Weak, reused passwords are still the number one cause of account takeovers, and no amount of antivirus software fixes that if your Netflix password is the same one you use for online banking. This guide walks through setting up a password manager from scratch, migrating your existing passwords, and layering two-factor authentication on top for the accounts that matter most.

Why a Password Manager Is Essential

The average person has well over a hundred online accounts, and it's simply not realistic to remember a unique, strong password for each one unassisted. Password managers solve this by generating and storing complex, random passwords for every site, protected behind a single master password you do need to remember. This means a data breach at one company — which happens constantly and is entirely outside your control — doesn't cascade into your other accounts being compromised too, because each password is unique.

Choosing a Password Manager

  • Bitwarden: Open-source, free tier is genuinely capable, cross-platform, and widely recommended by security professionals. A sensible default choice for most people.
  • 1Password: Paid-only but polished, with excellent family and travel-mode features.
  • Apple Passwords / iCloud Keychain: Built into macOS and iOS, solid if you're fully within the Apple ecosystem, though less useful on Windows.
  • Avoid: Storing passwords in a spreadsheet, a notes app, or your browser's built-in password manager as your primary system — these lack the encryption and breach-monitoring features of a dedicated tool.

This guide uses Bitwarden as the walkthrough example, but the steps are broadly similar across any reputable password manager.

Setting Up Bitwarden Step by Step

Step 1: Create Your Account

  1. Go to Bitwarden's website and sign up for a free account.
  2. Choose a master password — this is the single most important password you'll ever create. Use a long passphrase of four or five random unrelated words (for example, combining random nouns you wouldn't normally put together) rather than a short complex string, since length matters more than complexity for resisting cracking attempts.
  3. Do not reuse this master password anywhere else, and do not write it down anywhere insecure.

Warning: Bitwarden and similar zero-knowledge password managers cannot recover your master password if you forget it — that's the security trade-off for them not being able to read your vault either. Consider writing it down once and storing that note somewhere physically secure, such as a locked drawer, as a genuine backup.

Step 2: Install the Apps and Extensions

  1. Install the Bitwarden browser extension for Chrome, Firefox or Edge from the official browser add-on store.
  2. Install the Bitwarden desktop app if you want offline access to your vault.
  3. Install the Bitwarden mobile app on your phone, and enable biometric unlock (Face ID, Touch ID or Windows Hello, depending on device) so you're not typing your master password constantly.

Step 3: Import Existing Passwords

  1. If your passwords are currently saved in a browser, export them first — in Chrome, go to Settings > Autofill and passwords > Password Manager > Settings > Export passwords. In Firefox, go to Settings > Privacy & Security > Logins and Passwords > Saved Logins > ... menu > Export Logins.
  2. In Bitwarden, go to the web vault and choose Tools > Import Data, select your browser as the source format, and upload the exported file.
  3. Once imported and confirmed, delete the exported file (it's an unencrypted plain-text file, so don't leave it sitting on your desktop) and clear the saved passwords from your browser to avoid two out-of-sync systems.

Step 4: Replace Weak and Reused Passwords

  1. Open the Bitwarden web vault and check its built-in health report or password strength tool, which flags weak, reused, and old passwords.
  2. Work through the list, starting with your most important accounts: primary email, banking, and any account tied to password resets for others.
  3. For each one, log into the site, go to account security settings, and change the password using Bitwarden's built-in generator (right-click the password field with the extension active, or generate one manually and copy it in).
  4. Save the new password to Bitwarden as you go.

Pro tip: Prioritise your primary email account above everything else. Most "forgot password" flows for other sites route through email, so a compromised email account can cascade into every other account being reset and taken over.

Setting Up Two-Factor Authentication

Two-factor authentication (2FA) adds a second proof of identity beyond your password — typically a code from an app on your phone — so a stolen or guessed password alone isn't enough to get into an account.

Choosing a 2FA Method

  • Authenticator apps (Google Authenticator, Microsoft Authenticator, or Bitwarden's own built-in authenticator on paid plans): Generate a rotating six-digit code every thirty seconds. This is the recommended method for most accounts.
  • Security keys (such as a YubiKey): A physical USB or NFC device you tap or plug in. The strongest option, particularly worth it for your primary email and any cryptocurrency accounts.
  • SMS text codes: Better than nothing, but vulnerable to SIM-swap attacks where a criminal convinces your mobile provider to transfer your number to their device. Use this only when an app-based option isn't offered.

Setting Up an Authenticator App

  1. Install an authenticator app on your phone.
  2. Go into the security settings of the account you want to protect (look for "Two-factor authentication" or "2-Step Verification").
  3. Choose the authenticator app option — the site will display a QR code.
  4. Scan the QR code with your authenticator app, which immediately starts generating codes.
  5. Enter the six-digit code shown in the app to confirm the setup is working.
  6. The site will typically show a set of backup/recovery codes at this point — save these directly into the corresponding entry in Bitwarden as a secure note, since losing both your phone and these codes can lock you out entirely.

Which Accounts to Prioritise for 2FA

Set up 2FA in this rough order of importance:

  1. Primary email account(s)
  2. Password manager account itself
  3. Banking and financial services
  4. Social media accounts
  5. Cloud storage and backup services
  6. Shopping and other lower-risk accounts

Using Bitwarden's Built-In Authenticator

Bitwarden Premium (a low-cost paid tier) can generate 2FA codes itself and autofill them alongside your password, which is convenient but does mean both factors live in one place. For your most critical accounts — email and the password manager itself — it's genuinely more secure to keep the 2FA code generator on a separate device (your phone) from where your passwords are stored, so a single compromised device doesn't hand over both factors at once.

Ongoing Habits

  • When Bitwarden's health report flags a newly weak or reused password, deal with it within a few days rather than letting it linger.
  • If you receive a breach notification (Bitwarden and services like Have I Been Pwned will alert you), change that specific password immediately, and check whether you'd reused it anywhere else before the migration.
  • Review your 2FA backup codes annually and regenerate them if you're unsure where the originals are stored.

Closing Thoughts

Setting up a password manager and enabling two-factor authentication on your most important accounts is one afternoon's work that meaningfully closes off the most common way accounts get compromised. Start with your email and password manager itself, then work steadily through the rest of your accounts — you don't need to do it all in one sitting, just keep moving through the list.

Was this guide helpful? Explore more Privacy Settings guides, or browse all Security & Performance articles.