Managing passwords has become one of the most important parts of staying safe online. Unfortunately, it has also become the most daunting. This is because it feels like every app, website, and device requires you to create another account, and keeping track of strong unique passwords for all of them is nearly impossible.
This guide explains what a password manager is, why you should use one, and how to get started step by step.
A password manager is a secure tool that stores all your passwords in an encrypted vault. Instead of remembering dozens, or even hundreds of logins, you only need to remember one: your master password.
Password managers work across many devices including computers, smartphones, and tablets. They automatically fill in passwords, generate strong new ones, and alert you to potential security issues regarding your credentials.
Password managers work through apps and browser extensions, making your passwords easily accessible across all your devices. Whether you’re on your laptop, phone, or tablet, you can securely sign in from anywhere.
Without a password manager, many people are prone to reuse the same few passwords, which is an extremely insecure practice. Password managers create long, complex, and unique passwords for you that are nearly impossible to crack and you never have to memorize them.
The only password you need to remember is the one that logs you into your password manager. This is called the master password. By reducing everything to a single, secure password, you eliminate the need to write passwords down or store them in insecure places, greatly reducing the risk of compromise.
Getting started is easier than most people think. Here’s a simple step-by-step process:
Start by selecting a reputable password manager that aligns with your needs and preferences. You can choose a cloud‑based service for convenience and seamless syncing across devices, or a self‑hosted solution if you prefer complete control over your data. Popular and trusted options include 1Password, Bitwarden, KeePass, Dashlane, or RoboForm. Refer to the comparison table below to help you decide which one suits you best.
| Password Manager | Key Features | Free Plan Available? | Supported Browsers and Operating Systems | |
| 1Password | • Polished apps across platforms • Travel Mode for secure border crossings • Strong AES‑256 encryption | No free plan (14‑day trial only) | Apps available on: macOS, iOS, Windows, Android, Linux Browser extensions for: Google Chrome, Firefox, Edge, Brave, Safari | |
| Bitwarden | • Fully open‑source • Self‑hosting optional • Zero‑knowledge encryption | Yes - free plan includes unlimited passwords & device sync | Apps available on: macOS, iOS, Windows, Android, Linux Browser extensions for: Google Chrome, Firefox, Edge, Brave, Safari | |
| KeePass | • 100% free and open‑source • Offline‑first encrypted database • Highly customizable | Yes - fully free | Apps available on: Windows, MacOS, Linux Other platforms are community-supported ports and are not officially from KeePass. | |
| Dashlane | • Scam protection • Dark‑web monitoring • Passwordless login (no need for master password) | No free plan (14‑day trial only) | Apps available on: macOS, iOS, Windows, Android, Linux Browser extensions for: Google Chrome, Firefox, Edge, Brave, Safari | |
| RoboForm | • Data breach monitoring • Secure sharing • Passwordless login (no need for master password) | Yes - Free plan includes unlimited passwords on a single device | Apps available on: macOS, iOS, Windows, Android Browser extensions for: Google Chrome, Firefox, Edge, Brave, Safari |
Your master password is the only password you’ll need to remember going forward, so make sure it’s long, unique, and memorable only to you.
One of the strongest approaches is to use a passphrase, which is a string of random, unrelated words that aren’t connected to you in any personal way. For example: Jaywalker‑Pointless‑Smog. According to Bitwarden’s password strength tool, a passphrase like this would take centuries to crack. (Of course, please don’t use this exact example, it’s now public!)
You can use Bitwarden’s password strength tool to test the strength of your own master password and ensure it would take an impractically long time to crack. If you’re struggling to come up with a strong password or passphrase, Bitwarden’s online password generator can help create one for you.
After creating your account, make sure to enable a strong MFA method right away. MFA adds an essential extra layer of protection, so even if someone manages to obtain your master password, they still can’t access your vault without a second verification step.
You’ll find MFA options in your password manager’s account settings. Choose a robust method such as an authentication app (e.g., Microsoft Authenticator or Google Authenticator) or a hardware‑based security key like a YubiKey.
For more details on choosing and using MFA, please refer to our Multi-Factor Authentication (MFA) article.
Once your account is set up and secured, install your password manager’s app on every device where you plan to use it. For a smoother browsing experience, with automatic login prompts and seamless autofill, also install the official browser extension for your preferred web browser.
While browsers like Google Chrome, Edge, Firefox, and Safari offer basic password‑saving features, they’re not as secure or as convenient as a dedicated password manager, especially when switching between devices or signing into mobile apps. To avoid conflicts and ensure your passwords stay centralized and protected, turn off your browser’s built‑in password manager after installing your new one.
This step may take some time, but once everything is imported, you’ll be significantly more organized and far more secure. Even better, creating and managing new accounts will become effortless moving forward.
One simple way to add your existing logins is through your password manager’s browser extension. After signing into the extension, simply log in to each of your online accounts as you normally would, the extension should automatically prompt you to save each set of credentials into your vault.
Once all of your accounts are added, take a moment to review your vault. Make sure entries are accurate, update any weak or reused passwords, and organize items into folders or categories if your password manager supports it. This final bit of cleanup ensures you start off with a secure, well‑structured vault that’s easy to maintain.
While your account will still require a strong password (and we strongly recommend using a password manager to create and securely store it), setting up passwordless authentication means you won’t need to enter it or retrieve it during your day-to-day sign-ins.
Okanagan College supports passkeys through the Microsoft Authenticator app and FIDO2 security keys, making it quick and easy to transition to passwordless authentication.
For more information related to passkeys, please read our Passwordless Authentication Using Passkeys article.
Yes, when using a reputable one, password managers are widely considered safer than not using one. Many of the most trusted and popular password managers provide these secure features:
No. Okanagan College does not provide password managers for individual employees or students.
Just like your wallet, purse, or personal devices, your passwords (including those for your OC accounts), are your own responsibility. Choosing how and where to store them, such as which password manager to use, is entirely up to you.
You should choose a password manager that meets your personal needs: one that offers the right features, support, security, and price point. It’s also important that your password manager is not tied to your employment or enrolment at OC so that you can continue using it even after you are no longer affiliated with Okanagan College.
When storing your OC credentials, be sure you are still following OC’s Standard for Passphrases and Passwords.
If you forget your master password, you will lose access to your entire vault unless you previously set up an optional recovery method, such as recovery codes, emergency kits, or trusted contacts (depending on the provider). These recovery tools must be configured before you lose access; they cannot be added afterward.
Most password managers cannot reset your master password for you, and this is by design, it’s a critical security feature, not a flaw.
MFA recovery options vary by provider, but most password managers offer several fallback methods:
If you lose both your master password and your MFA method, recovery is often impossible, and that’s intentional. This design protects your vault by ensuring only you can ever unlock it.
Most major password managers make switching providers straightforward by supporting both exporting and importing your vault. This allows you to move your passwords, secure notes, and other stored items with minimal effort.
When exporting your vault, it’s critical to handle the file securely:
This ensures your sensitive information remains secure throughout the transition.
Even in a breach, your passwords usually remain unreadable since vaults are end‑to‑end encrypted. This means that if the attacker had your stolen vault, they would still need your master password to decrypt it.
Recommended steps after a breach:
Many providers offer these additional services:
No. Storing passwords in note-taking apps is very dangerous to your online safety. This is because note-taking apps usually store data in plain-text, which means if your device is compromised, saved notes are immediately readable to anyone with access.