How to start using a password manager at work safely

TL;DR — A password manager stores your work passwords in one encrypted vault (locked storage) so you only need to remember one strong master password. The fastest safe setup is: create your account, turn on two-factor authentication, install the browser extension and mobile app, save your first few work logins, and store your recovery code somewhere separate from the vault. Reading time: ~5 min

Goal

When you finish, you will have a working password manager account for work, protected by a strong master password and two-factor authentication, with your main work logins saved, organized, and available on your computer and phone.

Prerequisites

• Your work email address and access to its inbox
• An invitation from your company, or approval to create a work password manager account
• Your phone, with the ability to install apps from the App Store or Google Play
• A modern browser: Chrome, Edge, Firefox, or Safari updated to the latest version
• A second factor for sign-in: an authenticator app (an app that generates 6-digit login codes), such as Google Authenticator, Microsoft Authenticator, or 1Password/Bitwarden Authenticator if your company allows it
• A safe place outside the password manager to store a recovery code: a company-approved notes app, a printed copy in a locked drawer, or a sealed IT handoff document
• 15 minutes with access to your usual work sites so you can save their passwords

Steps

Step 1: Accept the invitation or create your work account

Use the link from your company if you received one. If your company told you to sign up directly, open your provider's website and choose the sign-up option for your work email.

Exact action:

• Open the email with the subject similar to "You have been invited" and click Join, Accept invite, or Create account.
• If there is no invite, go to your provider's sign-up page and enter your work email address.
• Complete the email verification step by clicking the link sent to your inbox.

What you should see when this succeeds: you land on the password manager web vault or dashboard and your work email appears as the signed-in account.

Step 2: Create a strong master password

In the account setup screen, enter a master password that is long and unique. Use a passphrase (several random words) you have never used anywhere else.

Use this exact pattern:

four-or-five-random-words-with-numbers

Example format only:

River7-Window-Lemon-Train

Do not reuse your email password, laptop password, or any existing work password.

What you should see when this succeeds: the account setup completes and the vault opens without any password strength warning.

Step 3: Turn on two-factor authentication

In your password manager's web dashboard, open the security settings and enable 2FA (two-factor authentication).

Exact menu path in your provider's dashboard:

Account or Profile → Security → Two-Factor Authentication → Enable Authenticator App

Then:

1. Open your authenticator app on your phone.
2. Tap + or Add account.
3. Scan the QR code shown by the password manager.
4. Enter the 6-digit code from the authenticator app into the password manager.
5. Click Enable, Confirm, or Finish.

What you should see when this succeeds: the security page shows Two-Factor Authentication: On or a green/active status.

Step 4: Save the recovery code outside the vault

Most password managers show a recovery code, emergency kit, or backup codes during 2FA setup. Save it somewhere that is not inside the password manager.

Exact action:

• On the recovery screen, click Download, Print, or Copy code.
• Save the file to a company-approved secure location, or print it and store it in a locked drawer.
• If your company uses a secure notes system, paste the code there with the title:

Password Manager Recovery Code - <Your Name>

What you should see when this succeeds: you can point to one recovery location that is outside the password manager and accessible if your phone is lost.

Step 5: Install the browser extension on your work computer

Install the official browser extension from your password manager so it can save and fill passwords in websites.

Exact menu path:

Password manager web vault → Apps, Downloads, or Get the Apps → Browser Extension

Then choose your browser:

Chrome Web Store → Add to Chrome
Edge Add-ons → Get
Firefox Add-ons → Add to Firefox
Safari extension page → Install

After installation, sign in to the extension with your work account, your master password, and your 2FA code.

What you should see when this succeeds: the extension icon appears in your browser toolbar and shows you as signed in.

Step 6: Install the mobile app on your phone

Install the official mobile app so you can access work logins away from your computer.

Exact action:

iPhone: App Store → search your password manager name → Get
Android: Google Play → search your password manager name → Install

Open the app and sign in with:

Work email
Master password
6-digit authenticator code

If prompted, turn on biometric unlock (fingerprint or Face ID) for convenience after the first full sign-in.

What you should see when this succeeds: the app opens to your vault and shows the same items as the web vault.

Step 7: Add your first work logins

Start with the accounts you use most often: email, project management, code hosting, cloud dashboard, and VPN.

Exact action in the browser extension:

Open a work site you already use → sign in normally → when prompted, click Save Login or Add Password → Name the item clearly

Use this naming pattern:

<Company> - <System> - <Your email>

Examples:

Acme - Google Workspace - alex@acme.com
Acme - GitHub - alex@acme.com
Acme - AWS - alex@acme.com

If your password manager supports folders, collections, or tags, create these exact labels:

Email
Infrastructure
Finance
HR
Shared Accounts

What you should see when this succeeds: at least 3-5 work logins appear in your vault with clear names.

Step 8: Replace weak or reused work passwords

For any saved login that uses a weak or reused password, change it on the website and save the new one in the password manager.

Exact action:

Open the website → Profile or Account Settings → Security → Change Password

When the password manager offers a generated password, use it. If it asks for settings, use these literal values:

Length: 20
Uppercase: On
Lowercase: On
Numbers: On
Symbols: On

Save the new password when prompted.

⚠️ If the account is shared by a team, do not change the password until you confirm who else uses it. Changing a shared password can lock out coworkers or automation.

What you should see when this succeeds: you can sign out of the site and sign back in using the saved password from the extension.

Step 9: Save one secure note for non-password access details

Some work systems also need account numbers, support PINs, or backup codes. Store those in a secure note, not in a plain text file.

Exact menu path:

Web vault or app → New Item → Secure Note

Use this exact template:

Title: <Company> - <System> - Access Notes
Contents:
Account owner:
Support PIN:
Recovery email:
Notes:

What you should see when this succeeds: the note appears in your vault and is searchable.

Verify it works

Run these checks end to end:

1. On your computer, open a saved work site and sign in using the browser extension autofill.
2. On your phone, open the password manager app and confirm the same login item is visible.
3. Sign out of the password manager on one device, then sign back in using:

Work email
Master password
6-digit authenticator code

1. Confirm your recovery code is stored outside the vault by locating the file, printout, or approved secure note.

Expected result:

- Browser extension fills a saved login successfully
- Mobile app shows the same saved items
- Sign-in requires your master password and 2FA code
- You can locate your recovery code without opening the vault

[Work Sites] ---- 1. save/fill logins ----> [Browser Extension]
                                           |
                                           | 2. sync encrypted vault
                                           v
                                      [Password Manager]
                                           ^
                                           | 3. sign in with master password + 2FA
                                           |
                                       [Mobile App]

Common pitfalls

You used your personal email instead of your work email

Mistake: creating the account with Gmail, Outlook.com, or another personal address.

Symptom: you do not see your company's shared items, or your admin cannot manage your access.

Fix: sign out, create or accept the account with your work email, and ask your admin to resend the invite if needed.

You saved the recovery code inside the password manager

Mistake: storing the only recovery code as a secure note in the same vault.

Symptom: if you lose your phone and forget your master password, the recovery code is unreachable.

Fix: move the recovery code to a company-approved location outside the vault and verify you can access it separately.

You skipped two-factor authentication during setup

Mistake: finishing account creation without enabling 2FA.

Symptom: the account is protected only by the master password, which may violate company policy.

Fix: open:

Account or Profile → Security → Two-Factor Authentication → Enable Authenticator App

and complete the QR code setup.

You changed a shared account password without telling the team

Mistake: updating a password for a shared vendor, social, or infrastructure account on your own.

Symptom: coworkers, scripts, or devices suddenly cannot sign in.

Fix: restore access with the team, then update the shared item in the approved shared vault or collection before anyone signs in again.

The browser extension is installed, but it does not offer to fill passwords

Mistake: installing the extension but not signing in, or using a different browser profile.

Symptom: the icon is visible, but no saved logins appear on websites.

Fix: click the extension icon, sign in with your work account, and confirm you are in the same browser profile you use for work sites.

This article was written by an AI system and published pending human review. Verify anything you intend to act on.