How to Set Up a Password Manager and Turn On 2FA in 15 Minutes

Quick answer

• Minutes 0–5: install a password manager and create one long master password (a phrase of 5–7 random words works).
• Minutes 5–10: turn on 2FA for your email first, then your password manager.
• Minutes 10–15: add 2FA to banking and shopping accounts, using an authenticator app or passkey instead of text codes when you can.
• After that: replace reused passwords a few at a time, starting with your most important accounts.

You don’t have to fix everything tonight. These 15 minutes cover the accounts that matter most.

---

Why these two things?

• A password manager creates and remembers a long, unique password for every account, so one leaked password can’t unlock the rest. CISA recommends using one. (CISA)
• Two-factor authentication (2FA or MFA) adds a second step at sign-in. CISA puts it simply: even if someone steals your password, they still can’t get past that second step. (CISA)

Together, they stop the most common account takeovers.

---

Minutes 0–5: Set up the password manager

1. Pick one. Look for one that works on every device you use, fills in passwords automatically, and supports 2FA and passkeys. Good options include 1Password, Bitwarden (has a free plan), or the free one built into your phone (Apple Passwords or Google Password Manager) if you only use one ecosystem.

→ [AFFILIATE LINK PLACEHOLDER: 1Password] (We may earn a commission.)

2. Create your master password. It’s the only one you’ll need to remember, so make it long. CISA suggests at least 16 characters, or a passphrase of 5–7 unrelated words. (CISA)

• Example style (don’t use this one): copper-lantern-violin-oatmeal-tundra
• Never reuse it anywhere else.

3. Save the recovery info. Most managers give you a recovery key or emergency kit. Print it or write it down, and keep it somewhere safe at home.

4. Install it everywhere. Add the app to your phone and the extension to your browser, then sign in on both.

5. Import what you have. If your browser already saves passwords, most managers can import them in a few clicks. Then turn off the browser’s own password saving so you’re not keeping two lists.

---

Minutes 5–10: Turn on 2FA for email first

Your email is the master key. Password resets for almost everything else go there, so protect it first.

CISA’s steps work for nearly any account: (CISA)

1. Open Settings (it may say Account, Profile or Privacy).
2. Find Security (or “Password and security”).
3. Look for two-factor authentication, two-step verification or MFA, and turn it on.
4. Pick a method and confirm.

Which method should you pick? From strongest to weakest:

Method	How it works	Use it when
Passkey or security key	Your phone or a USB key confirms it’s you. Hard to phish.	It’s offered, especially for email and banking
Authenticator app	An app makes a new 6-digit code every 30 seconds	Passkeys aren’t available
Text or email code	A code is sent to your phone or inbox	It’s the only option. Still far better than nothing

CISA says phishing-resistant MFA (the FIDO standard that passkeys and security keys use) is the one to aim for, but any MFA is better than no MFA. (CISA)

Save your backup codes. Most sites give you one-time backup codes when you turn on 2FA. Store them in your password manager or print them. They save you if you lose your phone.

Then turn on 2FA for the password manager itself. It holds everything, so it deserves the same protection.

---

Minutes 10–15: Your next most important accounts

Work down this list until the timer runs out:

• ☐ Bank and credit cards
• ☐ Apple ID or Google account (this protects your phone backups too)
• ☐ PayPal, Venmo, Cash App
• ☐ Shopping accounts with saved cards (Best Buy, Walmart, Target and others)
• ☐ Social media (hijacked accounts get used to scam your friends)

Tip: many password managers can also store 2FA codes, which makes signing in faster. Some people prefer a separate authenticator app so the password and the code aren’t in one place. Either way is a big upgrade.

---

After tonight: fix reused passwords in small batches

Open your password manager’s security or health report. It flags reused, weak and leaked passwords.

• Fix 5 a day, most important first.
• On each site: Change password → let the manager generate one → save.
• Delete accounts you don’t use anymore. They can’t leak if they don’t exist.

---

Common questions

Is it risky to keep all my passwords in one place? Good managers encrypt your vault, and your master password plus 2FA protects it. For most people, that’s far safer than reusing a few passwords everywhere.

What if I forget my master password? That’s what the recovery kit from step 3 is for. Many managers can’t reset it for you, because they can’t see your vault.

Do I still need 2FA if I use passkeys? Passkeys already combine “something you have” (your device) with your fingerprint, face or PIN. Keep 2FA on for anything that still uses a password.

Using public Wi-Fi a lot? A VPN adds encryption on networks you don’t control. → [AFFILIATE LINK PLACEHOLDER: NordVPN] (We may earn a commission.)

---

15-minute checklist

• ☐ Password manager installed on phone and browser
• ☐ Long master password created, and the recovery kit saved
• ☐ 2FA on for email
• ☐ 2FA on for the password manager
• ☐ 2FA on for banking
• ☐ Backup codes saved

Steps and menu names vary by app and change over time. When in doubt, search the site’s help pages for “two-factor.”