Password Managers and Passkeys: A Complete Setup Guide

The problem is reuse, not complexity

Requiring a symbol and a capital letter never stopped a breach. Attackers do not guess your password character by character; they take a list of billions of email and password pairs from previous leaks and replay it. If the pair works anywhere, that account is gone.

This means the only property that protects you is uniqueness. A long, boring, unique password per site is strictly better than a clever, complex one used in three places.

Humans cannot generate or remember dozens of unique strings. That is not a discipline failure, it is a design failure, and a manager is the fix.

Choosing a manager without overthinking it

The differences that actually matter

Any reputable manager with end-to-end encryption, a published security model and independent audits is a large improvement on your current situation. Do not stall for weeks comparing feature grids.

The features that genuinely matter: cross-device sync you will actually use, a browser extension for autofill, secure sharing if you have a household or team, and an emergency access or recovery path.

Autofill is a security feature, not a convenience feature. A manager refuses to fill credentials on a lookalike domain, which means it catches phishing pages that your eyes will not.

• End-to-end encryption with a published model
• Independent third-party audits
• Reliable sync across every device you own
• A recovery path you have actually tested

The master password and recovery

Your master password is the one secret you still memorise. Make it a passphrase of four to six unrelated words. Length beats character soup, and a phrase is far easier to recall under stress.

Write it once on paper and store it somewhere physically secure. This is not bad practice; the threat model for a piece of paper in a locked drawer is completely different from the threat model for a reused string on the internet.

Set up and then actually test the recovery path. Most people discover their recovery kit does not work at the exact moment they need it. Test it while you still have access.

What a passkey is, in plain terms

A passkey is a key pair. The private half never leaves your device and is unlocked by your fingerprint, face or device PIN. The public half sits with the website. Signing in means your device proves it holds the private key.

Nothing reusable is transmitted. There is no shared secret in a database for an attacker to steal, so a breach of the site yields nothing that logs anyone in. Phishing also fails, because the key is bound to the real domain and simply will not respond to a lookalike.

Passkeys sync through your platform account or your password manager, so losing one device does not lock you out. Register a second device or a hardware key anyway.

A migration plan for one evening

Highest impact first

Start with your primary email. It is the recovery address for everything else, so it is the account that unlocks all the others. Give it a unique generated password, then add a passkey or an authenticator app.

Then do banking and payments, then anything with a saved card, then social accounts, then the long tail. Import your browser-saved passwords into the manager, run its breach and reuse report, and work down the list it produces.

Switch two-factor from SMS to an authenticator app or passkey wherever it is offered. SMS codes are interceptable through SIM swap and are the weakest of the second factors still in common use.

• Email first, then payments, then everything else
• Replace SMS codes with an app or passkey
• Run the reuse report and fix every flagged entry
• Register a backup device before you need it

Living with it afterwards

Let the manager generate every new password and never memorise one again. If a site offers a passkey, take it and remove the password afterwards where the site allows.

Review the breach report quarterly. It is the closest thing to a health check for your online identity, and it takes about five minutes.