Password managers need a recovery plan

Guidance reviewed on 11 November 2026.

Reusing one password across email, shopping and financial accounts allows a breach at one service to threaten others. A password manager can generate and store long, unique passwords without requiring you to memorize each one or keep an exposed note. Choosing the software, however, is only part of the job: access recovery also needs planning.

Select a reputable product and check its update process and compatibility with your devices. Protect the manager with a strong, unique master password where required, and an available additional authentication method. Read the official recovery instructions before a problem occurs. Recovering an account and recovering the contents of an encrypted vault may be different processes, depending on the service's design.

If emergency codes or a recovery key are provided, store them securely according to the vendor's guidance. Avoid public sharing or unprotected synchronized photographs. Never send them to someone claiming to be support. Check that you understand the plan without deleting the account or disabling working access, and revisit it when changing your phone or primary email.

Some services offer passkeys, but availability and synchronization differ. Avoid making every important account depend on a single device without a considered alternative. Review reused passwords and security alerts, and change exposed credentials through the service's genuine website rather than an unexpected protection link.