Start with a password manager without shutting yourself out

First choose how you want to save your safe

In a service such as Bitwarden can sync your vault through an account between devices. With KeePassXC manage a local database file and arrange any exchange yourself. Both methods can be useful, but require different maintenance. With a local safe, backups and file synchronization are your own task; with a service you also need to set up your account and recovery options properly.

In addition, look at the devices you use. Test the browser extension and mobile app before transferring all your accounts. An app that has many functions on paper helps little if filling in on your main device remains cumbersome.

Make your Master Password unique

Use a long master password that you don't use anywhere else. A password manager protects many accounts at once, so no old password here. Keep emergency information in a safe place outside the vault itself. Otherwise you may not have that information available when you can no longer login.

Master password, two-step verification and recovery code have different functions. With Bitwarden, the two-step verification recovery code is meant to restore that additional login step; it does not automatically return a forgotten master password. Read the repair procedure of the chosen service and do not rely on a general button that solves everything.

First, transfer some regular accounts

1. Install the app or extension via the official route.
2. Save one existing account and make sure the website is correct.
3. Log out of that website and re-enter the test.
4. Create a new, unique password with the generator for that account.
5. Check that the new password is in the correct vault notification.

Do not start your main recovery account immediately. If you know the controls, you can also address your email account and other crucial accounts. E-mail deserves extra attention because password recovery from other services often goes there.

Note exports and fill in automatically

An export file may contain passwords readable. Do not leave such a file in your download folder or shared cloud folder. Choose an appropriate secure export where possible and test how to return it later. Also check the web address before filling in: a password manager does not make a counterfeit website reliable.

Use two-step verification where available and keep recovery codes carefully. Remember what you do when your phone breaks down. You don't want both your vault and the only way to open it to be on the same lost device.

Make the switch manageable

Work account for account and remove old saved passwords only when the new method works reliably. Check double entries and give important accounts identifiable names. The biggest gain comes from unique passwords and good recovery management, not from filling a long list as soon as possible.