Password managers

What a password manager is

Most people reuse a few passwords, because nobody can remember fifty. The trouble is that websites are breached all the time. When one leaks your email address and password, criminals try the same pair on banks, shops and email providers, and every account that shares that password goes with it.

A password manager is an app that remembers passwords for you. It makes a long random password for each account, keeps them all in an encrypted vault, and fills them in when you visit the site. You remember one password, the master password, which opens the vault. Everything else can be long, random and different, because you never have to type it.

It also helps against fake sites. The manager offers a login only on the exact address it was saved for, so when a scam email sends you to a lookalike page, nothing is offered. That silence is your cue to stop.

Hosted or on your own server: start hosted

On a homelab site this sounds backwards, but keep your passwords on Bitwarden’s own servers to begin with. Passwords are what you need when something breaks: the router login, the server’s admin page, the email account that resets everything else. If they live on the home server that has died, you’re locked out of the tools you need to fix it.

Bitwarden’s servers only ever hold your vault in encrypted form, so you give up very little by letting them store it. Once you have backups you’ve restored from at least once, you can move to Vaultwarden, the self-hosted option below (it’s in the ZimaOS app store), and keep using the same Bitwarden apps.

How your passwords stay safe

Your vault is locked and opened on your own phone or computer, with a key made from your master password. Bitwarden stores and syncs only the scrambled copy, which it has no way to read. This is called zero-knowledge encryption, and it’s also why Bitwarden can’t reset your master password for you.

Bitwarden’s code is public, and outside security firms audit it every year, with the reports published on its website.

What it needs

• An email address and an afternoon. Moving in takes minutes. The afternoon is for changing your most important passwords.
• No money. The free plan covers unlimited passwords on unlimited devices. Premium, billed yearly, adds two-factor codes inside the app, emergency access for a trusted person and file attachments.
• A pen and paper, for the master password and a recovery code.

The master password, and what happens if you forget it

This is the one part to get right. Bitwarden never knows your master password, so it can’t reset it for you. If you forget it and have no other way in, the only option left is to delete the account and start again, losing everything inside.

Use a passphrase of four to six random words, which is long but easy to remember. Bitwarden’s generator can make one: choose Passphrase instead of Password. Write it on paper and keep it at home with your passport or other important papers. Someone would have to be inside your house to read it, which rules out the online attackers you’re defending against.

Then set up your ways back in before you need them:

• The two-step login recovery code. When you turn on two-step login, Bitwarden gives you a code that switches it off if you lose your phone. Write it on the same piece of paper.
• A password hint. Optional. Bitwarden emails it to you on request, so make it something only you would understand.
• Emergency access (Premium). A trusted person can ask for access to your vault. You get an email and a waiting period you choose, and if you don’t refuse in time, they’re let in. This also helps your family if something happens to you.
• A device that’s still signed in. If any of your devices still opens Bitwarden with a fingerprint or PIN, you can export your passwords from it before starting a new account.
• An encrypted export. Every few months, in the web app under Tools, Export vault, save a password-protected encrypted file and keep it with your backups.

How Bitwarden fits in

• Apps for everything, kept in sync. Browser extensions for Chrome, Firefox, Safari, Edge and others, apps for iPhone, Android, Windows, Mac and Linux, and a web vault. A password saved on one shows up on the rest moments later.
• Autofill. Fills in logins in the browser and in phone apps, on the site each one belongs to. After the first sign-in on a device, your fingerprint, face or a PIN opens the vault, so you type the master password far less often.
• A generator. Makes random passwords or passphrases. Connect an alias service such as SimpleLogin or Firefox Relay and it can make a fresh email address for each sign-up as well.
• Passkeys. Stores the passkeys some sites now offer in place of a password, on the free plan.
• Sharing. The free plan shares logins with one other person, and the Families plan between six.

The easy way to set it up

Nothing here needs a server or the terminal.

1. Create your account at bitwarden.com. It asks whether to keep your data in the US or the EU. Pick one and remember it, because your account exists only in that region. Choose your master password and write it down.
2. Install the browser extension from your browser’s extension store, and the app on your phone. Sign in to both.
3. Move your passwords in from your browser, as described in the next section.
4. Turn on two-step login. In the web app, go to Settings, Security, Two-step login, and choose an authenticator app, such as the one on the two-factor page. Save the recovery code it shows you.
5. Turn on autofill on your phone. The app walks you through it the first time you open it.
6. Stop your browser offering to save passwords, in its own password settings, so there’s only one place to look.

Over the next few weeks, use the generator to replace your important passwords, email first, then banking, then everything else as you sign in to it.

Moving in from your browser

Every browser that saves passwords can hand them over.

• Chrome, Edge, Brave, Opera, Vivaldi or Arc on a computer. The tidiest way is Bitwarden’s desktop app, downloaded from bitwarden.com (the app store versions can’t do this). Choose File, Import data, pick your browser, then Import directly from browser. No file is left lying around.
• Any browser, using a file. In the browser’s password settings, choose Export passwords. This saves a CSV file, a plain list that anyone who opens it can read. In Bitwarden’s web app, go to Tools, Import, choose your browser as the format and pick the file. Then delete the file and empty the bin.
• Apple Passwords on iPhone, with iOS 26 or later. In the Passwords app, open the options menu, choose Export Data to Another App, and pick Bitwarden.

Import once, because doing it twice creates duplicates. When a few logins have worked from Bitwarden, delete the copies from the browser’s own password manager.

Questions people ask

What if Bitwarden is hacked?

The attackers would get vaults they can’t read without each person’s master password. That’s why the master password needs to be long. It’s also why the LastPass breach mentioned below was serious: stolen vaults can be attacked offline for as long as the thieves like, and short master passwords give way first.

Should my two-factor codes live in Bitwarden too?

It’s convenient, but it puts both halves of every login in one place. Many people keep their codes in a separate app instead. Either way, the code for your Bitwarden account itself must live outside Bitwarden, or you can’t get in to read it.

Isn’t my browser’s own password manager good enough?

It’s far better than reusing passwords. It ties you to one browser company, though, and mixing an iPhone with a Windows PC, or Chrome with Firefox, gets awkward. Bitwarden works the same on all of them.