Use a password manager well

Editorial update: 21 September 2026. Introductory learning material.

An approved password manager can generate and store unique passwords. Choose one through your organization’s security and procurement process rather than relying on an old product list.

• Protect the vault with a long, unique master password and the strongest supported authentication.
• Understand recovery options before depending on the service.
• Use approved sharing features and separate business and personal records.
• Keep devices and the password manager updated.
• Securely handle exports, which may contain unencrypted passwords.

Do not change the master password merely because three or six months have passed. Respond promptly to suspected compromise and follow applicable policy and provider instructions.

Activity: Confirm the recovery owner and offboarding process without exporting or disclosing credentials.

Reference: NIST SP 800-63B-4. Check the source and your system provider’s current instructions before implementation.