1Password

Once the account exists, install everywhere you actually work: the desktop app, the browser extension, and the mobile app. The browser extension is the piece that earns its keep daily, so do not skip it and rely on copy-paste. Turn on biometric unlock (Touch ID, Face ID, Windows Hello) so unlocking is a fingerprint rather than a re-typed passphrase, and you stop being tempted to weaken the master password just to type it less.

Save your Emergency Kit, the document holding your account key, somewhere genuinely safe and offline. If you lose the account key on a personal plan, nobody recovers your vault, which is the point of the design and also the one way to lock yourself out permanently. Treat that piece of paper as seriously as a passport.

Before you import anything, plan your vaults. Vaults are the unit of sharing, so decide the structure up front: a Private vault for you alone, a shared household or team vault for things others need, and separate vaults for anything with a different access boundary (client work, finance, infrastructure). Then import your existing passwords (from a browser or another manager), and run the built-in audit to find the reused and weak ones.

How to actually use it

The order that delivers value fastest is import, then clean, then live in it.

Start by importing every credential you can find, including the ones rotting in your browser. Then open the security audit (1Password calls it Watchtower) and work the list: reused passwords first, because one breach there exposes several accounts, then weak passwords, then any flagged in a known breach. For each one, visit the site, change the password, and let 1Password generate a long unique replacement. You are not trying to fix everything in a day; you are trying to kill the reuse that turns one leak into many.

Once the vault is clean, change your habit: never type a password again. When you sign up for something new, let the extension suggest and save a generated password. When you log in, let it fill. When the browser offers to save a password, decline and let 1Password capture it instead, so you keep one source of truth rather than two half-full ones.

Then push past passwords. Store the things you currently keep in a notes app or a drawer: card details for faster checkout, secure notes for licences and recovery codes, identities for forms, and software keys. The more of your sensitive small data lives here, the more the single-vault habit actually holds.

Power moves

The feature that separates a pro is sharing through vaults, not through messages. When a teammate needs access to an account, you add the item to a shared vault and grant them the vault, and when they leave you revoke it in one place. Nobody ever pastes a password into a chat again, and offboarding stops being a frantic password-reset spree.

Turn on the one-time-password feature so 1Password stores your two-factor codes alongside the login and fills both together. This sounds like putting all your eggs in one basket, and it is a real trade-off, but for most accounts the convenience that makes you actually use unique passwords outweighs the theoretical loss, with your truly critical accounts kept on a separate hardware key.

For sharing outside your team, use the secure-link feature instead of email: it creates a link that expires and can be limited to specific recipients, so a one-off credential hand-off does not sit in someone's inbox forever.

If you build or operate software, 1Password reaches into developer territory: it stores SSH keys and can act as your SSH agent, it manages environment secrets, and it ships a command-line tool. That means a script can pull a secret at runtime from the vault rather than from a plaintext .env file, which is a genuine security upgrade for any real workflow.

Where it fits your stack

In a growth and ops stack, 1Password is the layer underneath everything that needs a login or a key. It plugs into the browser where most of your marketing and ops tools live, so every SaaS account fills automatically. On the team side, it integrates with identity providers for single sign-on and automated provisioning, so people get the right vaults when they join and lose them when they leave.

For the technical side of the stack it connects to the tools that hold secrets: the CLI feeds credentials into scripts and CI, the SSH agent handles server access, and secret references let an app read a key from the vault instead of from a committed file. The effect is that credentials stop being copied into a dozen places and start living in one place that the rest of your tooling reads from.

Pitfalls to avoid

The biggest mistake is a weak or memorable master password. Everything rests on it, so make it a long passphrase you can remember but nobody can guess, and never reuse it anywhere else.

The second is losing the account key. Save the Emergency Kit offline before you do anything else, because there is no reset button by design.

The third is half-adopting it: saving some passwords in 1Password and letting the browser keep the rest. Two sources of truth means you never trust either, and you fall back to old habits. Pick 1Password, turn off the browser's own password saving, and migrate fully.

The fourth, on teams, is dumping everything into one shared vault. That hands everyone access to everything and defeats the structure. Split vaults by access boundary from the start.

Finally, do not treat the audit as a one-time chore. New weak and breached passwords appear over time, so check Watchtower occasionally and keep the reuse count at zero.