Clear Path step · Home · Solid ground for everyone
Put one password manager in charge
Every important account has its own password, and a fake site gets nothing from your autofill.
Why it matters: Criminals take passwords leaked from one site and try them everywhere else. A manager makes every password unique without anyone memorizing them, and it won't fill a password into a fake site.
Do it
- Pick one manager for the household. All-Apple or all-Android households can use the free built-in one; mixed households do better with a cross-platform manager.
- Install it on every phone and computer and turn on autofill.
- Change your email password first, then your bank, then let the rest change as you log in over the next few weeks.
- Protect the manager's own account with a passkey or MFA, and write its main password down with its recovery kit on paper at home. Some managers can't reset a forgotten main password.
- Treat it as a warning when the manager doesn't offer to fill a password: you may be on a lookalike site.
Say this: If my password manager doesn't offer to fill, I stop and check the address before I type anything.
Check it worked: Everyone in the household uses one password manager, your email and bank have unique passwords, and the manager's own account is protected with a passkey or MFA.
Simply put
A password manager is like a key cutter that makes a different key for every lock and remembers them all. One leaked key opens nothing else, and it won't hand a key to a fake door.
In detail
Most managers now store passkeys too, which makes the manager the place your sign-ins migrate to as sites drop passwords. That makes its recovery kit one of the most important pieces of paper in the house; it belongs in the digital-legacy plan.
As a story
A text says your parcel couldn't be delivered and links to a page asking you to sign in to reschedule. The logo, the colors and the wording all look right.
You tap the sign-in box and wait for your password manager to fill it in, the way it always does. Nothing happens. It doesn't recognize the site.
That pause is the warning. You look at the address again: it's one letter off. You close the page, open the delivery company's own app yourself, and see there's no missed delivery at all. Your password stays where it belongs, and you get on with your day.
If this is new to you: No need to change everything today: start with email and your bank. Write the main password down and keep it with the recovery kit; some managers can't reset it.
Points toward the Long View: the place your passkeys will live as sites drop passwords.