Accounts & passwords
Should I use a password manager? A plain-English guide to getting started
Most people have dozens of accounts and a handful of passwords they reuse. That’s understandable, and it’s also how one data breach turns into five hacked accounts. A password manager remembers a different strong password for every site, so you only need to remember one.
The short version
Getting started
- Pick a reputable password manager, built-in or standalone.
- Protect it with one long passphrase and two-step verification.
- Move your most important accounts first.
- Let it create new passwords as you go.
Why reused passwords are the real problem
Websites get breached all the time, and the stolen email addresses and passwords are sold and tested on other sites automatically. If you use the same password for a shopping site and your email, a breach at the shop becomes access to your email.
You can’t remember a unique strong password for every account. A password manager can.
Is it safe to put all my passwords in one place?
It’s a fair question. Reputable password managers encrypt your passwords so that only your main password can unlock them. Even the company running the service can’t read them. The risk of one well-protected vault is much lower than the risk of reused passwords across dozens of sites.
The Australian Signals Directorate recommends using a password manager, along with passphrases and two-step verification.
Choosing one
| Option | Good for | Things to know |
|---|---|---|
| Built into your phone or browser (Apple Passwords, Google Password Manager, Microsoft Edge) | Getting started quickly if you mostly use one ecosystem | Easiest to set up. Less convenient if you mix Apple, Windows and Android devices. |
| Standalone managers (such as Bitwarden, 1Password, Proton Pass, Dashlane) | Mixed devices, families and teams | Work across all devices and browsers. Most have family and business plans with sharing. |
Look for: two-step verification support, apps for all your devices, a good security track record, and the ability to share passwords safely with family or staff.
For a business, choose a business plan so access can be managed centrally and removed when someone leaves.
Setting it up
Create a strong main password
Use a passphrase: four or more random words, like coffee-river-lantern-tuesday. Long and memorable beats short and complicated. Don’t use it anywhere else.
Turn on two-step verification
Protect the password manager itself with two-step verification.
Save your recovery details
Most managers give you a recovery code or emergency kit. Print it or write it down and store it somewhere safe at home. Without it, a forgotten main password can mean losing access.
Install it everywhere
Add the app to your phone and the extension to your browser, so it can fill in passwords for you.
Moving your accounts across
You don’t need to do everything in one evening. Start with the accounts that matter most:
- Your main email accounts
- Banking and super
- myGov
- Your phone carrier account (used to protect your number)
- Apple, Google or Microsoft account
- Social media
- Shopping sites with saved cards
For each one, sign in, change the password to a new one generated by the manager, and save it. For everything else, update passwords as you naturally log in over the next few weeks.
Many managers can import saved browser passwords
That gets everything into one place quickly. Then use the manager’s security report to find reused or weak passwords and fix the important ones first.
Test what you know
Passwords and passphrases is a free NovaSoft Labs course with six fictional scenarios and an explanation for every answer. Pass it to print a completion certificate.
Common questions
What happens if I forget my main password?
It depends on the manager. Some offer recovery through your devices or a recovery code, others can’t recover it at all. Set up the recovery option and keep your emergency kit safe.
What if the password manager company gets hacked?
Your vault is encrypted with your main password, so stolen data is very hard to use if your main password is strong and unique. That’s why the passphrase matters.
Do I still need a password manager if I use passkeys?
Yes, for now. Many sites don’t support passkeys yet, and password managers can store passkeys too. See our guide to passkeys.
Sources
This guide is general information, not legal or financial advice. If you think you’ve lost money or personal information, contact your bank and the services named above straight away.
Keep reading
Related help
Talk to NovaSoft
Want a hand with this at work?
These guides are free to use. If your business wants help putting the checks, accounts and devices in place, our team can do it with you.