Password Managers: A Beginner's Guide for UK Users
What a password manager does, whether it is safe, how to set one up and move your logins across, and the habits that keep your accounts secure.
Most of us know we should use different, long passwords for every account, and most of us do not, because remembering dozens of them is impossible. A password manager removes that burden: it creates, stores and fills in strong passwords so you only need to remember one.
What it does
A password manager is an encrypted vault. It:
- Generates long random passwords you never need to see.
- Stores them behind one master password.
- Fills them into websites and apps when you sign in.
- Often warns about weak, reused or leaked passwords.
- Syncs across your phone and computers.
Browsers and phone systems also offer built-in managers, which are a reasonable start. Dedicated tools often add easier sharing and stronger features.
Is it safe to put everything in one place?
It sounds risky, but for most people it is considerably safer than the alternatives of reusing passwords or keeping them in a notebook or a note on the phone. Reuse is the real danger: when one site is breached, criminals try the same password everywhere else.
That said, the vault is only as strong as its master password and the account around it, so protect it properly:
- Use a long master passphrase, such as several unrelated words, that you do not use anywhere else.
- Turn on two-factor authentication for the manager. See two-factor authentication explained.
- Keep a recovery method stored safely, such as a printed key in a drawer.
- Keep devices updated and locked.
Setting up in an afternoon
- Choose a manager with good reviews, a clear security model and apps for your devices.
- Create the vault and set the master passphrase.
- Install it on your phone, computer and in your browser.
- Import saved passwords from your browser if you wish, then tidy them.
- Start with the most important accounts: email, banking, cloud storage, mobile phone provider and shopping sites.
- Replace weak and reused passwords gradually using the generator.
- Delete the old saved list from your browser once you are confident.
You do not need to do everything at once. Fixing your email account first is the most valuable step, since password resets flow through it.
Everyday habits
- Let the manager fill passwords instead of typing them, which also helps against fake sites, as it will not fill on a lookalike address.
- Use the generator for new accounts.
- Store secure notes such as Wi-Fi codes and licence keys, if the tool supports it.
- Review the security report occasionally.
What to do about shared and family accounts
Some managers offer family plans with shared folders for things like streaming accounts and Wi-Fi details. This beats texting passwords around. Avoid sharing the master passphrase.
Pitfalls to avoid
- A weak or reused master password.
- Not setting up recovery, which can lock you out permanently.
- Letting someone else use your vault when they repair your device. See what not to share with a technician.
- Storing the master password in a plain text note.
For small businesses
A manager lets teams share logins safely and remove access when someone leaves. It is a key element in the small business IT basics checklist.
Help getting started
If you would like someone to set it up with you and move the important accounts across, you can search Compito by postcode, compare ID-verified local providers and send a request. You receive an offer to accept and pay online and can message the provider about how they will handle your details. See tech support services.
A worked example: tidying up in a weekend
Someone has about eighty accounts, with a handful of passwords used again and again. On Saturday they set up a manager, import what the browser holds and look at the security report, which lists forty reused passwords. They change the ten that matter most first: email, bank, mobile provider, cloud storage and the main shopping account. Over the following weeks, each time they log into something, they let the manager replace the old password. After a month the weak and reused ones have largely gone, without any single heroic effort.
Choosing: built-in or dedicated
| Question | Built-in browser or phone manager | Dedicated manager |
|---|---|---|
| Cost | Usually free | Often free tier, paid for extras |
| Works across browsers | Often one ecosystem | Usually all |
| Family or team sharing | Limited | Often supported |
| Emergency access for relatives | Varies | Often available |
| Ease of starting | Very easy | Slightly more setup |
If you only use one browser or one phone brand, the built-in option can be a good beginning. If you mix systems, a dedicated manager tends to be more convenient.
What to do about other secrets
Passwords are only part of the picture. Consider storing, in encrypted notes or the vault:
- Wi-Fi codes and router login.
- Recovery codes for two-factor authentication.
- Software licence keys.
- Account numbers you refer to often, but not full card details unless the tool is designed for them.
Planning for emergencies
If something happened to you, could a trusted person get into essential accounts? Many managers have an emergency access feature, or you can write down recovery information and keep it in a safe place. Make a note of where it is and who knows.
Less confident users
Start with just email and banking, and let a family member help with set-up. Use biometric unlock on the phone so daily use is easy. Printed recovery details in a drawer are better than nothing, and far better than reusing a single password everywhere.
When something goes wrong
If you suspect your master password is compromised, change it from a trusted device, review the security report and change the passwords for your most important accounts. Then turn on two-factor authentication anywhere it is missing.
Frequently asked questions
What if I forget my master password?
Many managers cannot recover it by design, which is what keeps them secure. Set up the recovery option offered and store it safely.
Are browser password managers good enough?
They are much better than reusing passwords. A dedicated manager offers extra features and works across more apps and browsers.
What if the password manager company is hacked?
Well-designed managers store data encrypted so that attackers cannot read it without your master password. A strong passphrase and two-factor authentication keep you safe.