Best practices · 2,400 words

Password manager best practices in 2026

Five years of running a password manager taught me the operational practices that matter — and the ones that don't. This is the actually-useful list, applicable to Bitwarden specifically and any reputable manager generally.

Master password discipline

Length over complexity

The single most important rule. A 5-word random passphrase ("correct horse battery staple wagon") has more entropy than a 10-character random string ("Tr0ub@d0r3") and is easier to remember. NIST 2017+ guidance explicitly endorses passphrases.

Aim for 14+ characters total, ideally 4-5 random words. Use EFF's diceware or your password manager's generator.

Random selection is non-negotiable

Don't pick words that mean anything personal — your dog's name, your favourite band, your birthplace. Social engineering has access to all of that. Random selection from a wordlist is the only way to ensure entropy.

Never reuse

Master password must be unique to your password manager. Don't reuse from email, banking, or anything else. If a single service breaches, your master must remain unaffected.

Don't store digitally

Memorise it. If you must write it, paper in a fireproof safe. Don't store in a text file, a sticky note, a phone notes app, or another password manager. The whole point is that this one password lives only in your head.

Rotation is mostly outdated advice

NIST guidance dropped mandatory rotation in 2017 — forcing periodic changes encourages weak passwords (people increment a number on the end). Rotate the master only if you suspect compromise or you used a weak one initially.

Vault hygiene

Quarterly review

Every 3 months, spend 15 minutes:

• Run vault health check (Premium feature in Bitwarden) — list of compromised, weak, reused passwords.
• Delete entries for services you no longer use.
• Update entries with stale info (changed phone numbers, expired credit cards).
• Verify URL fields match current site (companies rebrand domains).

One password per service

Sounds obvious; gets violated constantly. If two services share a password, a breach of one becomes a breach of both. Password manager generates fresh passwords; cost of one-per-service is zero.

Use the generator religiously

Don't type a password yourself when creating a new account. Click the generator, accept whatever it produces. 16-character random alphanumeric is the modern default. Only override length for sites with stupid maximum-length restrictions.

Update old weak passwords proactively

Every quarter, pick 5-10 of your oldest entries (sort by date created), regenerate fresh passwords. Slow but eventually rotates everything off the early reuse-era credentials.

2FA strategy

Master account 2FA is mandatory

Discussed at length in our 2FA setup guide. TL;DR: enable TOTP today. Add FIDO2 hardware key if you're a high-value target. Never use only email-code 2FA.

Per-account 2FA where supported

Beyond the password manager itself, enable 2FA on:

• Email accounts (the recovery channel for everything else)
• Banking and financial services
• Cloud storage with sensitive documents
• Any service that's been breached recently
• Anything that controls other authentication (Google account, Apple ID, Microsoft account)

Don't store master-account TOTP in the vault it protects

Circular dependency. Master account TOTP must live in a separate authenticator (Aegis, 2FAS, Google Authenticator). Per-service TOTP can go in the password manager (Bitwarden Premium has TOTP support per item) — that's fine, those don't protect the manager itself.

Backup 2FA factors

Hardware key strategy: buy two YubiKeys, register both, keep one in a safe. Authenticator app strategy: use one with cloud backup (Authy, 2FAS with sync) or maintain two devices with the same secrets. Recovery codes: physical paper, safe deposit.

What to store in the password manager

Always store

• Login credentials for every online service
• Wi-Fi passwords (home, office, frequent hotels)
• Software licence keys (Office, Adobe, games)
• API keys and tokens (developers)
• Database connection strings (developers)
• Recovery codes for various services
• Server SSH keys (alongside the actual key file)

Useful to store

• Credit card details (premium for autofill on checkout)
• Identity documents reference numbers (passport number, but not the document itself)
• Address details for autofill
• Medical record numbers (not full health record)
• Emergency contact info
• Insurance policy numbers

Borderline cases

• Bank account routing/account numbers — useful for auto-paying rent, risky if vault compromised
• Crypto recovery seeds — controversial; many security pros say never store hot, others say encrypted vault is acceptable for non-life-changing amounts
• Photos of physical IDs — only encrypted vault with strong master, and only if the alternative is physical loss

What NOT to store in the password manager

• The master password itself. Obviously. Memorise it.
• Master account 2FA TOTP secret. Circular dependency.
• Long-term cryptocurrency cold storage seeds for significant amounts. Hardware wallet, not vault.
• Documents you can't reproduce. Birth certificate scans, tax records — encrypted backup, not password manager.
• Physical safe combinations. If you can't remember the safe combo, it's defeating the safe.
• Anything that, if vault compromised, would be catastrophic in a way the listed credentials wouldn't be. Calibrate to your specific situation.

Backup procedures

Why backup the vault

Cloud password managers are highly reliable, but: account lockouts happen, password resets fail, you might leave the service. A backup is insurance.

How to backup Bitwarden

1. Web vault → Tools → Export Vault.
2. Format: Encrypted JSON (recommended) or unencrypted JSON / CSV.
3. Save to encrypted external drive or USB stick.
4. Store the drive offline (not in cloud, not on always-connected device).

Backup cadence

Quarterly is sensible. Monthly if you make many vault changes. Yearly is too infrequent for active vaults.

Keep multiple backups

Two physical locations — home + office, home + safe deposit box. The two-location rule defeats single-point-of-failure scenarios (house fire, theft).

Test restores

Once a year, restore a backup to a test account and verify integrity. Backup that's never tested has unknown reliability — could be silently corrupted.

Threat-model thinking

Who are you defending against?

The right level of paranoia depends on who realistically might attack you:

• Random scammer / mass attack: any reputable password manager + TOTP defeats this.
• Targeted attacker (former colleague, ex-partner, etc.): upgrade to FIDO2, audit recently-active sessions monthly.
• Sophisticated criminal (you have $1M+ in crypto, you're a CEO): hardware wallet for crypto, FIDO2 with two keys, dedicated work-vs-personal email accounts, regular audits.
• State-level adversary: different game entirely; password manager alone is insufficient. Compartmentalised devices, VPNs, encrypted comms, threat-aware operational security.

Calibrate spend to threat level

Free Bitwarden + free TOTP authenticator is fine for typical users. $10/year Premium + $50 YubiKey is fine for moderate-threat users (security/journalism/finance roles). State-actor defence requires investments far beyond password management.

Common mistakes I've seen

1. Reusing master password across services. Even once. The whole architecture breaks.
2. Storing master TOTP in the vault it protects. Locked-out scenario.
3. No 2FA on master account. Single password is the entire defence.
4. Master password written on Post-it note next to monitor. Yes, people do this.
5. No backup of vault. Account lockout = lose everything.
6. Using a personal account for workplace credentials. Better separation: dedicated work vault.
7. Telling family the master password "in case of emergency". Bitwarden Premium has Emergency Access feature for this — designated contact requests vault after delay you set.
8. Picking a password manager mainly on UI design. Security record matters more.
9. Storing every credential without ever auditing. Vault grows to thousands of entries you don't remember.
10. Using browser-saved passwords as primary. No master password protection, syncs to whoever has access to your browser profile.

Closing thoughts

Most "password manager best practices" articles read like checklists. The actual practice is simpler: pick a strong master, enable 2FA, generate fresh passwords for everything, back up quarterly. The rest is calibration to your specific situation.

If you take one thing from this guide: master password length matters more than every other setting combined. A 6-word random passphrase with TOTP defeats nearly every realistic attack on your vault.