A password manager can make unique passwords easier to use, but it is not a guarantee against every account problem. The useful starting point is a maintained product that works with your devices, supports the sign-in features you need and gives you a recovery path you understand.
Start here
Start with the system around the password
Choose for practical fit rather than a brand ranking. Check the devices, browsers and phones you actually use before moving anything important.
Check device supportConfirm that the manager supports your computer, phone, browser and the sign-in methods you use.Read this part
Create one strong master passphraseMake it long, unique and unpredictable. Do not base it on personal information or reuse it elsewhere.Read this part
Practise before expandingSave, find and use one ordinary low-risk account at its known correct website.Read this part
Choose a maintained fit
Look for a product that is actively maintained, works on your supported devices and offers the everyday features you need, such as synchronisation and autofill. Check whether multi-factor authentication is available for the manager account and whether the recovery options are suitable for you.
Do not choose only because a product is popular or inexpensive. A system that does not work on your phone, browser or computer may leave you bypassing it when you are in a hurry. Read the provider's current device and account documentation before committing.
Useful starting information is available from Cyber.gov.au's password manager guidance.
Protect the manager itself
Your master passphrase protects access to the manager, so treat it differently from the individual passwords stored inside. Make it long, unique and difficult to predict. Avoid names, dates, addresses and other personal details. Never reuse it for email, shopping or another service.
Multi-factor authentication can add another type of check, such as an authenticator code or security key. It improves protection but does not remove the need to protect your devices and recovery material.
Keep the manager signed in only on devices you trust and can lock. A lost master passphrase may not be recoverable, so identify the provider's official recovery choices before you need them. See passphrase guidance and MFA guidance.
Make one careful first sign-in
Begin with an ordinary, low-risk account rather than banking, government or another account where a mistake could interrupt something important. Open the website through a known bookmark or address, check the domain, and sign in without rushing.
When creating a new password, make sure the manager saves it and that the website accepts it before closing your existing access. Then sign out and practise finding the entry and signing in again. Repeat the ordinary sign-in check on each supported device you rely on; a browser check alone does not verify the phone.
What to read next
If you’d rather have local help, see our password safety and control help.