guide · static export
Security

Set Up Bitwarden and Lock Down Your Password Vault

One master password, two-factor on the vault, autofill on the desktop and a recovery path that does not depend on remembering anything else.

by@guidox updated:10/30/26 time:20 min level:Beginner tested on:Windows 11 24H2, Bitwarden 2026.1 works on:Windows 10, Windows 11, Android, iOS tools:Bitwarden, Authenticator app
TL;DR

Create the vault with a **long passphrase**, turn on **two-step login** with an authenticator app, and write the **recovery code** on paper. Then install the browser extension and the desktop app so autofill works everywhere.

Before you start

Requirements

  • A Bitwarden account (free tier is enough)
  • An authenticator app (Aegis, 2FAS, Ente Auth)
  • Ten minutes and a place for the recovery code
Step by step

Instructions

01

Start with a passphrase, not a password

Pick four or five unrelated words and separate them with a character. A passphrase of this length beats a short string with symbols, and you only type it once per device.

correct-horse-battery-staple-47
⚠ warningThe master password is never recoverable. Nobody at Bitwarden can reset it.
02

Turn on two-step login

In **Settings > Security > Two-step login** add the authenticator app and scan the QR code. Store the recovery code outside the vault - a code inside the vault you cannot open is useless.

03

Install the extension first

Add the browser extension, log in and enable **autofill on page load** for trusted sites only. Autofill on every page teaches you to click without looking.

tipThe extension can unlock with biometrics - that keeps the master password out of muscle memory on a shared machine.
04

Import what you have, then delete it

Export the old browser passwords to CSV, import them in **Tools > Import data**, and delete the CSV afterwards. That file is plain text and the most common leak in this whole process.

⚠ warningDelete the CSV with Shift + Delete. Emptying the recycle bin is part of the job.
05

Fix the worst passwords first

Open the **Reports** tab and work through **Exposed passwords** and **Reused passwords**. Change the accounts that also protect your email, because email resets everything else.

06

Test the recovery path

Log out everywhere, then sign in again with the passphrase and the TOTP code on a second device. If either step fails now, it will fail worse at the moment you actually need it.

Troubleshooting

Common issues

Autofill does not appear

The page uses a shadow DOM or a cross-origin form. Use the extension popup and copy the entry by hand.

The authenticator codes are rejected

The device clock drifted. Turn on automatic time synchronisation and check the time zone.

I lost the recovery code

Regenerate it in the security settings while you can still log in, and store the new one outside the vault.

The vault asks for the master password constantly

The vault timeout is short. Raise it to a few hours on your own machine, keep it at minutes on shared ones.

FAQ

Frequently asked

Is the free tier enough?

Yes for one person with unlimited entries and TOTP. The paid tier adds file attachments and emergency access.

What if Bitwarden goes down?

The local cache still unlocks, and you have the recovery code on paper. Export an encrypted backup once a year.

How to undo this

Export the vault to an encrypted JSON backup, delete the account and restore the passwords into your browser. Delete the extension and the desktop app afterwards.

Changelog · 1 entry
  1. 2026-10-30
    First version
Interactive version: checklist, feedback, related guides →

Free · no account needed · tracks your progress