Set Up a Password Manager the Right Way (Windows + iPhone)

Sticky notes, reused passwords, and Chrome’s half-remembered logins eventually fail. A password manager gives every site a unique random secret and autofills only on the real domain — which also blocks a lot of phishing.

This setup guide covers Windows + iPhone habits that work in 2026. Pick any reputable vault (see affiliate comparison); the process is the same. Also enable 2FA on the big three and learn passkeys.

Choose a manager (features that matter)

Feature	Why you want it
Zero-knowledge encryption	Vendor cannot read your vault
MFA / passkey on the vault	Stops password-only vault login
Browser extension + iOS app	Daily usability
Audits / bug bounty	Maturity signal
Emergency access / heirs	Real life happens
TOTP + passkeys	Fewer apps to juggle

Skip unknown “AI password manager” APKs from ads. Free tiers from known vendors are fine to start; paid tiers usually unlock families/sharing.

Step 1 — create the vault properly

1. Install from the official site or Store
2. Create the account / vault
3. Master password rules:
   • Long passphrase (4+ random words + digits)
   • Never reused on email or banking
   • Stored in your head or a sealed offline backup
4. Write the master password on paper once → store offline → practise typing it

If you forget the master password, support usually cannot recover a zero-knowledge vault. That is the point.

Step 2 — lock the vault with MFA

Inside the manager’s security settings:

• Enable authenticator TOTP or passkey unlock
• Store vault recovery codes offline (same discipline as Google backup codes)
• Prefer biometric unlock on phone after the strong master exists

Step 3 — import without making a mess

Options:

1. Export passwords from Chrome/Edge/Safari → import CSV into the manager → delete the CSV securely (shred/secure delete; do not leave it on Desktop)
2. Or skip bulk import — save new passwords as you log in this month

After import, turn off browser saving:

• Chrome/Edge: Settings → Autofill → Password Manager → offer to save → Off
• iPhone: Settings → Passwords → AutoFill Passwords → prefer your manager

Conflict between iCloud Passwords and a third-party manager causes double prompts — pick a primary.

Step 4 — Windows browser extension

1. Install the official extension from the Chrome/Edge/Firefox store link inside the manager app
2. Pin it
3. Enable autofill / inline menu
4. Disable conflicting extensions

Test on a low-risk site. Confirm it does not fill on lookalike domains.

Step 5 — iPhone autofill

1. Install the official iOS app
2. Settings → General → AutoFill & Passwords (wording varies by iOS) → enable your manager
3. Enable Face ID unlock in the app
4. Safari / Chrome iOS should show the manager’s suggestions above the keyboard

For work phones with MDM, follow company rules — some block third-party autofill.

Step 6 — rotate the dangerous passwords first

Do not try to change 200 logins tonight. Priority order:

1. Email (Google / Microsoft / Apple ID)
2. Banks and tax
3. Apple ID / Google / Microsoft (again if reused)
4. Work SSO
5. Social media
6. Everything else when the manager prompts a weak/reused warning

Generate long random passwords (20+ characters). You will never type them manually.

Step 7 — optional TOTP and passkeys in the vault

• Move authenticator seeds gradually when services allow
• Save passkeys to the manager or platform authenticator when offered
• Keep hardware keys for the highest risk accounts if you use them

Emergency and travel planning

Scenario	Prep
Phone lost	Vault MFA backups; find-my; revoke sessions
Partner needs access	Emergency access feature or sealed master copy
Border / shared PC	Use phone vault; avoid installing on untrusted PCs
Repair shop	See guides on moving 2FA before repair; do not hand over master password

Troubleshooting

Problem	Fix
Autofill missing	Extension permissions; unlock vault; disable browser saver
Wrong password filled	Multiple entries — merge duplicates
iOS shows only iCloud keys	Enable third-party autofill provider
Sync lag	Force sync; check account status
CSV import failed	Re-export; check encoding; import in smaller batches

If malware stole an old reused password before you migrated, rotate and scan: remove malware. A VPN helps on public WiFi but does not replace the vault.

Weekly five-minute habit

1. Resolve weak/reused alerts for 3 sites
2. Delete abandoned accounts when convenient
3. Confirm MFA still works on the vault
4. Never screenshot your master password

Done criteria

• Master passphrase memorised
• Vault MFA on
• Extension + iPhone autofill working
• Browser built-in saver off
• Email + bank passwords unique

After that, “what was my Netflix password?” stops being a lifestyle. The manager becomes boring infrastructure — which is exactly what good security feels like.

Family sharing and emergency access

Most reputable managers offer family sharing or emergency access after a waiting period. Set this up while everyone is calm: who can request access, how long the wait is, and where recovery kits live. Do not put the master password in the same email inbox the vault protects. For mixed iPhone/Windows homes, verify autofill on both platforms the same weekend you migrate.

Migration week plan

Day 1: vault + MFA + extension. Day 2: import browser passwords and delete the CSV securely. Day 3–7: rotate email and bank passwords. Ongoing: change a few reused passwords whenever the manager warns you. Pair with 2FA and passkeys. Ignore ads for “AI password managers” with no audits.

Broken autofill on stubborn sites

Some banking sites block managers; use copy-from-vault carefully and watch the address bar domain. Disable conflicting iCloud Passwords versus third-party autofill when prompts double. Update the browser extension after major Chrome/Edge updates. If autofill stopped after a Windows MSA glitch, unlock the vault and sign into the extension again.