How to Set Up a Password Manager on iPhone and Android in the UK

If you use the same password on more than one website, a single data breach can hand a stranger the keys to your email, your bank and your shopping accounts. A password manager fixes this by remembering a different, strong password for every site, so you only have to remember one master password. Setup takes about twenty minutes.

Pick the manager that fits your phone

On an iPhone, the simplest start is the manager built into iOS, found in Settings under Passwords, or as its own Passwords app on newer versions. It stores logins in iCloud Keychain, syncs them across your Apple devices and fills them in with Face ID or Touch ID, at no extra cost.

On Android, the built-in option is Google Password Manager. It is tied to your Google account, saves logins from Chrome and Android apps, and syncs across your devices and any computer where you are signed into Chrome, also free.

If you use a mix of iPhone, Android, Windows and Mac, an independent app can be easier, because it works the same everywhere. Bitwarden is a popular free option, and 1Password is a well-known paid one. Both store your passwords in an encrypted vault and offer apps for every platform. Pick one with a clear privacy policy, and check that it offers two-factor authentication for the vault itself.

Do not keep passwords in a notes app or a spreadsheet, which are not encrypted the same way and are easy to lose or expose.

Create your account and set a strong master password

Open your chosen app or the built-in manager, then create one master password. This is the only password you will need to remember. A good approach is four or five random words joined together, with a number or symbol mixed in.

Write it down on paper and keep it somewhere safe at home. Do not store it in a photo, an email or a cloud note. If you forget it, most managers cannot recover your vault, because the encryption means even the company cannot read it.

Turn on two-factor authentication for the manager itself, so the app asks for a code from an authenticator app or a text message on a new device. It adds a few seconds to signing in and a large amount of protection if someone guesses your master password.

Switch on autofill so logins fill themselves in

A password manager only saves time if your phone offers to fill in your logins. On iPhone, open Settings, then General, then AutoFill and Passwords, and choose your manager. If you use the built-in Passwords app, it is selected by default. On Android, open Settings, then Passwords and accounts, and set your chosen manager as the autofill service. Google Password Manager is the default in most recent versions.

Test it straight away. Open a website or app you already use, tap the username field, and check that your phone offers the saved login. If it offers nothing, check that autofill is switched on for that manager and that the login is saved in the vault.

Move your existing passwords in

Most managers can import passwords from your browser. In Chrome, go to Settings, then Autofill and passwords, then Google Password Manager, and export your saved logins as a file. Your manager will have an import option that reads that file. Delete the exported file as soon as the import is done, because it holds your passwords in plain text.

If your passwords are saved in more than one place, import them all, then let the manager find duplicates. It will flag accounts where you reused a password or chose a weak one. Work through that list over a few days, starting with your email, your bank and your main shopping accounts.

Replace reused and weak passwords

Open the security check or password health report inside your manager. It will list logins that are reused, weak or known to have appeared in a data breach. Start with the most important ones: your email account, because password resets go there, then your bank, then anything tied to payments.

For each one, open the site's change password page and let the manager generate a new password of sixteen random characters or more. Save it in the manager when it asks, and do not try to memorise it.

If a site offers passkeys, consider using one instead of a password. A passkey uses your fingerprint or face to sign in and cannot be phished the way a password can. Your manager can store passkeys too, and many UK banks, email providers and shops now support them.

Keep the vault safe day to day

Set your phone to lock quickly, and use fingerprint or face unlock so the manager can confirm it is you. Never add someone else's fingerprint to a phone that holds your vault. If you share a device with family, set up a separate user profile or keep your manager signed out when you hand the phone over.

Check the security report once a month. It will warn you about new breaches and passwords that have become weak. If a password has leaked, change it right away from the site itself, not from a link in an email or text, which could be a scam.

Finally, set up emergency access if your manager offers it. This lets a trusted person get into your vault if something happens to you, after a waiting period, so nobody can use it without you having a chance to refuse.

Frequently Asked Questions

Is a free password manager safe to use?

Yes, if it comes from a reputable provider. The built-in managers on iPhone and Android, and well-known free apps such as Bitwarden, encrypt your vault so only you can open it. Avoid unknown apps with no clear privacy policy, and always turn on two-factor authentication for the vault.

What happens if I forget my master password?

Most password managers cannot recover it, because your vault is encrypted with that password and the company cannot read it. Write it down on paper and keep it somewhere safe at home. Some managers offer emergency access through a trusted contact, which is worth setting up.

Do I still need two-factor authentication if I use a password manager?

Yes. A password manager gives every account a unique, strong password, which stops one breach from opening all your accounts. Two-factor authentication adds a second check, so even a stolen password is not enough on its own. Use both wherever a site offers them.