Mark it once you can do it without this page open.

How to do it

  1. Pick a manager with a long security track record, either the one built into your device or a standalone app.
  2. Make the vault's phrase from five or six unrelated words, and do not use it anywhere else.
  3. Write that phrase on a card and keep it at home in a drawer only you use until it sticks.
  4. Add a second sign-in step to the vault itself.
  5. Replace the passwords on your email, bank and phone carrier accounts first with ones the vault generates.
  6. Let the vault offer to save or change each remaining password as you log in over the next month.
  7. Delete old password lists in notes apps, spreadsheets or browser files once everything is in the vault.

Common mistakes

  • Choosing a vault phrase you already use somewhere else.
  • Trying to change a hundred passwords in one night and quitting halfway.
  • Keeping a notes file of passwords next to the vault.

Quick self-check

Three questions. Your last score is kept in this browser.

1. What is the one password you still need to remember?
2. Which accounts should get new passwords first?
3. What should happen to your old password spreadsheet?

Teach this to someone

A one-page sheet for showing a friend, a roommate or a kid: what to say, what to show, and one question to check it landed.

Words on this page

Sources

  • National cybersecurity agency guidance for home users, 2026. Checked September 28, 2026.

Last reviewed . First published .