Password Manager

A password manager stores a unique, strong password for every account behind one strong passphrase, so the user remembers one secret instead of hundreds. The risk shifts to that one vault, so the setup matters: a long master passphrase, multi-factor authentication, and an offline recovery kit. This skill chooses the type, plans the migration, and sets up emergency access.

Input required

• Devices and platforms: phones, computers, browsers, shared machines.
• Current habits: browser-saved passwords, notebook, memory, reuse.
• Who shares accounts: partner, family, work.
• Comfort with cloud versus local storage.
• Budget, if any.

Questions to ask first

Ask in one batch of at most five questions, skipping any already answered:

1. Which devices and browsers do you use daily?
2. How do you store passwords today, and do you reuse them?
3. Do you share any accounts with family?
4. Do you prefer a cloud-synced vault or one stored only on your devices?
5. Who should be able to get in if you cannot?

Method

1. Choose a type. Decide between a standalone manager (works across devices and browsers), a platform or browser built-in manager (simpler, tied to one ecosystem), or an offline file-based one (full control, manual syncing). Compare cross-device support, sharing, export options, multi-factor support, and independent security audits. Product details change, so the user must verify. Pick one; two managers means two places to lose track of.
2. Create the master passphrase. Use a long passphrase of several unrelated words or a phrase the user can type from memory, never reused anywhere. The user enters it themselves; the agent never sees it.
3. Turn on multi-factor for the manager account, using an authenticator app or hardware key. Keep any backup codes offline.
4. Migrate in priority order. First email, banking, phone carrier, and government accounts, then everything else over a few weeks. Use the manager's generator for a unique password, and change reused ones as you meet them. Import from the browser, then delete browser-saved copies.
5. Add multi-factor to accounts that matter, preferably not stored in the same place as the password; see Identity Protection.
6. Build the recovery kit. On paper or an offline drive, record the account email, the manager's recovery or emergency method, and backup codes. Store it in a secure physical place; see Important Docs Vault. The master passphrase can be written and sealed, kept apart from the kit, if the user judges it safe.
7. Set emergency access. Use the manager's emergency or sharing feature if it exists, or a sealed instruction for a trusted person. See Estate Planning for the wider arrangement.
8. Practice recovery. Once, on a spare device, confirm the kit lets them back in.
9. Maintain. Quarterly, review items flagged as weak, reused, or exposed in a breach, and delete old accounts.

Output format

• Recommendation of type with a short reasoning, and verification checklist for the product.
• Migration order as a checklist with the first ten accounts.
• Recovery kit contents and where it lives.
• Emergency access plan.
• Maintenance schedule.

Ground rules

• Never ask for, display, or store passwords, master passphrases, one-time codes, recovery codes, or account numbers.
• Do not endorse or rank products, or state prices, features, or audit results; the user checks current information.
• Do not suggest saving the master passphrase in a note, email, or chat.
• Warn that losing both the passphrase and the recovery kit can mean permanent loss of the vault.

Self-check before answering

• Is exactly one manager recommended?
• Does the plan protect the manager itself with multi-factor?
• Is migration phased by importance?
• Are recovery and emergency access planned, and tested?
• Did I avoid handling any secrets?

Common pitfalls

• Weak or reused master passphrase.
• Skipping multi-factor on the vault.
• Leaving old passwords in the browser after migration.
• No recovery kit, then locking oneself out.
• Putting everything in one place with one factor.
• Never updating weak entries flagged after a breach.

Example prompt

Help me pick and adopt one password manager across my phone and laptop, migrate my important accounts first, and set up multi-factor, emergency access, and an offline recovery kit. I will type all secrets myself.

Learn more

• Identity Protection for the wider layers beyond passwords.
• Important Docs Vault for storing the recovery kit.
• Estate Planning for access when the user is incapacitated.