Most people who give up on a password manager do so in the first week, because moving passwords in, sharing with family and planning for a lost master password were never thought through. Setting up a password manager means choosing one, protecting the account with a strong primary password and two-step verification, importing the passwords already saved in browsers and other apps, cleaning them up, and arranging sharing and emergency access. This guide walks through each step in plain English, with the exact menus for the common import routes and the pitfalls that leave passwords exposed. It is for anyone setting one up for themselves or a household. Why password managers are worth using is covered in the Password Managers Explained for Everyone Guide; this page is the practical follow-on. Where third-party products are named they appear alphabetically and only as examples of how a feature works, not as recommendations.
Key takeaways
- Protect the vault before you fill it. Set a long, memorable primary password and turn on two-step verification for the password manager account first, as the NCSC advises.
- Import, then delete the export file. Most imports use a CSV file that holds every password in plain text; Google and Bitwarden both tell you to delete it straight after importing.
- Fix the weakest passwords first. Use the built-in health check to change breached and reused passwords, starting with email, banking and the password manager itself.
- Share through the manager, not by message. Shared vaults or groups keep household passwords encrypted and up to date, and you can remove access later.
- Plan for the day you cannot sign in. Store your recovery details offline and set up emergency access or a trusted person, because some account inheritance features do not include saved passwords.
What it is
A password manager is an app, browser feature or device feature that stores your passwords in an encrypted vault, creates strong new ones and fills them in for you. Setup is the short project of moving from "passwords in my head, a notebook and three browsers" to "every password in one vault, each one unique". The NCSC says built-in browser and device managers are a good option on your own devices, and that third-party managers suit people who use a mix of browsers and devices. The best one, in the NCSC's words, is the one that meets your needs and you find easiest to use.
Choosing a starting point
| Your situation | Sensible choice | What to watch |
|---|---|---|
| All Apple devices | Apple Passwords app (iCloud Keychain) | Harder to use on Windows or Android devices later |
| Android phone plus Chrome everywhere | Google Password Manager | Security depends on your Google Account and its recovery options |
| Mixed devices and browsers | A third-party password manager | Choose one with apps for every platform you use and a clear recovery process |
| Household that shares logins | A manager with family sharing or shared groups | Decide who can edit shared items and who manages the family account |
| Shared or public computer | Do not save passwords there at all | The NCSC says never save passwords in the browser on a public or shared device |
Comparing products in more depth is covered in the Password Manager Buyer's Guide.
How it works
Step 1: Secure the account
- Primary password: this is the one password you must remember. Make it long rather than complicated; the NCSC's three random words approach works well. Do not reuse it anywhere else.
- Two-step verification: the NCSC calls turning on 2SV the first and most important step, and says to turn it on for the password manager too, so a stolen primary password alone is not enough.
- Recovery details: write down what you would need to get back in. 1Password, for example, provides an Emergency Kit PDF with the sign-in address, email, Secret Key and space for the account password, and suggests keeping a printed copy with documents such as your passport. Other managers provide recovery codes; store them offline in the same way.
- Device locks and updates: the NCSC notes your stored passwords are only as secure as your devices and accounts, so keep automatic updates on and a screen lock on every device.
Step 2: Import your existing passwords
Most moves use an export file. Google's help describes exporting from Chrome through More > Passwords and autofill > Google Password Manager > Settings > Export Passwords > Download file. Importing into Google Password Manager accepts only .csv files whose first line names the columns url, username and password, takes up to 3,000 passwords at a time, and stores up to 10,000 per account.
| Import route | How it works | Points from the vendor's documentation |
|---|---|---|
| CSV file from a browser or app | Export from the old store, import into the new one | The file holds every password unencrypted; Google says delete it after importing because anyone with access to the device could read it |
| Direct import in a third-party manager | The manager reads a named format (Chrome, Edge, Firefox, Safari or another manager) | Bitwarden lists direct formats under Tools > Import and warns that importing does not check for duplicates; 1Password lists imports from Brave, Chrome, Edge, Firefox, Safari and other managers |
| Credential Exchange (app to app) | The new app pulls items directly from the old one without a file | 1Password documents direct import from apps that support the standard on iOS and iPadOS 26 or later and Android 14 or later |
Avoiding a mess: import each source once, because repeat imports can create duplicates. After checking everything arrived, Bitwarden suggests you may also want to delete the data from the old browser or manager, and turning off the old browser's offer to save passwords stops a second copy building up. Credential Exchange is explained in the FIDO Credential Exchange Passkey Portability Guide.
Step 3: Clean up
Most managers include a health check. Apple's Passwords app flags weak, reused and compromised passwords, and Chrome's Safety Check does the same for Google Password Manager. Work through the list in this order:
- Your main email account, because it resets everything else.
- Banking, payment and shopping accounts with saved cards.
- Any password reported as breached.
- Reused passwords, using the generator to create a unique one for each site.
- Accounts you no longer use: close them rather than updating them.
Where a site offers a passkey, the NCSC recommends it as the first choice. Many password managers can store passkeys alongside passwords. See the Passkeys for Everyone Guide and, for how breached-password checks work, Breached password checks.
Step 4: Use autofill
The NCSC points out that autofill only fills a password on the correct website, which helps protect against phishing. If your manager does not offer to fill on a page that looks like your bank, stop and check the address rather than copying the password across by hand.
Step 5: Set up family sharing
Shared logins for streaming, utilities or the Wi-Fi router belong in a shared vault or group, not in a text message. Apple's Passwords app offers Shared Groups, and most third-party managers offer shared vaults in family plans. Good practice:
- Share only what is shared: keep personal email and banking in each person's private vault.
- Decide who can edit: one adult manages the family account and shared items.
- Remove access when circumstances change: after a separation, a lodger leaving or a child moving out, remove them from the group and change the passwords they could see.
The Family Cyber Security Plan Template helps agree these rules.
Step 6: Arrange emergency access
The NCSC notes that many managers offer recovery options such as secure hints or emergency access through trusted contacts. Two examples show the range:
- Bitwarden emergency access: you name trusted contacts in advance with either View access to your individual vault or Takeover, which sets a new primary password. A request is approved automatically if you do not reject it within the wait time you chose. Adding contacts needs a premium or paid family plan.
- 1Password Emergency Kit: the kit holds what is needed to sign in, and 1Password suggests giving a copy to someone you trust, such as a spouse or someone named in your will.
Do not assume an account inheritance feature covers passwords. Apple's Legacy Contact, for example, excludes Keychain data such as passwords and passkeys. The Account Recovery Planning Guide covers this in more depth.
Why it matters
Reused passwords are how one breach turns into many: the NCSC explains that an attacker who gets one password will try it on your other accounts. A password manager makes a unique password for every account practical, but only once the old passwords are inside it and changed. Setup is also where most of the risk sits: an export file left in the Downloads folder, a weak primary password or a vault nobody else can open after an accident undoes much of the benefit. Doing the steps in order, protection first and import second, avoids those traps.
Common misconceptions
- "Putting all my passwords in one place is riskier." The vault is encrypted and protected by your primary password and 2SV. The real risk is a weak primary password: in the LastPass breach, attackers stole encrypted vault backups, and accounts with weak primary passwords were the ones most exposed to cracking.
- "Importing is finished when the import completes." The CSV file is still on disk and the old browser still holds copies. Delete the file and clear or switch off the old store.
- "The browser's manager is not a real password manager." The NCSC regards built-in managers as safe on your own devices with updates on.
- "My family can get in if something happens." Only if you set up emergency access or left recovery details somewhere they can find. Inheritance features may not include passwords.
- "I will change all my passwords this weekend." Few people manage it. Fix email, banking and breached passwords first, then change the rest as you sign in.
- "Sharing a password once by message is fine." Messages are kept, forwarded and backed up. Shared vaults can be revoked; messages cannot.
Related concepts
- Why password managers help: the Password Managers Explained for Everyone Guide.
- Passkeys: the phishing-resistant replacement for passwords, often stored in the same app. See the Passkeys for Everyone Guide.
- Browser settings: the browser's own password saving and checks. See the Browser Privacy and Security Settings Guide.
- Two-step verification: see the Two-Factor Authentication for Everyone Guide.
- Product security guides: the 1Password Security and Bitwarden Security guides cover each product's settings in depth.
- If your password manager is breached: the Password Manager Vault Breach Response Playbook.
Practitioner checklist
- Choose a manager that works on every device and browser you use.
- Set a long, unique primary password and turn on two-step verification for the manager.
- Store recovery details (emergency kit or recovery codes) offline with important documents.
- Import each old password store once, then delete the CSV export file.
- Turn off password saving in old browsers and clear their stored copies once the import is checked.
- Change breached and reused passwords, starting with email and banking; add passkeys where offered.
- Move shared household logins into a shared vault or group with clear edit rights.
- Set up emergency access or a trusted person, and check what inheritance features do not cover.
Standards and references
- NCSC: Password managers
- NCSC: Three random words
- Google Chrome Help: Import passwords with Chrome
- Google Chrome Help: Manage passwords in Chrome
- Apple Support: Use the Passwords app
- 1Password Support: About your Emergency Kit
- Bitwarden Help: Emergency access
- Apple Support: How to add a Legacy Contact for your Apple Account
Related NHI Mgmt Group resources: Password Managers Explained for Everyone Guide · Passkeys for Everyone Guide · Account Recovery Planning Guide · Password Manager Buyer's Guide