How to set up a password manager and stop reusing passwords

By the end of this guide, the passwords your browser has saved will sit in one encrypted vault, unlocked by a single passphrase you can actually remember, and you'll have a plan for replacing the ones you reuse. You need a computer with Chrome, Edge or Firefox, a pen and paper, and about 40 minutes. For Bitwarden, keep your phone nearby too. Everything here is free.

Why bother

Websites get broken into, and the email addresses and passwords taken from them are passed around afterwards. That happens on the company's servers, however careful you are.

The damage spreads through credential stuffing. Attackers feed those email-and-password pairs into software that tries them on email providers, shops and social networks. Wherever you used the same password, it works. If every account has its own password, a leak stays at the one site it came from. A password manager makes that realistic: you remember one passphrase, and it remembers the rest.

How a password manager works

• One master password. One long passphrase, the only one you need to remember, unlocks everything else.
• An encrypted vault. Your logins are stored scrambled, and only your master password can unscramble them. Bitwarden encrypts your vault on your own device before syncing it, so its staff can't read it. KeePassXC keeps it in an encrypted file on your computer.
• Autofill. A browser extension fills in your username and password on the matching website. It checks the address first, so it won't offer your bank login on a look-alike site.
• A generator. It creates long random passwords for new accounts.

Bitwarden or KeePassXC?

Both are free and open source. The big difference is where your vault lives.

Pick Bitwarden if you want your passwords on your phone too, which suits most people. Pick KeePassXC if you mostly use one computer, or want nothing stored on anyone else's servers. There's no official iPhone app for KeePassXC either; compatible third-party apps exist, but Bitwarden is simpler there.

Set up Bitwarden

1. Make a master passphrase

This one passphrase guards everything, so make it long and random. Words picked by chance beat any clever password you invent, because people choose predictable words.

1. Open the EFF's dice passphrase page and its long word list.
2. Roll five dice and note the numbers in order, such as 4-1-5-2-6.
3. Look that number up in the list. That's your first word.
4. Repeat until you have six words, the number the EFF suggests.
5. Write the words down in order, with hyphens between them.

You'll end up with something like pebble-anthem-mutiny-gravel-unwind-oyster (an example only: don't use it). No dice? A dice app works, as long as chance picks the words, not you. Use this passphrase for your password manager and nowhere else.

2. Create your account

1. Go to vault.bitwarden.com and click Create account.
2. Enter your email address and choose where your account is stored: bitwarden.com (US) or bitwarden.eu (EU). Note which, because you'll choose the same one when you log in elsewhere.
3. Click Continue. An email should arrive within a few minutes; if it doesn't, check your spam folder.
4. In the email, click Verify email. A page opens asking you to set your master password.
5. Type your passphrase in both password boxes. It must be at least 12 characters; six words is plenty.
6. Leave the hint empty, or write one only you would understand. Never put the passphrase itself in the hint.
7. Click Create account. You should see your new, empty vault; if you're asked to log in instead, use your email address and passphrase.

3. Install the browser extension

1. Open our Bitwarden page, follow the official download link and choose your browser. You'll land in your browser's extension store.
2. Add the extension and confirm. Its shield icon appears in the toolbar, or behind the puzzle-piece Extensions button.
3. If the icon isn't showing, click Extensions and pin it.
4. Click the icon, enter your email address and click Continue.
5. Enter your passphrase to log in. If you're emailed a verification code, type it in: it's a check for logins from new devices.

4. Export your browser's passwords

Your browser can save its passwords as a CSV file, a plain spreadsheet that anyone who opens it can read. Save it in your Downloads folder, not on the Desktop or in Documents, which some computers upload to the cloud. Import it straight away, then delete it.

In Chrome:

1. Click the three-dot More button, then Passwords and autofill → Google Password Manager.
2. Click Settings on the left.
3. Next to Export passwords, click Download file.
4. If asked, enter your computer's password or PIN, then save the file.

In Edge:

1. Click Settings and more (the three dots, top right), then Passwords.
2. Click the … button on the passwords page and choose Export passwords.
3. Confirm the export, entering your computer's password or PIN if asked.
4. Save the file.

In Firefox:

1. Type about:logins in the address bar and press Enter.
2. Click the … menu at the top right and choose Export Passwords….
3. Click Continue with export, entering your computer's password or Primary Password if asked.
4. Save the file.

Brave, Opera and Vivaldi can export a CSV file from their password settings too. If you can't find an export option, update your browser and look again.

5. Import into Bitwarden

1. Go to vault.bitwarden.com and log in.
2. Choose Tools → Import.
3. Under File format, pick your browser's name from the list.
4. Click Choose File and select the file you exported.
5. Click Import. Your logins should now be listed in the vault.

If you see an import error, nothing was added: check the File format and try again. Import only once, because Bitwarden doesn't check for duplicates.

Then delete the exported file. On Windows, select it and press Shift+Delete so it skips the Recycle Bin. On a Mac, move it to the Bin, then empty the Bin.

6. Remove the browser's copy

Once a few logins work from the extension, delete the browser's copy and stop it offering to save new ones.

In Chrome, go back to Google Password Manager → Settings:

1. Next to Delete all Google Password Manager data, click Delete data, then Delete. This deletes saved passkeys too, so if you use any, delete passwords one at a time instead.
2. Switch off Offer to save passwords and passkeys.

In Edge:

1. Open Settings and more → Settings → Privacy, search, and services.
2. Under Clear browsing data, click Choose what to clear.
3. Set Time range to All time and tick only Passwords. Leaving cookies ticked would sign you out of websites.
4. Click Clear now.
5. Open Settings and more → Passwords → Settings and turn off Offer to save passwords.

In Firefox:

1. Go to about:logins, click … and choose Remove All Passwords, then confirm.
2. Open Settings, search for passwords and untick Ask to save passwords.

7. Turn on two-step login

With two-step login, someone who learns your passphrase still can't get in without a code from your phone.

1. In the web vault, choose Settings → Security → Two-step login.
2. Next to the authenticator app option, click Manage, then enter your passphrase.
3. On your phone, install an authenticator app such as Bitwarden Authenticator (any authenticator app works).
4. Scan the QR code on your screen with the app.
5. Type the six-digit code the app shows and click Enable. You should see that the method is now enabled.
6. Click Close.
7. Click View recovery code, enter your passphrase and copy the code onto paper.
8. Leave this tab open and log in from a private window. You should be asked for a code; once that works, close the old tab.

If codes are rejected, make sure your phone sets its clock automatically. The recovery code switches two-step login off if you lose your phone; using it gives you a new one, so write that down too.

8. Write down what can't be replaced

Nobody at Bitwarden can see, reset or recover your master password. Forget it, and your vault is gone.

On one sheet of paper, write your passphrase, your recovery code and your region (bitwarden.com or bitwarden.eu). Keep it somewhere safe at home, such as with your passport, and don't photograph it. Type the passphrase every day for a week until it sticks.

Finally, install the phone app from our Bitwarden page, log in and turn on its autofill.

Set up KeePassXC

Make your master passphrase first, exactly as in step 1 above.

Create your database

1. Install KeePassXC from its page here and open it.
2. Click Create Database. You should see General Database Information.
3. Type a name in Database Name:, such as Passwords, and click Continue.
4. On Encryption Settings, leave everything as it is and click Continue.
5. On Database Credentials, type your passphrase in Enter password: and again in Confirm password:. Ignore Add additional protection… for now.
6. Click Done.
7. Choose a folder and a file name and click Save. Your new, empty database opens.

If you're warned that the password is weak, use a longer passphrase.

To bring in your browser's passwords, export them as in step 4 above. Then choose Database → Import…, pick Comma Separated Values (.csv), select the file and import it into your open database. Check the preview at the bottom: if the columns don't line up, re-map them before you click Done. Delete the CSV file afterwards.

Where to keep the file

• On one computer, your Documents folder is fine; the file is encrypted, so cloud copies don't matter.
• To use it on several devices, keep it in a folder your cloud storage syncs. Pick a service with version history, so you can roll back a damaged file.
• Close the database on one device before editing it on another, or the sync service may create conflicting copies.
• On Android, KeePassDX opens the same file.

Connect your browser

1. Install KeePassXC-Browser from its page here. It's available for Chrome, Edge and Firefox.
2. In KeePassXC, choose Tools → Settings. On a Mac, look in the app's own menu, next to the Apple menu.
3. Click Browser Integration on the left.
4. Tick Enable browser integration.
5. Under Enable integration for these browsers:, tick your browser and click OK.
6. With your database unlocked, click the KeePassXC-Browser icon in your browser, then Connect.
7. Name this connection, such as chrome-laptop, and click Save and allow access.

Login boxes on websites now show a small icon; click it to fill them. The first time a site wants an entry, KeePassXC asks: click Allow Selected. If nothing happens, check that the database is unlocked, then restart the browser. On Linux, browsers installed as Flatpak or Snap packages generally can't connect; Ubuntu's Firefox Snap is the exception.

Back it up

1. Choose Tools → Settings → General.
2. Make sure Backup database file before saving is ticked, then click OK. KeePassXC now keeps a copy of the previous version each time it saves.
3. Once a month, choose Database → Save Database Backup… and save a copy to a USB stick.

Lose the passphrase or every copy of the file, and nobody can recover your passwords, so keep a paper copy as in step 8 above.

Passkeys

A passkey is a login without a password. Your password manager keeps a secret key and the website keeps only a matching public one, so there's nothing to reuse, leak or type into a fake site.

• Bitwarden's free plan stores and uses passkeys. When a site offers to create one, the extension asks to Save passkey. If it doesn't, turn on Ask to save and use passkeys under Settings → Notifications in the extension. On a phone you need iOS 17 or Android 14 or later.
• KeePassXC handles passkeys through KeePassXC-Browser: tick Enable Passkeys in the extension's settings. They're stored in your database, so your backups include them.
• A browser's CSV export carries passwords, not passkeys. For any passkey you made in your browser, sign in to that site and create a new one in your password manager.

What to do first

1. Check your email address on Have I Been Pwned: type it in and click Check. You'll see which known breaches included it, and Notify Me emails you about future ones.
2. Change your email account's password first. Password-reset links for everything else go to your inbox, so whoever controls it can take over the rest. Turn on two-step login there too.
3. Next, your bank and anything else that holds money or card details.
4. Then the rest, as you go: whenever you log in somewhere with an old, reused password, change it there and then.

Let your password manager create each new password: in Bitwarden, use the extension's Generator tab or the Generate button when editing a login; in KeePassXC, click the dice icon in the password field.

To find reused passwords in KeePassXC, choose Database → Database Reports… and open Health Check. Bitwarden's reuse report is a paid feature, so on the free plan, start with the two or three passwords you know you use everywhere.

Stuck? Ask in the forum.