have an import feature. In Chrome, go to Settings > Autofill > Passwords > Export Passwords. Save the CSV file. In your password manager, go to Settings > Import, select Chrome, and upload the file. The manager imports the entries into your vault.

After importing, go through each entry and update the password. The imported passwords are your old passwords. They are probably weak. They are probably reused. Generate new ones. This is the moment to fix that.

Delete the CSV file after importing. It contains all your passwords in plain text. Do not leave it sitting in your Downloads folder.

Set Up Breach Monitoring

Most password managers include breach monitoring. This feature checks your email addresses and passwords against databases of known breaches. If your credentials appear in a breach, the manager alerts you.

Enable breach monitoring in your password manager settings. Add all your email addresses. The manager scans breach databases and notifies you if any of your addresses show up. When you get an alert, change the password for that account immediately. Generate a new one through the manager.

Some managers also scan your vault for weak passwords, reused passwords, and old passwords. Run this scan after you finish migrating your accounts. The manager will flag entries that need attention. Work through the list. Update weak passwords. Replace reused passwords. Change passwords you have not touched in two years.

Configure Emergency Access

Emergency access lets you designate someone (a spouse, adult child, trusted friend) who can access your vault if you die or become incapacitated. This is not the same as family sharing. Emergency access is a failsafe.

Set up emergency access through your password manager's account settings. Designate a trusted contact. Set a waiting period (24 hours, 7 days, 30 days). If the contact requests access, you get a notification. If you do not deny the request within the waiting period, they get access to your vault.

Choose the waiting period carefully. Long enough that you can deny a fraudulent request if your contact's account gets compromised. Short enough that your contact can actually access your vault in an emergency. Seven days is a reasonable default.

Tell your emergency contact that you have set this up. Give them your password manager username (not your master password). Explain how emergency access works. If something happens to you, they need to know this system exists.

Practice Using It

You have set up your password manager. You have migrated your accounts. Now you need to practice using it until it becomes automatic.

Log out of a few accounts. Log back in using the password manager's autofill. Get used to the workflow. Open the site. Click the password field. The manager fills the username and password. You click login. That is it. If the manager does not fill automatically, open the browser extension and select the correct entry.

Try logging in on your phone. Open an app. Tap the password field. The autofill prompt appears. Tap it. Unlock the password manager with your fingerprint or face. The manager fills the password. You log in. Same workflow, different device.

If you encounter a site where autofill does not work (some poorly designed sites break autofill), open the password manager, find the entry, and copy the password manually. Paste it into the login field. This is the fallback. It is slower, but it works.

What to Do When It Breaks

Password managers occasionally break. Browser updates disable extensions. Mobile apps crash. Sync fails. You need a plan for when this happens.

If the browser extension stops working, restart your browser. If that does not fix it, uninstall the extension and reinstall it. Your vault is stored on the password manager's servers (or locally, if you self-host). Reinstalling the extension does not delete your data.

If sync stops working, check your internet connection. Check the password manager's status page (most companies have one). If the service is down, wait. If the service is up and sync still fails, log out of the app and log back in. This forces a fresh sync.

If you get locked out of your account (you forgot your master password, you lost your 2FA device, you lost your backup codes), you are in trouble. Most password managers cannot recover your account because of zero-knowledge encryption. This is why you write down your master password and store your backup codes somewhere secure. If you lose both, you lose your vault.

Some managers offer account recovery through a recovery key or a trusted contact. If your manager offers this, set it up. It is your last line of defense.

When to Update Your Master Password

You do not need to change your master password regularly. Routine password changes are outdated advice. NIST no longer recommends periodic password changes unless you have reason to believe the password has been compromised.

Change your master password if:

You think someone saw you type it
You typed it on a device you do not trust
Your password manager account was accessed from an unfamiliar location
You used the same password somewhere else (fix this immediately)

Otherwise, leave it alone. A strong master password that you remember is better than a constantly changing master password that you forget.

The First Month

The first month with a password manager is the hardest. You will forget to save new passwords. You will accidentally save the wrong password. You will get frustrated when autofill does not work. This is normal. Keep using it. The friction decreases.

After a month, the workflow becomes automatic. You stop thinking about passwords. You log in. The manager fills the password. You move on. That is the point. The password manager removes the cognitive load of remembering 200 passwords. It removes the temptation to reuse passwords. It removes the need to write passwords on sticky notes.

You still have one password to remember (your master password), but you only type it once per session. The rest happens automatically.

In Ocean's Eleven, the crew spends weeks planning the vault heist, rehearsing every step until the execution is automatic. The same principle applies here. The setup is tedious. The payoff is a system that works without conscious effort. You put in the work once. You benefit every day after.

Your password manager is now your single source of truth for credentials. Treat it that way. When you create a new account, let the manager generate the password. When you update a password, do it through the manager. When you log in, use the manager. The system works when you use it consistently.

You have 200 accounts. You now have 200 unique passwords. You remember one.