Password Managers, Explained: How to Stop Using the Same Password Everywhere
Be honest. You have one password. Maybe two. The "good one" with a capital letter and a 1 on the end, and the "throwaway" you use for sites you don't care about. When a site makes you change it, the 1 becomes a 2.
We're not judging. That's how most people do it, and it made sense back when you had five accounts. You have closer to a hundred now, and that one password is the weak spot in all of them.
Here's how it goes wrong. A website you signed up for years ago gets breached. Criminals take the leaked list of emails and passwords and run them against everything else: email, banks, Amazon, Instagram. Wherever the password matches, they're in. Nobody "hacked" you in the movie sense. They used the key you left under the mat, on a hundred different mats.
The fix isn't a better memory. It's a password manager.
What a password manager actually does
- Remembers every password for you, locked behind one main password (plus Face ID, a fingerprint or your device PIN).
- Makes up long, random passwords when you create an account, so every account gets its own.
- Fills them in on websites and apps, so you rarely type a password again.
- Warns you when a saved password is weak, reused or showed up in a data breach.
- Holds passkeys too, the newer password-free way to sign in (more on those in our two-factor guide).
You go from remembering a hundred passwords badly to remembering one well.
Which one should you use?
The one you'll actually use. All four of these are solid.
| Option | Cost | Best for |
|---|---|---|
| Apple Passwords | Free | Mostly iPhone, iPad and Mac. Built in on iOS 18 and later, and works on a Windows PC through iCloud for Windows. |
| Google Password Manager | Free | Android and Chrome people. Built into Chrome everywhere, and works on an iPhone if you pick Chrome for AutoFill. |
| Bitwarden | Free plan; Premium about $20 a year | Mixed households (iPhone, Windows, Android) that want one app everywhere. |
| 1Password | Paid only, with a free trial | Families and small businesses that want the most polished app and easy sharing. |
Our rule of thumb: everyone in the house on Apple, use Apple Passwords. Living in Chrome and Android, use Google's. A mix of everything, or you run a business with shared logins, go with Bitwarden or 1Password.
What we'd steer you away from: the notes app, a spreadsheet named "passwords," and the sticky note on the monitor. (We've seen all three more times than we can count. The sticky note is undefeated.)
Set it up in an afternoon
- Pick one and install it on your phone and your computer.
- Make your main password long. A short sentence or four or five random words beats a short jumble of symbols. Federal guidance (NIST) now says length matters more than complexity. Write it down once and keep that paper somewhere safe at home, not in your wallet.
- Turn on two-step verification for the password manager account. If you went with Apple or Google, that means your Apple Account or Google account, which are now the keys to everything.
- Turn on autofill. On an iPhone: Settings → General → AutoFill & Passwords, then pick your app. On Android, search Settings for Autofill. In Chrome it's on by default.
- Bring in what you already saved. If you picked Bitwarden or 1Password, import the passwords your browser has been saving, then turn off the browser's own password saving so you're not keeping two lists.
- Fix the big ones first. Don't try to change 200 passwords tonight. Give these new, generated passwords:
- ☐ Email (every password reset goes there)
- ☐ Apple Account, Google or Microsoft account
- ☐ Bank, credit cards, PayPal and Venmo
- ☐ Your phone carrier account
- ☐ Amazon and anywhere else with a saved card
- ☐ Social media
- ☐ Business accounts: Google Business Profile, Square, your domain and website host
- Let the rest happen on its own. Every time you log into an old account, let the manager make a new password and save it. A couple of months from now, you're mostly done without ever having a "password weekend."
- Run the security check. Apple Passwords has a Security section, Google has Password Checkup, and Bitwarden and 1Password have their own. They flag reused, weak and leaked passwords. Work down the list.
The usual worries
"Isn't that all my eggs in one basket?" Kind of. But it's one very strong basket with a long password, two-step verification and encryption, versus 40 baskets with the same cheap lock. The second one is how people actually get hacked.
"What if the password manager gets hacked?" Apple, Bitwarden and 1Password encrypt your saved passwords so the company itself can't read them. The thing that unlocks them is your main password, which is why it matters and why it never leaves your hands.
"What if I forget the main password?" With Bitwarden or 1Password, nobody can reset it for you. That's the point, and it's why you write it down once and keep it safe at home. (1Password gives you an Emergency Kit to print for exactly this.) With Apple or Google, it's tied to your Apple Account or Google account, so normal account recovery applies.
"My job makes me change my password every 90 days." That's your work's IT policy, and plenty of companies still have one. Current federal guidance actually recommends against forced changes on a calendar. For your own accounts, change a password when there's a reason: a breach, a scam, somebody saw it.
Want help?
Getting a household or a small team onto a password manager is one of the best hours you can spend on your tech. We'll set it up on every device, bring over what you have, fix the important accounts with you and make sure you can still get in if your phone takes a swim. Book a session or check out membership.