Move your whole life into a password manager in a weekend, without locking yourself out

Most people never adopt a password manager because the migration looks like one giant, risky task. It is not. It is three small tasks done in the right order, and the order is what keeps you from ever being locked out.

Day one: fill the vault before you change anything

Install the manager and import what your browser already knows. Every major browser can export saved passwords, and every major manager can import them. Do not retype them by hand; you will skip the ones you barely remember, and those are exactly the accounts that will bite you later. After the import, log in to nothing. The vault is now a record, not yet a system.

Now audit the record. You will find duplicates: the same password reused across a forum, a shop and, worryingly, your email. Mark those. Reuse is the only thing that turns one leaked site into five compromised accounts, which is why the migration is worth doing at all. For the honest scenario-by-scenario picture of what a manager does and does not protect, see the VPN and password safety table.

Day one, evening: the two keys you must not lose

A password manager concentrates risk into two secrets: the master password and the recovery path. Choose a master password that is long and memorable to you alone - a string of four or five unrelated words beats a short symbol soup, because length is what resists guessing and you will type it dozens of times a day. Write the recovery kit - the printed emergency code, the location of any key file - on paper, and put the paper somewhere you trust. A manager with no recovery path is a single point of failure; a manager with a paper kit is a belt with braces.

Day two: rotate the five that hurt, in this order

Do not try to change two hundred passwords in a weekend. Change the five that matter, then let the rest rotate naturally the next time you log in.

• Email first. Your email is the master key to password resets everywhere else. Secure it before anything that depends on it.
• Bank and payments. Direct financial damage lives here.
• The account that stores your identity documents or cloud backups. Losing it is losing your paper trail.
• Your primary shop and delivery accounts. Less about money, more about the saved card and address an attacker inherits.
• Work-adjacent accounts that share any password with the above.

For each, generate a long random password in the manager and enable two-factor while you are logged in. If you want the free-tier baseline for the manager itself, the Bitwarden free-plan piece documents what unlimited devices officially includes.

What this does not cover

A manager fixes reuse and recall. It does not fix phishing - a perfect vault still hands your real password to a fake login page that looks right. That is a separate skill; spotting a suspicious link is the companion habit. And it does not replace having done the two-minute security checklist; do both.

Sources

• Bitwarden