A safer sign-in routine does not require remembering a different complicated password for every account. A password manager can store unique credentials, while passkeys can offer another way to sign in where a service supports them. Start with the accounts that unlock the rest of your digital life, especially your primary email and financial accounts. This guide explains general security practices rather than promising that any tool prevents every compromise.
Understand the two tools
A password manager stores credentials in a protected vault and can generate unique passwords. You unlock the vault to retrieve or fill them. The important benefit of uniqueness is containment: if one website loses a password, that password should not also open your other accounts. CISA recommends using a password manager to create and store strong passwords.
A passkey uses cryptographic credentials rather than a password typed into the site. Depending on the service and device, you may approve sign-in with your device unlock method. Passkeys designed around the site’s identity can resist ordinary phishing attempts better than a password or a one-time code typed into a fake site. They do not protect you if someone gains access through an insecure recovery route or a device you have left unlocked.
Choose a manager you can maintain
Your device may already include a password manager, or you can choose a separate one. Compare the supported devices and browsers you actually use, how credentials sync, how recovery works, and whether you can export or transfer your data if you change providers. Review the provider’s security documentation and update policy. If your employer supplies a manager, follow its rules for work credentials and keep personal accounts in an appropriate personal vault.
Protect the vault with a long, unique master password when the product uses one. Enable a strong second factor where available, and lock your devices with a screen code. Do not reuse the vault password elsewhere. A manager is a valuable central location, so protecting access and planning recovery deserve as much attention as convenience.
Make recovery possible
Before changing sign-in methods, read the account’s recovery options. Store recovery codes securely somewhere separate from the device that might be lost. Depending on the service, a second passkey, a hardware security key or another approved recovery method can provide redundancy. Test that you understand the process before removing an older method; do not post or email recovery codes to yourself as ordinary unprotected text.
Passkey synchronization and recovery vary by provider. A passkey stored only on one device may be lost with that device, while a synced passkey depends on the security and recovery of the syncing account. Check which applies to each important account. CISA’s guidance discusses phishing-resistant authentication and recommends stronger methods where available.
A manageable migration
- Inventory: Identify your primary email, banking, shopping and work accounts.
- Secure the foundation: Update the email and manager credentials first, then enable strong multi-factor authentication.
- Add passkeys: Enroll where supported and record the recovery route.
- Replace reuse: Generate a different password for each remaining account.
- Review alerts: Investigate a breach or unexpected login through the service’s own app or website.
- Revisit: Check recovery information when you change phone numbers or devices.
Avoid common traps
A login request arriving by message can be a phishing attempt even when it mentions a real company. Open the service directly using a saved bookmark or its app; do not give a caller your password, verification code or recovery code. A password manager declining to fill on an unfamiliar address is a cue to inspect the address carefully, not a reason to force credentials into it.
You do not need to change every account in one afternoon. A deliberate sequence with a working recovery plan is more useful than rushing and locking yourself out. Where passkeys are unavailable, a unique password plus the strongest practical multi-factor option remains a meaningful step. Review each service’s current instructions because enrollment and recovery differ.
When a device changes hands
Before selling, recycling or giving away a phone or computer, check that important credentials and recovery methods are available on another trusted device. Follow the manufacturer’s sign-out and reset instructions only after verifying your access. Remove the old device from account sessions where the service provides that control. If a device is lost, use the service’s security settings to review sessions and revoke access where possible. Keep a written checklist of the accounts you need to check, without recording the secrets themselves in that checklist.
Sources: CISA password manager guidance · CISA mobile communications best practices