How to Set Up a Free Password Manager the Right Way

Why Passwords Fail Without Help

The average person has dozens of online accounts and cannot memorise dozens of long, random passwords. So the brain does what brains do: it reuses one password everywhere with small variations, or picks something memorable and short. Both habits are exactly what attackers count on.

The consequence is a domino effect. One site with weak security gets breached, and the email and password combination is tested against every major service within hours. Because the password was reused, the breach spreads from a hobby forum to your email, your bank and your website.

A password manager solves this by remembering what humans cannot: a different, long, random password for every account, stored encrypted and filled in automatically. This guide covers how to choose one, set it up properly, migrate your existing passwords, and build the small habits that keep it secure.

What a Password Manager Does

Stores passwords in an encrypted vault protected by one master password you do remember.
Generates strong random passwords so you never invent one yourself again.
Fills in logins automatically on websites and apps through a browser extension or mobile app.
Syncs across devices so your phone and laptop have the same vault.
Warns about weak or reused passwords and alerts you when a breach includes your credentials.
Stores more than passwords, such as secure notes, card details, addresses and recovery codes.
Shares individual items securely when a colleague or family member genuinely needs access.

Choosing a Free Option

There are three realistic free routes, and all three are far better than reuse.

Option	Strengths	Limits
Open-source password managers	Free for unlimited passwords across devices; audited; transparent code	Interface is plainer; advanced sharing features may be paid
Browser built-in managers	Zero setup; already syncing on your device	Weaker organisation, limited sharing, tied to one ecosystem
Vendor trials and free tiers	Polished interfaces	Often limited to one device type or a device count without payment

For most people, an open-source manager on a free tier is the best value. If you already use a browser’s built-in manager, keep using it as a starting point, but understand that moving later takes effort, so choose deliberately rather than drifting.

Setting It Up: Step by Step

Create the account on your computer, not your phone, because you will be typing and importing.
Choose a master password using the passphrase method explained below. Do not reuse anything you have used before.
Install the browser extension and log in. Pin it so it is always visible.
Install the mobile app and sign in, enabling biometric unlock for convenience.
Turn on two-factor authentication for the password manager account itself. This is the one account where 2FA is non-negotiable.
Save the recovery code offline, in a locked drawer or a safe, not only inside the vault it is meant to recover.
Import your existing passwords from your browser or a spreadsheet, as described below.
Run a security audit if your tool offers one, and start replacing weak and reused passwords.
Test on one site by generating a new password, saving it, logging out and logging back in with autofill.

Creating a Master Password You Can Actually Remember

The master password is the only one you need to memorise, so it must be both strong and memorable. The reliable method is a passphrase of four to six unrelated words, joined with a symbol or two and a number that does not follow a pattern.

What to avoid:

Names of family members, pets, or your city, especially combined with a birth year.
Quotes, song lyrics or famous phrases, which appear in cracking wordlists.
Simple substitutions such as “@” for “a” on an otherwise ordinary word.
Anything you have used as a password before, anywhere.

Practise typing it a few times a day for a week. Write it on paper only temporarily, keep that paper out of sight, and destroy it once the passphrase is firmly in memory. A written master password left in a drawer for two years is a worse risk than the effort of learning four words.

Importing Your Existing Passwords Safely

Migration is the step where people get nervous, and reasonably so. Handle it in this order.

Export from your browser or current tool as a CSV file. Understand that this file is plain text and is the most sensitive file on your computer at that moment.
Import it into the password manager.
Delete the CSV immediately, and empty the trash or recycle bin afterwards.
Check the import worked by opening a handful of saved logins and testing autofill.
Delete the exported copy from any cloud sync folder, download history or backup if it was temporarily placed there.

If you are importing on a shared computer, do this on a private device instead. Timing matters: a plain text CSV sitting in a downloads folder for a week is a genuine risk, while a CSV that exists for three minutes is not.

Replacing Weak Passwords Without Losing a Weekend

You do not need to change everything in one day. Work in priority order.

Primary email account.
Banking, payment apps and anything with card details.
Hosting, domain registrar and WordPress administrator logins.
Social media accounts.
Cloud storage and documents.
Shopping accounts with saved cards.
Everything else, whenever you next log in.

For any account you visit less often, change the password the next time you log in. That way the job completes itself over a few months without a dedicated marathon session.

Sharing Passwords Without Exposing Them

Sometimes sharing is necessary: a spouse, a business partner, an accountant, a developer. Do it properly.

Use the built-in sharing feature in your password manager, which shares a single item rather than the whole vault.
Revoke access when the need ends. Contractors finish projects; access should not linger.
Never send passwords by email, SMS or chat. Those channels persist in backups and on devices long after the message is deleted.
For temporary sharing, use a one-time secret link that expires after viewing.
For team credentials, use a manager with proper user roles and an activity log rather than a shared note.

Small Habits That Make It Work

Generate a new random password for every new account, even ones you think do not matter.
Let the manager fill, rather than pasting, because pasting leaves the value in the clipboard.
Clear the clipboard after copying a password manually, especially on a shared machine.
Lock the vault when you step away, and set an auto-lock timeout of a few minutes.
Keep your authenticator app and your password manager on separate devices where practical, so one theft does not hand over both.
Review your vault’s security report monthly and act on the breaches it reports.
Add a trusted emergency contact if your tool supports it, so a family member can gain access if something happens to you.

Common Mistakes

Protecting the vault with a master password that is reused elsewhere. One weak link defeats the purpose.
Storing the recovery code inside the vault it recovers.
Leaving the plain text export file on the computer or in cloud storage.
Sharing the master password so someone else can “help”, rather than sharing a single item.
Ignoring breach alerts because the affected site seemed unimportant.
Forgetting that the manager itself needs updates and needs its own 2FA.
Storing business credentials in a personal vault without any way for the business to recover them.

Frequently Asked Questions

Is it safe to keep all my passwords in one place?

It is safer than reusing three passwords across sixty accounts. Modern managers encrypt your vault locally, meaning the provider stores data it cannot read. The realistic risks are a weak master password and a lost recovery code, both of which you control.

Can I use a password manager for work accounts?

Yes, but check your employer’s policy and use a tool your IT team approves. Some organisations require a business plan with admin controls and auditing.

What if I forget the master password?

Most managers cannot reset it, because they never see it. Recovery depends on your recovery code or emergency access contact. If both are missing, the vault is effectively unrecoverable, which is the system working as designed.

Are browser-generated passwords good enough?

The passwords are strong. The weakness is often the surrounding management: weaker sharing, less reliable organisation, and differences between ecosystems. If you switch browsers or devices, plan your export before you move.

Should I store card details in the vault?

Many people do, and it is convenient. Consider leaving the three-digit security code out, or storing cards only in your bank’s own secure system, so a single compromised vault does not hand over payment details.

What about my Wi-Fi password and device PINs?

Store them as secure notes in the vault. They cannot be auto-filled, but you will eventually need them, and they are exactly the kind of thing people lose.

Your First Week

Day 1: create the vault, choose a passphrase, enable 2FA, save the recovery code.
Day 2: install the extension and mobile app, test autofill.
Day 3: import existing passwords, delete the export file.
Day 4: change the password on your primary email account.
Day 5: change banking and payment account passwords.
Day 6: change hosting, registrar and WordPress admin passwords.
Day 7: review the security report and note which sites still need new passwords.

Password Manager Questions After Week One

What happens if the company behind my manager shuts down?

You export your vault and move to another tool, which is why open standards and easy exports matter when choosing. Most managers let you export to a plain file, and many can import from each other directly. Do the export once a year as a test, keep it brief, and delete the file immediately afterwards.

Should I use the browser’s built-in manager instead?

It is a legitimate starting point, especially if you only use one browser and one device ecosystem. The limitations appear when you share logins, switch browsers, need secure notes and file attachments, or want better reporting on reused passwords. Migrating later is a fifteen-minute job, so starting simple is not a trap as long as you export rather than retype.

How do I manage passwords for apps that cannot autofill?

Store them with the same care and copy them manually when needed. Mobile banking apps, smart TV logins and some desktop software will not autofill, so keep the entry name descriptive, add a note about which device it belongs to, and clear your clipboard after pasting.

What should I do about accounts I no longer use?

Close them where possible, especially shopping sites holding address and card details, and old forums with your email attached. Accounts you never log into are pure risk with no benefit. Where closing is impossible, at least delete saved payment details and change the password to a random one stored in your vault.

Is it a problem that my vault is in the cloud?

Not inherently. Reputable services encrypt your vault on your device, so the provider stores data it cannot read. The practical risks are a weak master password, a missing recovery code, and malware on the device doing the typing. Strong master passphrase, 2FA on the account, and a clean computer cover all three.

How often should I review what is in the vault?

Once a month for five minutes: check the health report, act on any reused or compromised passwords it flags, and delete entries for accounts you have closed. A quarterly check of tags and folders keeps it navigable as the vault grows past a few hundred entries.

Final Thoughts

A password manager feels like an extra step for the first week and an obvious convenience ever after. Pick a free, well-reviewed tool, protect it with a passphrase you have genuinely memorised, turn on two-factor authentication and keep your recovery code somewhere other than inside the vault. That is the whole job, and it removes the largest security risk most people carry around every day.