Tools · Passwords and sign-in

Using a password manager

A password manager creates, stores and fills in a different strong password for every account, so one data breach can't unlock the rest. You remember a single master passphrase of 4 to 7 unrelated words. Good free options exist, including ones built into browsers. Set it up in this order: choose a reputable one, make the master passphrase, turn on two-step sign-in, then replace your email and bank passwords first with random 16+ character ones. Write the master passphrase down and keep it somewhere physically safe; most managers can't recover it.

Easy30 min to set up; a few weeks to cover every accountFree options; paid plans add featuresChecked October 2, 2026

What to know

Choose a reputable password manager. Many good ones are free, including those built into browsers; dedicated managers often add stronger security features and work better across devices. Compare reviews from a trusted source like Consumer Reports. Source: CISA National Cybersecurity Alliance
Look for "zero-knowledge" design: the company can't see your passwords and never stores your master password. Source: National Cybersecurity Alliance
Create the master passphrase: 4 to 7 unrelated words, like CISA's example "Horse Purple Hat Run Bay Lifting." Spaces are fine. Source: CISA Don't use that example itself.
Turn on two-step sign-in for the password manager right away. Source: National Cybersecurity Alliance
Install its browser extension and phone app so it can autofill and sync. Source: National Cybersecurity Alliance
Replace your most important passwords first: email, social media and financial accounts. Source: CISA Let the manager generate each one: at least 16 characters, random, and unique. Source: CISA
Let the rest come over time. Save passwords as you log in, or import them all at once. Source: National Cybersecurity Alliance

Watch out Reusing a password, even with a letter or symbol added, is risky. If one account is breached, that password becomes a skeleton key to the others. Source: National Cybersecurity Alliance In CISA's example, one reused password let a hacker into someone's email and start a $700 bank transfer. Source: CISA

Strong password rules

A strong password follows all three rules. Source: CISA

Rule	What it means
Long	At least 16 characters. Longer is stronger.
Random	A random mix of upper- and lowercase letters, numbers and symbols, or a passphrase of 4 to 7 unrelated words.
Unique	A different password for every account.

Safer than what you're doing now

Reusing the same password across accounts Source: National Cybersecurity Alliance
Writing passwords in a notebook or on sticky notes Source: National Cybersecurity Alliance
Saving them in a spreadsheet, notes app or file on your computer Source: National Cybersecurity Alliance CISA
Short or guessable passwords like 12345, birthdays or pet names Source: CISA

If it doesn't work

Forgot the master password? Most managers can't recover it, because they never store it. Memorize it or keep it somewhere secure, like a safe, and set up any recovery option offered. Source: National Cybersecurity Alliance
Autofill not working on a site? Open the manager and copy and paste instead.
Got a breach alert? Many managers warn you about breached, weak or reused passwords. Source: National Cybersecurity Alliance Change that password right away. Source: FTC
A site won't accept a long password? CISA suggests asking the company why it allows weak ones. Source: CISA

Good to know

Phishing warnings

Many managers also warn you about suspicious or phishing websites. Source: National Cybersecurity Alliance

Is one vault risky?

Reputable managers encrypt your data, so it's unreadable even if intercepted. Using one is far safer than reusing passwords. Source: National Cybersecurity Alliance

Sources

Cybersecurity and Infrastructure Security Agency Use strong passwords (archived)
National Cybersecurity Alliance What is a password manager?
Federal Trade Commission Use two-factor authentication to protect your accounts

Lesson T3.1 · Last checked October 2, 2026 against the sources listed.

See a mistake? Tell us

Next in ToolsTurning on two-step sign-in