Adopting a password manager is the first step; the second, often neglected, is keeping it in order. After importing the passwords saved in your browser you end up with hundreds of entries: duplicates, accounts on sites closed years ago, incomprehensible names such as «accounts.example.com», old passwords never updated. A messy vault still works for autofill, but becomes hard to use when you need to look something up, share access or run a security check.
After importing: the first cleanup
The initial cleanup is the longest part, but you only do it once. A reasonable order:
- Delete duplicates. Many password managers flag them automatically. When there are two entries for the same site, keep the one with the most recent password, checking with a test login.
- Delete dead accounts. Closed sites, services you no longer use. If the account still exists, consider deleting it directly on the site: a forgotten account is a needless risk.
- Rename entries. Give each one a readable name, such as «Bank – current account» or «Electricity supplier», instead of the technical address of the login page.
- Check the associated web address. It must match the real domain of the service, because that is what the password manager uses to offer autofill only on the right site.
Consistent names
A simple convention makes the list easy to scan:
| Messy entry | Tidy entry |
|---|---|
| login.example-service.com | Example Service – personal |
| app.example-service.com (2) | Example Service – work |
| 192.168.1.1 | Home router – admin panel |
| Wi-Fi | Home Wi-Fi – guest network |
When you have several accounts on the same service, add something after the name to tell them apart: personal, work, association, family member's name.
Folders or collections
Most password managers let you group entries in folders, collections or «vaults». You do not need refined categories: search remains the main tool. Folders are mainly useful for two purposes:
- separating what is shared from what is yours alone;
- isolating critical entries, such as your main mailbox, your bank and the password manager itself, so you can check them quickly.
A typical structure: Personal, Work, Family (shared), Home and devices, Finances.
Not just passwords
A password manager can store much more than website credentials, always encrypted:
- two-factor authentication recovery codes;
- security questions, ideally with made-up answers recorded here;
- Wi-Fi and router passwords;
- device unlock codes, such as the SIM PIN or PUK;
- software licences and serial numbers;
- secure notes with sensitive information.
Use custom fields for useful details, such as the email alias used for that account or the customer number. When you need to contact support, you will have everything in one place.
Sharing with family or a team
Many password managers offer family or small-group plans with shared folders. Compared with sending a password by message, sharing is safer and more convenient: if the password changes, everyone sees the new one, and you can revoke access at any time.
Some good practices:
- share only what you really use together, such as the Wi-Fi network, streaming services, household utilities;
- use read-only permissions when others need to use a login but not change it;
- when someone leaves the group, for example a collaborator changing jobs, revoke the sharing and change the passwords they knew.
The security review
Many password managers include a check that flags weak passwords, reused ones or those that appeared in known stolen-data archives. Use it methodically:
- start with critical accounts: main email, bank, public services, the password manager;
- then move on to reused passwords, which are the greatest risk;
- finally the weak passwords on less important accounts.
There is no need to fix everything in one day. Ten entries a week, during the weekly review, bring the vault into shape in a few months.
Protecting access to the password manager
Order is useless if access is fragile. The master password must be long and unique, two-factor authentication turned on, and the emergency kit or recovery codes kept in a safe physical place. Without them, losing the master password can mean losing everything.
In short
- After importing, delete duplicates and useless accounts and rename entries.
- Use consistent names and check the web address linked to each entry.
- A few folders are enough: separate what is shared and what is critical.
- Also store recovery codes, licences and useful details in custom fields.
- Review weak and reused passwords in small batches, starting with critical accounts.
