Set up a family password manager without losing access to everything

A private photo album still needs a secure login. If its password is the one you also used for an old shopping account, a leak at that shop can give someone a password to try against your photos. A password manager lets you use a different password for each account without remembering all of them. FTC account-security guidance

There are two jobs to do when setting one up. Put the passwords somewhere you can use them, then arrange a way back in if you lose the device you normally use. Do the second job before moving everything over.

Choose one you can use on your actual devices

You may already have a manager. On a recent iPhone, look for Passwords. In Chrome on a computer, open More → Passwords and autofill → Google Password Manager.

Start there if it works across the devices you use. Before moving passwords, open the manager on your phone and computer and check which account it belongs to. A password saved only on one device won't help you sign in from another.

Apple's setup guide and Google's password guide cover those controls. If your family uses different systems, check the manager's support for each person's devices before choosing it. Everyone should have their own manager account, even if you will share some logins.

Set up recovery before you need it

Protect the Apple or Google Account holding your passwords with a unique password and two-factor authentication, which asks for an additional sign-in check. Then look at what happens when that check is on a phone you no longer have.

For a Google Account with 2-Step Verification enabled, open Google Account → Security & sign-in → 2-Step Verification → Backup codes → Continue → Get backup codes. Print or download the codes and keep them somewhere private that you can reach without that Google Account. A copy only in the same account's Drive leaves you depending on the login you're trying to recover.

Each code works once. Creating a replacement set invalidates the old set. Google's Advanced Protection accounts use different recovery arrangements and don't offer these backup codes. Google's backup-code instructions

For an Apple Account, you can add a trusted adult as a recovery contact through Settings → your name → Sign-In & Security → Recovery Contacts → Add Recovery Contact. They can supply a recovery code when you need help getting back in; this doesn't give them access to your account. Check that the contact has been added successfully. Apple's recovery-contact instructions and requirements

Do this for each adult's account. Also check that recovery phone numbers and email addresses still belong to you. An old email account may look unused while it is still the way back into several accounts you rely on.

Replace reused passwords at the website

Open Security in Apple Passwords or Checkup in Google Password Manager to find passwords flagged as reused, weak or exposed in known leaks. Begin with your main email and the accounts holding family photos or payment information. Apple's security recommendations and Google's password checks

For each one, open the actual service's account settings and change its password there, accepting a generated password when offered. Save the new login in the manager. Editing the saved entry alone changes what the manager remembers, not what the website accepts.

Try the updated login in a private browser window before closing your existing session. If it fails, check the account email and whether the manager kept the old password or created a duplicate entry. Fix that account before changing the next one; otherwise you can end up with several saved passwords and no clear idea which changes succeeded.

When moving passwords between managers, don't leave the export in Downloads. A CSV export is a readable list of logins outside the manager's protected storage. After checking that the passwords imported correctly, delete the file, including its copy in the trash and any copies you put elsewhere. Someone with access to the device could otherwise open it and read the passwords. Google's import and cleanup instructions

Share a household login without sharing your whole account

If a school, photo service or other provider lets you invite another parent under their own login, use that. Each person can then recover their own access, and removing one person's access doesn't require changing everybody's password.

Where you need a shared login, put that particular credential in the manager's sharing feature. Your partner may need the household subscription; that doesn't mean they need the password to the email account that resets all your other passwords.

In Apple Passwords, create a New Shared Group, name it, add the people and move the selected passwords into it. Members can see and edit the credentials in that group, and changes are kept up to date across their devices. Check the members before adding another login. Apple's shared-group instructions

In Google Password Manager, select a saved password, choose Share, choose a member of your Google family group, then select Share → Done. This saves a copy to that person's Google Account. Google's sharing instructions

If someone should no longer use a shared account, change its password at the service and review its signed-in devices. Removing a person from a sharing group can't make them forget a password they already saw.

Keep a record of how to get back in

Your recovery note needs to say which manager you use, which account owns it and where its recovery material is kept. Keep that note with the private documents you would retrieve if your phone were lost. Don't put recovery codes in a family chat where they will be copied onto everyone's devices.

Once your important accounts have working, unique logins, the manager also gives you a useful list of accounts you no longer need. Before deleting those, check whether they are still used for recovery or signing in elsewhere. The unused-account guide takes you through that dependency check.