Using a Password manager can prove highly essential for good password management practices.

Broadly speaking, password managers allow users to generate strong passwords - but most importantly they allow users to have unique passwords for their various online accounts, eliminating the need for reusing passwords.

This guide is aimed at users ready to start putting their password manager to use. If users need more help or guidance on the topic of password managers themselves, then please refer to avoidthehack's inclusive guide on everything users need to know about password managers.

Step 0: Picking a password manager

Hopefully users have picked a password manager that both has a demonstrated commitment to security and is beneficial to user privacy. Ideally, users would have picked a password manager capable of being used offline (or without an active internet connection) and is open-source.

Users are encouraged to review the password manager options presented in avoidthehack’s recommended password managers post.

For users switching password managers

Users reading this guide may be in the process of switching password managers. For example, they may be migrating from a closed-source solution to an open-source solution.

Fortunately, most password managers allow users to export their vaults to a file that can then be imported by the new password manager.

Different password managers have differing steps for exporting the vault database; users should consult their existing password manager’s user guides/instructions for assistance in exporting databases.

Once successfully exported, this database can be imported into another password manager.

Step 1: Create a master password

The master password is the definitive “key” to decrypting and unlocking the encrypted vault of the password manager.

Users will want to take the utmost care in creating a strong password - it is far more ideal for users to create a “passphrase,” which would be harder to brute force attack or guess for an attacker. Users may also find passphrases easier to remember.

This master password or passphrase should be unique and not used anywhere else - not even to unlock any devices or machines. It should not contain personal identifiable information (PII) such as parts of social security numbers or birth dates.

The master password should not contain information that could be easily “guessable” with or without open-source intelligence investigation (OSINT - research) - this includes, but is not limited to:

• Pet, children, or family names
• School names
• Favorite colors/games
• Pet, children, family member birthdays
• Address information, such as street name or building numbers

Storing the master password

In an absolutely ideal world, the master password wouldn’t be stored anywhere but in your head. However, in the event you forget your master password and don’t have access to any of your backup methods, you’ll lose the information contained inside the vault -...