Seven habits that actually protect your vault
A password manager only protects you if a few settings are right. Here they are, most important first. Half an hour, once.
-
A long master password, never reused
It is the only key to your vault, and nobody can reset it. Take four or five unrelated words: "wheelbarrow-keyboard-storm-42-linden" beats a short "P@ssw0rd!" by a wide margin. Use it nowhere else, and write it on paper in a safe place until you know it by heart.
-
Switch the encryption to Argon2id
In the web vault, Settings then Security then Keys: choose Argon2id instead of PBKDF2 and keep the default values. PBKDF2 only resists raw computing power, which graphics cards supply in abundance; Argon2id also demands memory, which makes specialised hardware ineffective. Two minutes of work for years of margin.
-
Turn on two-step login
Settings then Security then Two-step login, with an authenticator app. Even if your master password leaked, it would no longer be enough to open your vault. Keep the recovery codes somewhere other than the vault itself: on paper, or with someone you trust.
-
Export your vault now and then
Tools then Export vault, in the password-protected encrypted format. A server can go down, an account can be lost. Keep that copy offline on a USB stick you put away, and refresh it two or three times a year.
-
Lock your devices
A well-protected vault on an unlocked phone protects nothing. Passcode on the phone, locked session on the computer, and in the Bitwarden app set automatic locking to a few minutes rather than "never".
-
Be wary of anything that rushes you
No legitimate email will ask for your master password, and we never will. The Bitwarden extension only offers to fill a form on the domain it recorded: if it stays silent on a site you thought you knew, look at the address twice before typing anything.
-
Change the passwords already exposed
The vault can spot weak passwords, reused ones, and those found in a known breach. Start with your email account: it is what resets everything else, so it deserves the strongest password and two-step login.
These settings live in your instance's web vault, once your account is created.