Reusing the same password on multiple sites is how most accounts get hacked — not through elaborate attacks, but because one site gets breached, the stolen password gets tested on Gmail, your bank, and everything else. A password manager solves this completely: every site gets a unique, random, unguessable password, and you only ever remember one. Here is how to set one up properly in 2026.
What changed in 2026
- Passkeys became mainstream. All major password managers now store and autofill passkeys alongside passwords — passkeys are phishing-proof and are replacing passwords for major services (Google, Apple, Microsoft, GitHub).
- Browser built-in managers improved but still fall short. Chrome Password Manager and iCloud Keychain work well within their ecosystems, but neither syncs easily across different browsers and platforms. For cross-platform or cross-browser use, a dedicated manager is still better.
- Bitwarden added passkey support and improved its mobile apps. It is now a complete free option with no meaningful limitations.
- Data breaches accelerated. The Have I Been Pwned database crossed 15 billion records. If you are still reusing passwords, the odds that at least one of your credentials is exposed are extremely high.
Which password manager to pick
| Manager |
Cost |
Best for |
| Bitwarden |
Free (or ~$10/yr premium) |
Everyone — best free option, open source |
| 1Password |
~$36/yr |
Families, teams, power users |
| Dashlane |
~$40/yr |
Easy UX, built-in VPN on premium |
| iCloud Keychain |
Free (Apple only) |
All-Apple households |
| Chrome Password Manager |
Free (Google only) |
Chrome-only, Android |
For most people: Bitwarden if you want free and cross-platform. 1Password if you want the best UX and family sharing and are willing to pay. iCloud Keychain only if every device you own is Apple.
How to set up Bitwarden (step by step)
Step 1: Create your account
- Go to bitwarden.com and click Get Started.
- Enter your email and create a master password — this is the one password you must remember. Make it a passphrase: four random words work well (e.g., "purple-fence-radio-marble"). Write it down and store it somewhere physically safe.
- Set up your master password hint — make it something only you understand.
Step 2: Install the browser extension
- In Bitwarden, go to Downloads and install the extension for Chrome, Firefox, Edge, or Safari.
- Log in to the extension. It will now autofill your credentials on any site.
Step 3: Install the mobile app
- Download Bitwarden from the App Store or Google Play.
- Log in. Enable biometric unlock (Face ID / fingerprint) so you do not need to type your master password on mobile.
- On iPhone: Settings → Passwords → Password Options → enable Bitwarden as autofill. On Android: Settings → Passwords & Accounts → select Bitwarden.
Step 4: Import your existing passwords
- From Chrome: chrome://password-manager/settings → Export passwords → save as CSV.
- From iCloud Keychain: On Mac, open Passwords app → File → Export All Passwords → save as CSV.
- In Bitwarden web vault: Tools → Import data → select your source format → upload the CSV.
- All your existing passwords will appear in Bitwarden immediately.
Step 5: Enable two-factor authentication on Bitwarden
- In Bitwarden web vault: Account Settings → Security → Two-step Login.
- Enable Authenticator App (TOTP) using Authy, Google Authenticator, or a similar app.
- Save your recovery code somewhere safe (printed or in a separate secure location).
How to use it going forward
- On any new account: click the Bitwarden icon in your browser → Generate Password → use the generated password and save it.
- When logging in: Bitwarden fills your credentials automatically after you unlock the vault with biometrics or master password.
- When a site supports passkeys: let Bitwarden save and use the passkey instead of a password — it is more secure and faster.
How to pick the right tier
| Scenario |
Recommendation |
| One person, all devices |
Bitwarden free |
| One person, want emergency access |
Bitwarden Premium (~$10/yr) |
| Family of 2–6 |
1Password Families ($60/yr) or Bitwarden Families ($40/yr) |
| Business team |
1Password Business or Bitwarden Teams |
Common mistakes
Using a weak master password. This is the one password that protects everything. A four-word passphrase is far stronger than a complex but short password. "Tr0ub4dor&3" is weaker than "correct horse battery staple" because humans choose predictable complexity.
Not enabling 2FA on the vault. Without 2FA, anyone who gets your master password has full access. 2FA on the vault itself is not optional.
Not importing existing passwords. Most people have 50–200 passwords scattered across browsers. Import them all, then audit for duplicates and reused passwords using Bitwarden's or 1Password's built-in health report.
Saving the master password in the manager. You cannot recover the vault if you lose the master password and did not store it elsewhere. Write it down and keep it physically safe.
What to skip
- Browser-only password managers for a multi-browser household — if you use Chrome at work and Safari on iPhone, neither Chrome nor iCloud Keychain serves both well.
- "Password manager" features in antivirus suites — they are secondary products, rarely get feature updates, and can lock your passwords if you stop paying the antivirus subscription.
- Storing passwords in plain text notes or spreadsheets — these are not encrypted and one file sync to the wrong place exposes everything.
FAQ
What if Bitwarden gets hacked?
Bitwarden uses zero-knowledge encryption — your vault is encrypted with your master password before it leaves your device. Even if Bitwarden's servers were breached, attackers get encrypted blobs they cannot decrypt without your master password.
Can I use a password manager offline?
Bitwarden and 1Password both cache an encrypted copy of your vault locally. You can access saved passwords without an internet connection; changes sync when you reconnect.
What is the difference between a password and a passkey?
A password is a shared secret you type. A passkey is a cryptographic key pair — the private key never leaves your device, so phishing and database breaches cannot expose it. Where sites offer passkeys, always prefer them.
Should I still change passwords regularly?
Only when there is a reason (breach notification, suspected compromise). Arbitrary 90-day rotation without cause actually reduces security because people choose weaker, predictable passwords to rotate.
Where to go next
See How to set up a firewall in 2026, How to set up a VPN on iPhone in 2026, and How to set up a guest network in 2026.