---
name: password-manager
description: Use when someone wants to choose and adopt one password manager, migrate from reused or remembered passwords, set unique passwords with multi-factor authentication, and prepare emergency access and an offline recovery kit. Related to [[identity-protection]] (the wider protection plan including freezes and phishing habits), [[important-docs-vault]] (storing documents rather than logins), and [[estate-planning]] (access for others after death or incapacity).
---

# Password Manager

A password manager stores a unique, strong password for every account
behind one strong passphrase, so the user remembers one secret instead
of hundreds. The risk shifts to that one vault, so the setup matters:
a long master passphrase, multi-factor authentication, and an offline
recovery kit. This skill chooses the type, plans the migration, and
sets up emergency access.

## Input required

- **Devices and platforms**: phones, computers, browsers, shared
  machines.
- **Current habits**: browser-saved passwords, notebook, memory, reuse.
- **Who shares accounts**: partner, family, work.
- **Comfort with cloud versus local storage.**
- **Budget**, if any.

## Questions to ask first

Ask in **one batch of at most five questions**, skipping any already
answered:

1. Which devices and browsers do you use daily?
2. How do you store passwords today, and do you reuse them?
3. Do you share any accounts with family?
4. Do you prefer a cloud-synced vault or one stored only on your
   devices?
5. Who should be able to get in if you cannot?

## Method

1. **Choose a type.** Decide between a standalone manager (works across
   devices and browsers), a platform or browser built-in manager
   (simpler, tied to one ecosystem), or an offline file-based one
   (full control, manual syncing). Compare cross-device support,
   sharing, export options, multi-factor support, and independent
   security audits. Product details change, so the user must verify.
   Pick one; two managers means two places to lose track of.
2. **Create the master passphrase.** Use a long passphrase of several
   unrelated words or a phrase the user can type from memory, never
   reused anywhere. The user enters it themselves; the agent never sees
   it.
3. **Turn on multi-factor** for the manager account, using an
   authenticator app or hardware key. Keep any backup codes offline.
4. **Migrate in priority order.** First email, banking, phone carrier,
   and government accounts, then everything else over a few weeks. Use
   the manager's generator for a unique password, and change reused ones
   as you meet them. Import from the browser, then delete browser-saved
   copies.
5. **Add multi-factor to accounts that matter**, preferably not
   stored in the same place as the password; see [[identity-protection]].
6. **Build the recovery kit.** On paper or an offline drive, record the
   account email, the manager's recovery or emergency method, and
   backup codes. Store it in a secure physical place; see
   [[important-docs-vault]]. The master passphrase can be written and
   sealed, kept apart from the kit, if the user judges it safe.
7. **Set emergency access.** Use the manager's emergency or sharing
   feature if it exists, or a sealed instruction for a trusted person.
   See [[estate-planning]] for the wider arrangement.
8. **Practice recovery.** Once, on a spare device, confirm the kit lets
   them back in.
9. **Maintain.** Quarterly, review items flagged as weak, reused, or
   exposed in a breach, and delete old accounts.

## Output format

- **Recommendation** of type with a short reasoning, and verification
  checklist for the product.
- **Migration order** as a checklist with the first ten accounts.
- **Recovery kit contents** and where it lives.
- **Emergency access plan**.
- **Maintenance schedule**.

## Ground rules

- Never ask for, display, or store passwords, master passphrases,
  one-time codes, recovery codes, or account numbers.
- Do not endorse or rank products, or state prices, features, or audit
  results; the user checks current information.
- Do not suggest saving the master passphrase in a note, email, or
  chat.
- Warn that losing both the passphrase and the recovery kit can mean
  permanent loss of the vault.

## Self-check before answering

- Is exactly one manager recommended?
- Does the plan protect the manager itself with multi-factor?
- Is migration phased by importance?
- Are recovery and emergency access planned, and tested?
- Did I avoid handling any secrets?

## Common pitfalls

- **Weak or reused master passphrase.**
- **Skipping multi-factor** on the vault.
- **Leaving old passwords in the browser** after migration.
- **No recovery kit**, then locking oneself out.
- **Putting everything in one place** with one factor.
- **Never updating** weak entries flagged after a breach.

## Example prompt

> Help me pick and adopt one password manager across my phone and
> laptop, migrate my important accounts first, and set up multi-factor,
> emergency access, and an offline recovery kit. I will type all
> secrets myself.

## Learn more

- [[identity-protection]] for the wider layers beyond passwords.
- [[important-docs-vault]] for storing the recovery kit.
- [[estate-planning]] for access when the user is incapacitated.