Using a password manager
A password manager creates and remembers a long, unique password for every account. You remember one strong passphrase. Many good options are free, including ones built into your browser.
You'll need
- Your phone or computer
- A quiet half hour
Do it like this
- Pick a password manager. Some are free, like those built into browsers. Look to a trusted source like Consumer Reports for reviews (CISA).
- Create one strong master passphrase: 4 to 7 unrelated words (CISA).
- Start with your most important accounts: email, bank, phone carrier. Let the manager generate a new password for each (CISA).
- Aim for at least 16 characters, random, and different for every account (CISA).
- Turn on two-step sign-in for the password manager itself (CISA).
Watch out. Reusing one password is risky. If one account is breached, that password can unlock the others (National Cybersecurity Alliance).
If it doesn't work
- Forgot the master password? Most managers can't recover it because they don't store it (National Cybersecurity Alliance). Set up the recovery options it offers on day one.
- Autofill not working on a site? Copy and paste from the manager instead.
- Heard one of your accounts was breached? Change that password right away (FTC).
Good to know
Breach alerts
Many managers alert you to breached or weak passwords (National Cybersecurity Alliance).
Don't keep a file
CISA says not to save passwords in a file on your computer (CISA).
Passphrases
A memorable phrase of unrelated words can be strong and easy to type (CISA).
Sources
- Cybersecurity and Infrastructure Security Agency Use strong passwords
- National Cybersecurity Alliance Password managers
- Federal Trade Commission Use two-factor authentication to protect your accounts
Lesson T2.1 · Last checked October 2, 2026 against the sources listed. See a mistake?
Find it online: