Password manager for beginners: one password per site, without remembering them

One password for everything is convenient but risky. If a single website gets hacked, attackers automatically try the stolen credentials on email, online banking and shops. The solution is a separate password for every site. Nobody can remember that many. This is what password managers are for.

What a password manager does

A password manager is an encrypted vault. You only remember one long password that opens the vault. The program takes care of everything else:

Generating passwords. When you register, it suggests a strong, random password.
Saving passwords. When you sign in, it recognises the credentials and asks whether to save them.
Filling in passwords. On your next visit, you pick the entry at the top of the login page and the fields are filled in.

I use 1Password. The features below are documented there. Other password managers work on the same principle.

On all your devices

This is the point many people do not know: a password manager does not only fill in forms in the browser on your computer, but also on your phone, in apps and on websites.

Computer: A browser extension saves and fills in passwords on Mac, Windows and Linux.
iPhone and iPad: Under Settings → General → AutoFill & Passwords you turn on 1Password. A key icon then appears on the keyboard when signing in to apps and websites (guide).
Android: In the app under Settings → Autofill you turn on filling in. In Chrome and Brave you additionally have to allow autofill through another service in the browser settings (guide).

Passkeys, the newer way to sign in without a password, can also be saved and used on iPhone and Android.

So you do not have to type a password or know a single one. All devices use the same vault.

One step further: one email address per service

The email address is also something that stays the same everywhere you sign up. If a site is hacked, the attacker has your address and sends spam or phishing. Instead, you can use a separate address for every service, all delivering to the same mailbox. The principle goes by different names depending on the provider:

Apple: Hide My Email is part of iCloud+. You create the addresses in Safari, Mail or Settings and can also reply through them.
Proton: It is called Hide-my-email aliases there and is part of Proton Pass and Proton Mail. SimpleLogin belongs to Proton, and existing SimpleLogin aliases can be synced with Proton Pass. Up to 10 aliases are free, for unlimited aliases and for replying you need a paid plan.
Fastmail: It is called Masked Email. 1Password connects to it and creates the address right when you sign up.

The advantage: if you get spam at one of these addresses, you know which service lost it. And you switch off exactly that address without affecting anything else.

How I solve this with a domain of my own, so that I can reply from every address, is described in the article One email address per service with your own domain and Fastmail.

Where to start

Install a password manager and choose a long password for the vault.
Turn on autofill on your phone and in your browser.
Let it generate a new password at every sign-in. Switch existing accounts over bit by bit, starting with email and banking.

If you would like help with the setup for yourself or your team, get in touch.