If you use the same password (or a small family of similar passwords) for more than one account, you're not alone. You're also exactly who attackers count on.

Verizon's 2025 Data Breach Investigations Report found that credential abuse, meaning stolen or guessed passwords, was the most common way attackers first got into the organizations they breached, at 22% of breaches (Verizon 2025 DBIR). When one site leaks your password, criminals try it everywhere else.

A password manager solves this. It creates a strong, unique password for every account and remembers them all, so you only have to remember one. The Cybersecurity and Infrastructure Security Agency (CISA) recommends using one (CISA: Use strong passwords).

Step 1: Pick a password manager (2 minutes)

You have two good options:

  • The one built into your devices. Apple Passwords (iPhone, iPad, Mac) or Google Password Manager (Android, Chrome) are free and already installed. Great if your household mostly uses one brand.
  • A dedicated password manager. Standalone apps work across Apple, Android, and Windows, and make it easy to share passwords with family. Look for one with a long track record and independent security audits.

We don't sell software or take commissions. The best one is the one you'll actually use.

Step 2: Create one strong master password (3 minutes)

This is the only password you'll need to remember, so make it long. A passphrase of four or more random words is strong and easy to type, for example canyon-pickle-lantern-orbit (don't use this one).

Don't lose it. Write your master password on paper and keep it somewhere safe at home, like with your important documents. Most password managers can't recover it for you.

Step 3: Turn on multi-factor authentication (2 minutes)

Protect the password manager itself with a second step, such as a code from an authenticator app or a prompt on your phone. CISA calls multi-factor authentication one of the most effective ways to protect your accounts (CISA: Turn on MFA).

Step 4: Import the passwords you already have (3 minutes)

Most password managers can import the passwords saved in your web browser. Once they're in, turn off your browser's built-in password saving so everything lives in one place.

Step 5: Fix your most important accounts first (5 minutes)

You don't have to change every password today. Start with the accounts that matter most, and let the password manager generate a new, unique password for each:

  1. Your main email account (it can reset every other password)
  2. Bank and credit card accounts
  3. Your Apple, Google, or Microsoft account
  4. Any account that stores a payment card

Update the rest gradually as you log in to them.

Tip: Install the password manager on your phone too, so it can fill in passwords in apps. Then set up its emergency access or family sharing feature, so a trusted person can get in if something happens to you.

Sources: Verizon 2025 Data Breach Investigations Report · CISA: Use strong passwords · CISA: Turn on MFA

Want help setting it up?

We'll set up your password manager and multi-factor authentication with you, on every device, during a flat-rate $50 home consultation.

Ask about a home visit