You need a web browser and an email address — nothing to pay for. Bitwarden’s free tier is enough for everything here. One optional step uses Python 3 to show a point in the terminal, but you can skip it. Bitwarden is an app and browser extension, so the setup steps below describe its real screens rather than showing captured output; only the terminal command’s output was captured on a real machine.
🔴 Choose your master password before you begin, and make it one you can remember forever. It is the one password Bitwarden cannot reset for you — everything in your vault is encrypted with it. A long passphrase of four or five unrelated words is ideal: easy to remember, impossible to guess.
Why Use a Password Manager?
The average person has over 100 online accounts. Using the same password for multiple sites means that if one site is breached, all your accounts are compromised. A password manager solves this by generating and storing unique, strong passwords for every account.
You only need to remember one master password. The password manager handles the rest.
Getting Started with Bitwarden
Bitwarden is a free, open-source password manager. Your vault is end-to-end encrypted, meaning not even Bitwarden can read your passwords.
If you forget your master password, Bitwarden cannot recover it. Write it down and store it in a physically secure location (a safe, not a sticky note on your monitor).
Adding and Managing Passwords
Adding Passwords
There are several ways to add passwords to your vault:
- Auto-capture: When you log into a website, Bitwarden offers to save the credentials
- Manual entry: Click the Bitwarden icon > "+" to add a new login manually
- Import: If switching from another manager, export from the old one and import into Bitwarden (Settings > Import Data)
Auto-Fill
When visiting a login page, click the Bitwarden icon to see matching credentials and click to auto-fill. You can also use the keyboard shortcut:
Password Generator
When creating a new account, use Bitwarden's built-in generator instead of making up a password. Click the Bitwarden icon > Generator tab. Configure:
- Length: At least 16 characters (longer is better)
- Include: Uppercase, lowercase, numbers, and symbols
- Or use passphrase mode: Generates memorable word combinations (e.g., "correct-horse-battery-staple")
Organizing Your Vault
As your vault grows, organization helps you find entries quickly:
- Folders: Create folders like "Work," "Shopping," "Finance," "Social" to categorize logins
- Favorites: Star frequently used entries for quick access
- Notes: Store secure notes (recovery codes, license keys, WiFi passwords)
- Cards and Identities: Store credit card info and addresses for auto-fill on shopping sites
Enabling Two-Factor Authentication
Protect your Bitwarden vault itself with 2FA:
With a Premium subscription ($10/year), Bitwarden can generate TOTP codes for your other accounts, acting as both password manager and authenticator.
Now Do It Yourself: Set Up a Password Manager in Five Steps
A password manager replaces “a password I can remember” — which means a weak, reused one — with “one master password, and a different strong password for every site.” You will first see, in the terminal, exactly why reuse is so dangerous, then create a vault, save a login, generate a unique password, and lock the vault down with two-factor authentication. The terminal output below was produced by running it.
Go: a terminal (this step is optional but makes the danger concrete). If you skip it, read the output and move to step 2.
Do: save this as reuse.py and run it. It imagines you reused
one password everywhere, then one site gets breached.
leaked = "Summer2024!"
accounts = {"email":"Summer2024!", "bank":"Summer2024!",
"forum":"Summer2024!", "shop":"Nf7x2mQzPx9k"}
fell = [n for n,pw in accounts.items() if pw == leaked]
safe = [n for n,pw in accounts.items() if pw != leaked]
print("attacker replays the leaked password on every account:")
print(" compromised:", ", ".join(fell))
print(" survived :", ", ".join(safe), "(had its own unique password)")You should see: one leak taking down everything that shared the password, while the account with its own password stands:
attacker replays the leaked password on every account:
compromised: email, bank, forum
survived : shop (had its own unique password)This is called credential stuffing, and it is automated and constant. A password
manager exists so every one of those accounts can have its own shop-style unique
password without you memorising any of them.
If not: if Python is not installed, skip this — the lesson is in the output above, and the rest of the tutorial needs only a browser.
Go: open bitwarden.com and choose Get Started (or install the Bitwarden app from your device’s store).
Do: sign up with your email and the master passphrase you chose in Before you start. Bitwarden will ask you to type it twice and offers a “master password hint” — make the hint a nudge, never the password itself.
You should see: an empty vault after you verify your email. This is the moment your master password becomes the key to everything — Bitwarden stores only an encrypted vault it cannot read, so there is genuinely no “forgot password” that recovers your data.
If not: if you forget the master password later, Bitwarden cannot help — that is the design. Write the passphrase on paper and keep it somewhere safe until it is memorised; this is the one password worth an offline backup.
Go: in the vault, click the + / New button and choose item type Login.
Do: enter a real account you already have — its website, your username, and your current password — and save. Start with something low-stakes like a forum, not your bank, while you learn.
You should see: the item appear in your vault list, and clicking it reveal the details with the password hidden behind dots until you press the eye icon. Your vault now holds one login it will type for you from here on.
If not: if the website field matters for autofill later — enter the
real domain (https://example.com), because Bitwarden matches the saved item to
the site you are visiting by that URL.
Go: open the login you just saved and find the password field’s generate icon (the circular-arrows / dice symbol).
Do: generate a long password (20+ characters), then — importantly — go to that website, change your password there to the generated one, and save the item in Bitwarden. To see for yourself what “strong” looks like, generate one in the terminal too:
python3 -c "import secrets,string; print(''.join(secrets.choice(string.ascii_letters+string.digits) for _ in range(20)))"You should see: a random string like s91r22AC7OhsWXBFYoTB
(yours will differ) — twenty characters with no words, no pattern, nothing to guess.
That is what every one of your accounts should have, and the manager remembers them so you
never type or even see them again.
If not: if a site rejects the generated password, it has a length or character limit — use Bitwarden’s generator options to shorten it or drop special characters, then save the new value in the item so the two never fall out of sync.
Go: in the web vault, open Settings → Security → Two-step login.
Do: enable a second factor — an authenticator app (TOTP) is free and strong. Scan the QR code with an app like Aegis or Google Authenticator and enter the six-digit code to confirm. Save the recovery code it gives you.
You should see: two-step login marked enabled. Now even someone who somehow learns your master password cannot open your vault without your phone — the vault holding every other password you own deserves this extra lock more than any single site does.
If not: if you lose access to the authenticator later, the recovery code you just saved is the way back in — store it with your master-password backup. Do not skip 2FA here thinking you will “do it later”; the vault is the one account where later is too late.
Without scrolling up: a friend says a password manager is dangerous because “if someone gets the master password they get everything.” What is the flaw in stopping there, and what did step 5 add? Answer: the alternative — reusing one memorable password — already gives an attacker everything from a single breach (step 1), and with no protection at all. The manager shrinks your exposure to one strong master password, and step 5’s two-factor login means the master password alone is not enough: an attacker also needs your second factor. You have traded many weak locks for one strong lock plus a second key.
Now do it without the page: pick your three most important accounts — email first, because it can reset all the others — and give each one a freshly generated unique password saved in Bitwarden. Install the Bitwarden browser extension so it offers to fill and save logins automatically as you sign in over the coming week.
Summary
In this tutorial, you learned:
- Why password managers are essential for security
- How to set up a Bitwarden account and install the apps
- Adding passwords, auto-fill, and the password generator
- Organizing your vault with folders and favorites
- Enabling two-factor authentication for your vault
Start by adding your most important accounts (email, banking, social media) and gradually migrate all your logins. Change any passwords that were reused across sites.