You only have to remember one password ever again. Here’s how.
If you’re like most people, you’ve got one password (maybe two) that you reuse everywhere, because remembering a different one for every single account feels impossible. Here’s the problem: the moment one of those accounts gets breached, a criminal now has the key to every other account using that same password.
A password manager solves this, and you don’t need to be “good with computers” to use one.
What a password manager actually does
Think of it as a locked digital box that remembers every password for you. You unlock the box with one strong “master” password, and the manager fills in the right password automatically whenever you log in to a site or app. It can also generate a random, hard-to-guess password for a new account, so you never have to invent one yourself.
You probably already have one, free
Apple, Google, and Microsoft all build a password manager directly into their devices and browsers, free, already turned on for many people:
- iPhone/iPad: Passwords app (built in)
- Android/Chrome: Google Password Manager
- Windows: Microsoft Authenticator / Windows password manager
You don’t have to buy anything or sign up for a new service to start.
The one password you do need to remember
Your master password (or your device’s fingerprint/face unlock, which is even easier) is the only one you truly need to hold in your head. The new federal password guidelines, updated by the National Institute of Standards and Technology (NIST) in 2025, actually recommend moving away from short, complicated passwords stuffed with symbols, and toward long, memorable passphrases instead: three or four random words strung together, like purple-canoe-lantern-42. A passphrase like that is both easier to remember and harder for a criminal to crack than “P@ssw0rd1!”.
Getting started, step by step
- Open the password manager already built into your phone or browser (see above).
- Set (or confirm) a strong passphrase as your master password. Use it nowhere else.
- The next time you log in to a site, let it save that password. The next time you create a new account, let it generate one for you instead of typing your own.
- Over time, it fills itself in. You don’t have to convert every account at once.
What to never do
Never write your passwords in a plain note on your phone or a sticky note by your desk that a visitor could photograph. Never reuse your master password anywhere else. And never share your master password with anyone who contacts you claiming to be “tech support” or your bank, that’s always a scam.
Keep learning, free
Lumoset’s free course, Email & Online Accounts · Level 1: Getting Started Safely, walks through setting this up on your specific device, step by step, at your own pace. No account needed, always free, at lumoset.org.
Sources: National Institute of Standards and Technology, SP 800-63B-4 Digital Identity Guidelines FAQ (2025 revision, passphrase and password-manager guidance).