Why I Finally Switched to a Password Manager After Ten Years of Reusing the Same Three

For about ten years I ran my entire digital life on three passwords, rotated between banking, email, and everything else, each one a slightly modified version of the last. I told anyone who asked that I "kept it simple on purpose" and that a manager was one more app I didn't need. I was wrong, and I finally admitted it this month. Here's what actually changed my mind — and what nobody mentioned about the parts that are genuinely annoying at first.

I want to be upfront about why I resisted for so long, because I think most people reusing passwords right now have the exact same reasons, and none of them held up once I actually looked at them. I didn't trust a single company to hold every password I own. I didn't want to pay a subscription for something a free browser popup already half-does. And honestly, I didn't want to admit that three passwords wasn't the clever system I'd convinced myself it was.

The moment that actually changed it

It wasn't a hack, or at least not one that hit me directly. A service I'd used for years — nothing dramatic, a forum I barely visit anymore — emailed to say its user database had been exposed and recommended everyone change their password immediately. My first thought wasn't relief that I'd caught it in time. It was a cold drop in my stomach, because that forum used the exact same password as two accounts I actually cared about. I spent the next forty minutes manually changing logins on my phone, in a taxi, annoyed at myself the entire time.

That's the thing about password reuse that the warnings never quite land: it isn't really about that one service being hacked. It's that a breach anywhere in the reused chain hands an attacker every other account wearing the same key. I'd read that sentence a hundred times before. I only believed it once I was the one frantically changing three logins from a moving car.

What I actually did that week

I picked 1Password, mostly because it kept coming up as the choice of people whose judgement on this I trust, and because the family-sharing setup meant I could bring my partner onto the same system without emailing her spreadsheets of logins, which is a genuine thing I used to do. Setup took about twenty minutes: install the app, install the browser extension, set one long master password I'd never used anywhere before, and let it import what Chrome had already been quietly saving for years.

The import was the uncomfortable part. Watching a list of a hundred and forty saved logins scroll past, seeing exactly how many of them shared that same tired core password with a number swapped in, was a genuinely humbling ten minutes. I'd assumed it was three passwords. It was closer to a dozen, once you counted the "just add a 2" variations I'd forgotten I'd ever used.

"I didn't switch because I got hacked. I switched because I finally saw, in one scrolling list, exactly how much I'd been trusting to a habit I would never have called a security system if someone else described it to me."

What actually surprised me, a few weeks in

I expected the daily friction of typing a manager password into everything to be the trade-off I'd resent. It never arrived, because that isn't how it works day to day — the browser extension autofills logins the moment I land on a site, and it generates a genuinely random new password on the spot the moment I sign up for anything new, so I've stopped choosing passwords at all. The thing I hadn't expected was how much calmer signing up for a new account felt. No more "which variation did I use here," no more mental math. Click, generate, done, and I never see the password myself unless I go looking for it.

The other quiet win was on my phone specifically. Face ID unlocks the vault, so autofill on mobile is actually faster than typing was, which is the opposite of what I assumed going in. I'd pictured a manager slowing me down. Most days it's the fastest part of using my phone.

Where it still isn't effortless

I want to be honest that it isn't flawless. A handful of older banking apps and one utility company's site actively fight autofill, throwing up custom login fields the extension can't recognise, so I still type those two or three passwords by hand — which is a small irony given the whole point was to stop doing that. And the master password itself is a genuine single point of failure: there's no "forgot password" button that quietly resets it for you, by design, because the company holding your encrypted vault genuinely can't read what's in it. Lose the master password and the emergency recovery kit both, and you've locked yourself out of everything at once. I keep mine written down, offline, somewhere that isn't a note on my phone. A password manager also only protects what's inside it — the phone itself needs its own layer, which is why I went and turned on Stolen Device Protection and a few other iPhone settings Apple ships switched off by default.

Is it actually worth paying for

I went straight for a paid manager because the family sharing genuinely mattered to me, but it's worth saying plainly that it isn't the only route in. It's one of the very few recurring fees I've kept after cutting most of my subscription creep, because unlike a lot of what I cancelled, this one is doing genuine, constant work rather than gating a feature that should have shipped for free. If you'd rather not pay anything, the password managers built directly into Apple and Google's platforms will still get you off password reuse, which is the part that actually matters — the paid tier buys you sharing, sync across more platforms, and a bit of polish, not the core safety. A year on I tested that properly and moved the whole vault across for a month, which is how 1Password and Bitwarden actually compare when you live in both. More recently I've started layering passkeys on top of the password manager itself — a different fix for a related problem, not a reason to give the manager up.

It's the same instinct that made me finally trust a smart lock on my own front door after years of assuming it was a downgrade: the version I'd built in my head was worse than the real thing turned out to be. And it slots into the same tidy-digital-life mindset that had me testing whether Notion or a plain spreadsheet actually earns its keep — a system only counts if you actually use it every day without thinking about it, and this is the first security habit I've had that's genuinely passed that test. It's the same gap I found when I actually ran the numbers on what my VPN had and hadn't been protecting for two years: a genuinely useful tool doing exactly two specific jobs, not the all-purpose privacy shield I'd assumed it was.

If you're still on the "I've got a system" excuse I used for a decade, I'd just ask you to do the one thing that changed my mind: open your browser's saved passwords and actually scroll through them. That's usually all the argument it takes. If you want the honest follow-up when I next test something I was sure I didn't need, join the Brite newsletter.

Questions people actually ask

Is it safe to store all my passwords in one place?

It's safer than the alternative most people are actually doing, which is reusing a handful of passwords everywhere. A good password manager encrypts your data on your own device before it ever leaves it, using a zero-knowledge model, so the company storing it can't read your passwords even if their servers were breached. The real risk shifts to your master password, which is exactly why that one has to be strong and unique.

What happens if I forget my master password?

With a genuine zero-knowledge manager, there's no backdoor — the company cannot reset it for you, because they never had it. Most services give you a one-time emergency recovery kit or secret key when you set up the account, which you're meant to store somewhere safe and offline, like a locked drawer or a safe. Losing both the master password and the recovery kit means losing access to the vault, so treat that recovery kit like a spare house key, not a formality to skip.

Are free password managers good enough?

For a single device, often yes — the free tiers of most well-known managers, and the ones built into iOS, Android and modern browsers, will generate and store strong passwords perfectly well. Where the free tiers usually stop is syncing across multiple devices and platforms, sharing logins securely with family members, and monitoring saved logins against known data breaches. If you're one person on one device, a free option is a genuine upgrade over reusing passwords.

Do I still need two-factor authentication if I use a password manager?

Yes. A password manager fixes weak and reused passwords; two-factor authentication is a separate layer that protects you if a password leaks anyway, through a breach you never see coming. Most managers can even generate and store your two-factor codes alongside the password now, so turning it on costs you almost nothing extra once the manager is already set up.

Which password manager should I use in 2026?

There isn't one right answer — 1Password, Bitwarden and the password managers built into Apple and Google's platforms are all genuine, well-reviewed options with different strengths: Bitwarden's free tier is unusually generous, Apple and Google's built-in versions cost nothing and are already on your phone, and 1Password's family sharing and travel mode were what won me over specifically. Pick based on which devices you actually use and whether you need to share logins with anyone else, not on which name you've heard most.