2.3: Set Yours Up for Real

Set Yours Up for Real

This is a doing lesson. By the end, your manager will be installed, unlocked by a passphrase you created properly, and filling logins for you. Give it twenty unhurried minutes.

Step 1: Install the app and the extension

Take your pick from 2.2 and install the phone app and the browser extension on the computer you use most. Both matter. The app makes your vault available everywhere; the extension is what turns the manager from a filing cabinet into a tool that participates in every login. (Apple Passwords and Google’s manager are already on your devices — there, your only job is adding the browser extension to any non-default browser you use.)

Step 2: The master passphrase — take this part slowly

You’re creating the one secret that protects all the others. The recipe, and the reasoning behind it:

Use four to five random words. Not a quote, not a lyric, not your kids’ names in a row. Random words, the style that won the math in 2.1. Many managers will generate one for you, and letting them is fine. Say it aloud a few times. plum-ladder-vivid-october-crane is a real master passphrase.

Write it on paper and keep the paper at home. Yes, write it down. This surprises people who’ve absorbed decades of “never write passwords down,” but think back to your actual threat model from Module 1: machines, at scale, on the internet. A burglar reading a note in your desk drawer is not what’s attacking you; reuse is. Keep the paper at home until the passphrase is memorized — a week or two of daily use usually does it — then shred it if you like.

Save the emergency kit where family can find it. Some managers issue a recovery document (1Password calls it the Emergency Kit: your account details plus a secret key). Print it and store it with your important papers, in the folder your spouse, parent, or executor would check. This isn’t only about you being locked out. If something ever happens to you, that one page is how your family reaches the accounts that run your household. It’s a digital legacy plan that fits on a single sheet of paper.

Try it on the practice computer first

Before you do any of this for real, run through it once where nothing can go wrong — the search, the scary permission box, the passphrase. Two or three minutes.

Step 3: Turn autofill on — it’s a security feature

In the extension’s settings, enable autofill, and set the manager as the default password tool on your phone (iOS and Android both have a setting for this). Some people leave autofill off because it feels like a convenience they should virtuously refuse. It’s the opposite. Autofill is a phishing detector.

The manager files every password against the exact website address where you saved it. Visit paypal.com and it offers to fill. Visit paypa1-secure.com, a lookalike built to steal exactly this login, and it stays silent, because to the manager that’s a site it has never seen. Your eyes can be fooled by a convincing page at a nearly-right address. The manager’s string comparison can’t.

So build the reflex now: when autofill unexpectedly declines to fill a login page, stop typing. That silence is information. Check the address bar, because odds are something is off. (Recognizing what’s off is a skill of its own — our Spot the Scam course teaches it in depth.)

Before you move on

Three quick checks: the app opens with your passphrase on your phone; the extension fills a login on your computer (try any account, and let the manager capture it when it offers); the emergency kit is printed and filed.

That’s the machinery in place. Next lesson it starts absorbing your accounts, highest value first.