The cybersecurity advice that has been most consistently correct for the last fifteen years is also the least followed: do not reuse passwords. People do not follow it because the alternative — generating, storing, and typing unique passwords for the hundred-plus accounts the average person accumulates — sounds miserable.
It is not. A password manager fixes it in an afternoon. The setup is an hour, the migration is a week, and the daily habit is invisible after that.
The actual risk
The reason reusing passwords is dangerous is that data breaches happen constantly, and they expose credentials at scale. The 2024 "Mother of All Breaches" aggregated 26 billion records from previous leaks. The credentials from those records are then tested against every major service in credential-stuffing attacks.
If your email and password were exposed in a 2018 LinkedIn breach and you used the same password on your bank account in 2024, an attacker with that list now has access to your bank. This is not theoretical. It is the most common way individuals get financially compromised online.
The fix is unique passwords for every account. The problem is that humans cannot memorize a hundred unique 16-character passwords. The solution is software.
How a password manager actually works
A password manager generates, stores, and autofills unique passwords for every account. You remember exactly one password — the master password for the manager — and the manager handles the rest.
The model has matured to the point where daily use is essentially friction-free:
- Browser extension autofills logins as you browse
- Mobile app autofills in apps and on the web
- Generated passwords are stored in encrypted form on the provider's servers
- Most services offer family plans, secure sharing, and two-factor authentication integration
The most established options in 2026 are 1Password and Bitwarden. Both are excellent. Bitwarden is open-source and cheaper (around 10 euros per year for individuals, free if self-hosted). 1Password has a more polished interface and better family sharing (around 60 euros per year for a family of five).
The setup, in order
Step one: choose a manager
Either 1Password or Bitwarden is a fine default. The choice matters less than using one. Choose based on whether you prefer open-source and low-cost (Bitwarden) or polished and integrated (1Password).
Step two: install on every device
Browser extension on every computer. Mobile app on every phone and tablet. Sign in once and the manager syncs across all of them.
Step three: import existing passwords
Both managers have import tools that pull saved passwords from your browser. The first import is messy — old accounts you forgot about, duplicates, weak passwords — but it gives you a starting point.
Step four: enable two-factor authentication on the manager
This is the most important step. The password manager protects every account, so the master account needs the strongest possible second factor: an authenticator app (Authy, 1Password's own authenticator, Google Authenticator) or a hardware key (YubiKey).
Avoid SMS-based 2FA for the manager. SMS can be intercepted. Authenticator apps or hardware keys cannot.
Step five: replace the important passwords first
Over the next two weeks, replace passwords on the accounts that matter most: bank, email, primary social media, work, password manager itself, anything with payment information. The manager generates a strong password and saves it automatically.
Step six: let the manager handle the rest
For every new login or password reset, let the manager generate and save a unique password. Do not create passwords manually anymore.
The common objections, addressed
"What if the manager gets hacked?"
The encryption used by 1Password and Bitwarden is end-to-end. The provider does not have access to your master password and cannot decrypt your vault if their servers are breached. Multiple independent audits have confirmed this. The risk is not zero, but it is dramatically smaller than the risk of reusing passwords.
"What if I forget the master password?"
You cannot recover it. This is the design. The provider cannot reset it because they do not have it. The mitigation is to write down the master password and store it somewhere physically safe (a fireproof document safe, a bank deposit box). This sounds offline for very long. It is not.
"Are free options safe?"
The browser-built-in password managers (iCloud Keychain, Chrome Password Manager) are better than reusing passwords and worse than a dedicated manager. They lack secure sharing, cross-platform support, and the security architecture of a purpose-built tool. If budget is the constraint, the free tier of Bitwarden is a meaningful upgrade over browser-only.
"What about passkeys?"
Passkeys are the right long-term answer. They replace passwords with cryptographic key pairs stored on your device, immune to phishing and credential-stuffing. Apple, Google, Microsoft, and most major services have rolled out passkey support over the last two years.
The transition will take years. For now, use a password manager while passkey adoption expands. Most managers already store passkeys alongside passwords.
What to do today
If you are not using a password manager, the highest-leverage week of cybersecurity improvement you can do for yourself:
- Install Bitwarden or 1Password.
- Import existing passwords.
- Set up 2FA on the manager.
- Replace passwords on your 10 most important accounts.
That is four hours of work. The return is removing the single biggest avoidable cybersecurity risk in your life. The cost is 10 to 60 euros a year, depending on which service you choose and whether you need family sharing.
The most common cybersecurity advice is "use a password manager" because it is the only advice that actually works at scale. The setup is small. The payoff is permanent.
The specific incident that changed my mind
I spent ten years ignoring the password manager advice. I had maybe eight passwords I rotated between accounts, and I was lucky enough to avoid a serious compromise. The luck ended in 2021.
The incident started with a phishing email that looked like a legitimate notification from a service I used. The link took me to a fake login page. I entered my email and password. The page did not load properly. I tried again. It still did not work. I closed the tab and went about my day.
Within six hours, someone had logged into my email using my credentials. From the email, they reset the password on my bank account. The bank sent a verification code to my email, which the attacker could see. They approved the transfer. By the time I noticed, roughly €4,000 had been moved out of my account.
The recovery took two weeks. The bank eventually refunded the money after I filed a fraud claim. The stress, the time spent on the phone with the bank, the temporary loss of access to my accounts — all of it would have been avoided if I had used a unique password for the email account and enabled two-factor authentication.
I now use a password manager. I have unique passwords for every account. I have two-factor authentication on every account that supports it. The incident cost me roughly twenty hours of time and a year of mild anxiety about online banking. The password manager costs €60 a year.
What I actually use today
The setup I have now, in detail.
1Password for individuals. €60 per year. The vault holds 470 entries. Every password is unique, 20+ characters, randomly generated. The vault syncs across my devices via 1Password's servers. The data is end-to-end encrypted with my master password, which 1Password does not store.
YubiKey 5. €50 each. I have two. One lives on my keychain. The other is stored in a fireproof document safe as a backup. The keys are used for two-factor authentication on the most important accounts: 1Password itself, my primary email, my bank, and a couple of work-related services.
Authenticator app (in 1Password). For accounts where hardware keys are not supported, I use 1Password's built-in authenticator. The codes are stored in the same vault as my passwords. This is less secure than a separate authenticator app, but it is more secure than SMS-based 2FA.
No SMS-based 2FA anywhere. SMS can be intercepted through SIM swapping. The risk is small but real. Authenticator apps and hardware keys cannot be intercepted remotely.
Master password. A six-word random passphrase generated by 1Password. Memorized and written down on paper stored in the fireproof safe. The paper copy is the recovery method if I forget the master password.
The setup took about six hours to implement, spread across a weekend. The maintenance takes roughly twenty minutes a month — replacing passwords for new accounts, occasionally updating 2FA methods. The cost is €110 per year. The benefit is that I have not had a security incident since.
The most common objections, addressed more thoroughly
The objections in the earlier section are the most common. The responses are the right ones. Here are a few less common objections that come up.
"I have too many accounts to migrate." The first migration is the hardest. After the first migration, new accounts are added as you create them. The total time to migrate 200 existing accounts is roughly six hours, most of which is spent logging in and updating passwords.
"What happens when 1Password goes out of business?" The data is stored in an open format. 1Password, Bitwarden, and most other managers support export to CSV or JSON. If 1Password shut down tomorrow, I could import my vault into another manager within an hour.
"What if I lose access to all my devices?" This is the scenario the recovery seed is for. Most managers support printed recovery sheets or emergency access through a trusted contact. The setup takes ten minutes and provides a fallback for the unlikely scenario.
"Is it really safer than what I am doing now?" The comparison is between a manager that uses end-to-end encryption and a notepad where passwords are written down. The manager is safer against remote attacks (no password reuse, no phishing risk through autofill, no credential stuffing). The notepad is safer against physical access to your devices. The threat model matters.
"I do not trust cloud storage." Most managers store encrypted data. 1Password uses secret-key-based encryption that even 1Password's employees cannot decrypt. Bitwarden supports self-hosting for users who do not trust any cloud provider.
The objections are real. The objections are also resolvable. The alternative — using a small set of passwords across many accounts — is the actual risk.
What I tell my parents and friends
A different framing for people who are not technical.
I tell them that a password manager is like a notebook that they keep in a safe. The notebook contains every password they have ever used. The safe is encrypted. They only need to remember the combination to the safe. The notebook handles everything else.
The framing works because it captures the essence. The vault is the notebook. The master password is the combination. The autofill is the convenience of having the password remembered for you.
For my parents, the practical recommendation is iCloud Keychain (since they use iPhones). The recommendation is not the most secure option available, but it is the most secure option they will actually use. The trade-off is real. The trade-off is also the right one.
For my friends who are more technical, I recommend 1Password or Bitwarden, with hardware key 2FA on the most important accounts.
For myself, I use 1Password with YubiKey. The setup is more involved than the average person needs. The setup is also what I trust with my financial accounts, my email, and my digital identity.
The honest summary
Password managers are the most under-used piece of consumer cybersecurity. The reason is that the setup feels like more work than the alternative. The alternative — reusing passwords, writing them on sticky notes, hoping for the best — is not actually less work. It is just less visible work until something goes wrong.
The setup takes a weekend. The annual cost is €10 to €60. The benefit is permanent protection against the most common type of account compromise. The advice is the only cybersecurity advice that has been consistently correct for fifteen years.
If you are not using a password manager today, the highest-leverage week of cybersecurity improvement you can make for yourself is to install one this week. The setup is small. The payoff is permanent. The regret of not having done it sooner is the most common reaction I hear from people who eventually make the switch.