Get a Password Manager. Yes, You

I've had the password manager conversation enough times to know the objections by heart. "I have a system." "I don't want all my passwords in one place." "It seems complicated." All reasonable-sounding. None of them hold up very well.

Start with the "system." Usually it's one or two base passwords with small changes per site, maybe the site name tacked on the end. The trouble is that websites get breached constantly, and when they do, lists of email and password pairs end up circulating. Attackers then try those same pairs on every other popular service, automatically, at enormous scale. It's called credential stuffing, and it works because people reuse passwords. Little variations don't help much either, since the tools that do this know all the usual tricks. If your password for one forum is Fluffy2020!forum, guessing your bank one isn't hard.

The only real fix is a different, random password for every account. Nobody can remember a hundred of those. That's the entire reason password managers exist.

The "all in one place" worry is the one I take most seriously, so let's actually think it through. Your vault is encrypted on your device with a key derived from your master password. Reputable managers are designed so the company itself can't read your vault. If their servers were breached, the attacker would get encrypted blobs, and with a strong master password those are useless to them. Compare that to the alternative, where your passwords are scattered across a hundred sites with wildly different security, and any one of them leaking exposes the password you reused everywhere else. One well-guarded place beats a hundred badly guarded ones.

There's a bonus people don't expect, too. A password manager is quietly one of the best phishing defenses you can have. It fills your login based on the actual domain. If you land on a convincing fake of your bank, the manager just doesn't offer to fill anything. That pause is a huge red flag, and it catches fakes that look perfect to the eye.

As for complicated, it's really not anymore. You install the app and the browser extension, and from then on, when you log in somewhere, it offers to save. When you sign up for something, it offers to generate a password. That's most of it.

Which one? Honestly, the mainstream options are all fine. Bitwarden, 1Password, Proton Pass, and the ones built into Apple and Google devices are all reasonable choices. The built-in ones are the easiest start if you live entirely in one ecosystem. A standalone one makes more sense if you switch between, say, an iPhone and a Windows PC. Pick one and stick with it. Most of them also store passkeys now, which is where all of this is heading anyway.

A few things to get right on day one:

• Make the master password long. A string of four or five random words is easy to type and very hard to crack.
• Turn on two-factor authentication for the password manager account.
• Write down your recovery details and keep them somewhere safe at home. Not in the vault.

Then don't try to change everything at once. Let it collect passwords as you go about your week. When it's got a decent list, start with the accounts that matter most: email first, since it can reset everything else, then banking, then anything with a saved card. Most managers will flag reused and weak passwords for you, so you can chip away at the rest whenever you're bored.