A password manager stores account credentials so you can use different passwords without memorising each one. The useful change is behavioural: when one service has a problem, a unique password helps prevent that same credential from opening your other accounts. You do not need to reorganise your entire digital life in one evening to gain that benefit.
Begin with the accounts that unlock others
Start with your primary email account, then the account used for your phone or computer, and any account that contains important documents or administers other services. Email deserves early attention because password-reset messages for other services often arrive there. Next work through regularly used accounts, changing reused passwords as you go.
Make a private inventory of account names and their purpose. Do not write the passwords into an ordinary shared spreadsheet while preparing the move. A simple list such as “personal email,” “cloud files” and “electricity account” is enough to organise the work. If an account has a work owner or company policy, follow that policy rather than moving company credentials into a personal vault.
Choose around your actual devices
Before committing, check whether the manager works on the devices and browsers you regularly use. Test saving and retrieving one low-risk login. Check the provider's recovery approach, export options, update support and how it handles shared use. Features that sound impressive are less useful if they make routine sign-in so awkward that you return to reused passwords.
The NCSC recommends password managers as a way to create and remember passwords, and recommends protecting the manager account with two-step verification. Your vault's main password should be unique and strong. Treat recovery arrangements as part of setup rather than a problem to solve after losing a phone or forgetting the main password.
Move accounts in small batches
For each account, sign in using a known address or your usual application. Generate a new unique password, save it to the correct vault entry, and confirm that it works before closing the session. Check that the entry contains the right username and website. Duplicate entries with similar names can otherwise make later sign-in needlessly confusing.
A useful evening task is changing three important accounts, not fifty hurriedly. Leave a private note of which accounts still need attention. Where a service offers passkeys or another supported sign-in method, read its official setup and recovery guidance before changing methods. Different providers handle device changes and shared access differently.
Pay attention to unexpected prompts
Autofill is convenient, but pause when a page asks for credentials in an unusual way or your manager does not recognise a site you normally use. That can have innocent explanations, such as a new address, but it deserves verification. Reach the service independently rather than manually forcing a saved password into a page from a suspicious message.
Never disclose the vault's main password or a one-time verification code to someone claiming to provide unsolicited support. Protect the device itself with its supported screen lock and updates. A vault is one component of account security; it cannot decide whether every message, download or request is legitimate.
Make the routine sustainable
Review the vault occasionally for obsolete accounts, incorrect website addresses and accidental duplicates. Keep personal and work access appropriately separated. If family members need to share one household login, use a supported sharing mechanism where available rather than sending the password through a group chat. Explain who can use it and who maintains recovery information.
The practical goal is clear: every important account has a unique credential, the manager is protected, and recovery does not depend on the single device most likely to disappear. Once those habits work reliably, continue through the remaining accounts at a pace you can verify.
Sources and further reading
This original guide was prepared with AI assistance. Examples are illustrative. The edition date is an assigned date in this 2026 catalogue. See our editorial policy and report a correction.