I found out my email password had been leaked online when I tried to log in and got a message that my account had been locked. Someone had been trying to get in for weeks. The scary part was not the attempt. It was that I used that same password for about half my accounts, because I had never been able to remember more than a few variations.

That scare is why I now use a password manager, and it is the single best security change I have made.

The problem with human memory

If you remember your password, it is probably weak. Humans cannot remember thirty unique passwords, so we reuse one strong password, or we use the same password everywhere with a different number on the end. The problem is that when one site leaks your password, attackers try it on every other site immediately. One leak becomes every account.

A password manager stores a unique, random password for every site, so a leak at one site only affects that site. You remember one master password, and the manager handles the rest.

Which one I use

I use Bitwarden. It is open source, which means the code is public and independently audited, and it has a genuinely free tier that covers everything most people need: unlimited passwords, autofill on phone and computer, and syncing across devices.

The setup took about an hour one evening. I changed my important accounts first, email, banking, shopping, then worked through the rest over a few weeks. Bitwarden even has a password generator built in, so every new account gets a random string I never have to think about.

Things to know before you start

• Your master password is the only one you must remember. Make it a long passphrase, like four random words, and write it down somewhere safe once, because there is no recovery if you forget it.
• Turn on two factor authentication for the manager itself. It protects your entire password vault.
• Use the built in generator for new passwords. Let the manager create them instead of making your own.
• Let the manager autofill logins instead of copying and pasting, which is faster and safer.

The first few days feel strange. After a week, you will wonder how you lived without it. I now have a different random password for every site, and I remember exactly one. My email has not been locked again since.