Using a password manager

Why one password isn't enough

You've built a strong passphrase. The next problem: most people use the same password on multiple sites. When one site has a data breach — and breaches happen at major platforms every year — attackers take that password and try it everywhere.

• A gaming site you signed up to gets hacked. Your email and password are exposed.
• Attackers run automated tools that try your email + password on hundreds of other sites.
• If you reused that password on your email account, they're in. From there: password resets on every other account.
• One reused password = all your accounts at risk
• Unique password per site = one breach affects only one account

The only practical way to have a unique strong password everywhere is to let a password manager generate and store them for you.

How a password manager vault works

A password manager is a locked vault that lives on your devices and in the cloud. It holds one entry per account — the website, your username, and a long generated password you never have to type yourself.

When you log in to a site, the manager auto-fills your username and password. You never see the actual password — the manager handles it. Every password it generates is long and random: something like X7#mPkrQ2wLb9vTn. No human could guess it.

Choosing your tool

Two options work well for Canadian families. Both have strong privacy records and comply with Canadian privacy laws. Choose one — they work the same way.

Creating your master passphrase

Your master passphrase is the one password you need to remember. Use the Diceware method: choose four or five random, unrelated words — not a sentence you already say, and not words connected to your life.

Create the master passphrase together as a family. The parent or caregiver is the account owner and must know the passphrase. Children can help choose the words and add their number and symbol.

Family setup — step by step

This is a one-time setup. Work through it together — once it's done, adding new accounts takes about 30 seconds each.

1. Download your chosen app (Bitwarden or 1Password) on the family's main device. Get the browser extension for the browser you use most.
2. The caregiver creates the family account. The caregiver is the account owner — they control billing and recovery. Use the master passphrase you created together.
3. Invite family members. Each person gets their own vault section. The caregiver can see the family vault; each person's private section is just for them.
4. Add your most important accounts first. Start with email, school login, and gaming accounts. Use the manager to generate a new, unique password for each one and update the account. See the list below.
5. The child adds at least one account they manage themselves. This is the skill-transfer step. The child logs in, updates the password using the manager's generator, and saves the new entry. They now own that vault item.
6. From now on: every new account gets a generated password. When you create any new account anywhere, let the manager generate the password. You'll never need to think of one again.

What to add first

You don't need to add everything at once. Start with these: