arthur@homelab:~$ cat ~/guides/password-managers.md
Use a Password Manager
If you remember only one thing from this guide, make it this: every important account should have its own password.
That is almost impossible to do from memory. A password manager solves the problem by creating and remembering strong, unique passwords for you. You remember one good master password; the manager handles the rest.
You do not need to be technical, have anything especially secret, or consider yourself a likely target. If you use email, shop online, keep photos in the cloud, pay bills, or use social media, a password manager is for you.
Why reusing a password is dangerous
Suppose you use the same password for a small shopping site and your email. If the shopping site is breached, attackers can try that email-and-password combination on other services. This is called credential stuffing, but the name is less important than the result: one weak or breached site can expose several unrelated accounts.
Making small variations does not fix the problem. Summer2026!, BankSummer2026!, and ShoppingSummer2026! may feel different to a person, but they follow an obvious pattern.
A password manager can generate something long and random for every site. You do not need to know or type most of those passwords. The app fills them in for you on your computer and phone.
Is putting everything in one place safe?
It is reasonable to ask whether a password manager creates one big target. It does concentrate important information, which is why choosing a reputable manager and protecting it properly matters.
The vault is encrypted, and your master password is what unlocks it. A good password manager is designed so that the provider cannot simply read the contents of your vault. This is a much stronger everyday setup than reused passwords, predictable variations, notes scattered around a desk, or a spreadsheet named passwords.xlsx.
Nothing is risk-free. Malware on an unlocked computer, a convincing phishing page, or a weak master password can still cause trouble. A password manager greatly reduces the most common password problems; it does not replace software updates, caution, or two-factor authentication.
My recommendation: Bitwarden
For most people, I recommend Bitwarden. It has a useful free plan, works across the major browsers and operating systems, can generate and autofill passwords, and supports passkeys. Its code is open source, and its vault uses end-to-end encryption.
More importantly, it works well without demanding that you turn password management into a hobby. Start with Bitwarden’s hosted service, install its browser extension and phone app, and let it save and fill logins. That is the version I would recommend to a friend or family member.
The best password manager is ultimately the one you will keep using. Bitwarden is my default recommendation because it strikes a good balance between cost, transparency, platform support, and ease of use.
Other good choices
There is no single correct product for everyone. These are all reasonable places to start:
- 1Password is polished, works on many platforms, and has good options for families and teams. It is a paid service.
- Proton Pass is an open-source option with a strong privacy focus and fits naturally if you already use Proton’s other services.
- Apple Passwords is built into recent Apple devices. It is a straightforward choice if nearly everything you use is in the Apple ecosystem.
- Google Password Manager is built into Chrome and Android and is an easy improvement for people already living in Google’s ecosystem.
- KeePassXC stores a local encrypted database and gives you a great deal of control. It is a good fit if you prefer local files and are comfortable arranging your own backup and synchronization.
Browser and operating-system password managers are much better than reusing passwords. A dedicated cross-platform manager becomes more attractive when a household uses a mixture of Windows, macOS, Linux, Android, and iPhone devices, or when you want to avoid being tied to one browser or device maker.
Before choosing, check that the manager works on every device and browser you use. Also look for easy export, a clear recovery process, independent security reviews, and support for two-factor authentication and passkeys. Features and prices change, so check the provider’s current plan before deciding.
How to get started without making it a project
You do not need to change every password in one evening.
- Create your password-manager account directly from the provider’s official website.
- Choose a long, unique master password. A memorable phrase made from several unrelated words is easier to type and remember than a short collection of substitutions and symbols.
- Turn on two-factor authentication for the password-manager account and save its recovery code somewhere safe and offline.
- Install the official browser extension and mobile app.
- Add your email account first, then banking, shopping, social media, and other important accounts.
- As you visit other sites, replace reused passwords with generated ones and save them in the manager.
Do not reuse your master password anywhere else. Do not share it, and do not rely on memory alone for the recovery information. An emergency sheet kept in a secure physical place can contain the account email, recovery code, and instructions a trusted person would need. It should not sit beside an unlocked computer or travel around in a bag.
When changing a login, save the new password and confirm that it works before closing the page. Keep exports only as long as needed during a migration: an unencrypted CSV export is a readable copy of every password in it and should be securely removed after the import is verified.
Two-factor authentication and passkeys
Two-factor authentication adds another check after the password. An authenticator app or hardware security key is generally stronger than a text message, although SMS is still better than having no second factor when it is the only option offered.
The most important place to enable it is your email account because email is often the route used to reset everything else. Enable it on the password manager too, and store the recovery codes safely.
Some password managers can also store the rotating authentication codes used by other sites. That is convenient and still protects against many attacks. Keeping those codes in a separate authenticator creates more separation at the cost of more complexity. Choose a setup you can reliably use and recover.
Passkeys are another welcome option. They replace a password with a cryptographic credential and are resistant to the usual fake-login-page tricks. A password manager can store and synchronize passkeys, so adopting one now also prepares you for sites that are moving beyond passwords.
My self-hosted setup with Vaultwarden
I have been self-hosting Vaultwarden for a while in my homelab. Vaultwarden is an unofficial, resource-efficient implementation of the Bitwarden server API. I use it with the official Bitwarden apps, so the experience on my devices is familiar while the server and encrypted vault data live on infrastructure I operate.
It has worked well for me, and I like understanding where the service runs and controlling its deployment. It also fits the rest of my homelab: the service runs in a container, reaches the internet through my reverse proxy, and is included in my backup and monitoring routines.
That control comes with responsibility. I have to keep Vaultwarden and its host updated, maintain HTTPS, monitor the service, protect registration and administrative access, back up all of its persistent data, and test that I can recover it. I also have to consider what happens if my home internet, server, or domain is unavailable. Vaultwarden is community-maintained and is not the official Bitwarden server, so compatibility issues and support are my problem too.
For those reasons, I do not think most people should begin by self-hosting their password manager. Self-hosting changes who operates the service; it does not automatically make it safer. Bitwarden’s hosted service is the better starting point for almost everyone. Vaultwarden is a rewarding option for an experienced self-hoster who already has careful patching, backups, monitoring, and recovery practices.
A simple plan for today
Pick a reputable manager, create one strong master password, enable two-factor authentication, and move your email account into it. Then replace reused passwords a few at a time as you encounter them.
You do not need a perfect security system by tonight. Moving from one reused password to unique passwords stored in a reputable manager is already a large and practical improvement.