Harden It in 12 Steps [2026]

Nadia Dubois
September 13, 2026
21 min read

Password manager security stopped being a “set and forget” job somewhere in 2025. Infostealer malware harvested roughly 624 million passwords that year, against just 34 million lifted from classic compromised databases, according to research published in March 2026, a gap of more than 18 times. The vault sitting on your laptop right now is a far bigger target than the individual websites you log into. This tutorial walks through 12 concrete steps to lock that vault down against the threats that actually worked in 2026: infostealers, passkey phishing, and browser-in-the-browser scams, using tools available on any major password manager in Australia today.

None of this requires switching apps. Whether you run Bitwarden, 1Password, NordPass, Proton Pass, or KeePassXC, the hardening steps below apply with only minor menu differences. By the end, you will have a vault that resists the credential-harvesting techniques attackers actually deployed against Australians this year, plus a working automation project to keep checking your own exposure on a schedule.

Don’t miss new tech stories on Google

Add Tech Insider once in the Google app and our stories appear in your news suggestions.

Why password manager security got harder in 2026

Three shifts changed the threat model for password manager security this year. First, infostealer malware went industrial. Flashpoint’s analysis of the first half of 2025 recorded an 800% jump in infostealer-driven credential theft compared with the prior four months, pulling roughly 1.8 billion credentials from about 5.8 million infected devices. Second, session cookies became as valuable as passwords. KELA’s State of Cybercrime 2026 report tallied close to 2.86 billion compromised credentials, a mix of passwords and session cookies capable of skipping two-factor prompts entirely. Third, attackers started going straight after the vault software itself rather than individual sites.

That third point matters most for this guide. The Picus Red Report 2026 found that credential harvesting from password stores, a technique MITRE catalogues as T1555, showed up in 23.49% of the attacks it analysed, covering both browser-saved logins and dedicated password manager databases. Breachsense’s 2025 dark web exposure report backs this up with device-level detail: infected machines yielded an average of 547 saved passwords each, and its stealer-log tracker recorded 51,322 entries tied to lastpass.com, 17,407 to bitwarden.com, and 6,744 to 1password.com. No brand is immune. What matters is whether the vault was configured to resist extraction once the device itself gets compromised.

SpyCloud’s Identity Exposure Report 2026 adds a sharper detail for this specific guide: its researchers found around 1.1 million master passwords for password managers sitting in leaked datasets. A master password is supposed to be the one credential you never expose. When it turns up in a stealer log, the entire vault is compromised in one move, which is precisely why steps 2, 3, and 4 below focus on making that single point of failure much harder to exploit even if the password itself leaks.

Credential stuffing, a technique OWASP defines as testing large lists of stolen credentials against many sites automatically, has not gone away either. DeepStrike’s breach analysis found credential-stuffing attacks accounted for 22% of all data breaches recorded across 2024 and 2025, overtaking classic phishing as the single most common breach vector during that window. This is where the earlier steps compound: an infostealer harvests a reused password from one site, then an automated stuffing tool tries that same password against banking, email, and retail logins in bulk, often within hours of the initial theft. A password manager that generates a unique password per site defeats stuffing outright, but only if every account actually uses a manager-generated password rather than a memorised one typed in from habit.

For readers in Australia specifically, the Office of the Australian Information Commissioner’s Notifiable Data Breaches scheme means organisations holding your data are legally required to disclose a breach that is likely to cause serious harm. That disclosure timeline is often the first warning a household gets that a password needs changing, which is another reason step 5’s monitoring should run continuously rather than only at setup. Waiting for a company’s breach notification email, which can arrive weeks after the incident, leaves a gap that automated monitoring closes.

Prerequisites: what you need before you start

This tutorial assumes you already have an active password manager account. It works with any of the following, tested against their latest 2026 desktop and browser-extension builds:

• Bitwarden (desktop app and browser extension, latest version)
• 1Password 8 (desktop app and browser extension, latest version)
• NordPass (desktop app and browser extension, latest version)
• Proton Pass (desktop app and browser extension, latest version)
• KeePassXC (latest version, plus a browser connector plugin)

You will also need a hardware security key that supports FIDO2/WebAuthn (a YubiKey 5 series key or equivalent works for every manager on this list), a smartphone with biometric unlock enabled, admin rights on the computer you use daily, and roughly 90 minutes of uninterrupted time. If you plan to run the automation project in step 11, you also need Python 3.10 or newer installed and basic comfort with a terminal. None of the steps below require a paid tier upgrade, though a couple of the monitoring features are premium-only on some apps, which is flagged where relevant.

Step 1: Audit what is already exposed

Before hardening anything, find out whether your credentials are already sitting in a stealer log or breach dump. Most password managers now build this in. Bitwarden and 1Password both surface a “vault health” or “watchtower” report that flags reused, weak, and breached passwords by cross-referencing Have I Been Pwned’s database of more than 15 billion compromised accounts. Run that report first, because it changes the priority order for the rest of this guide. If your master password itself shows up as compromised anywhere, stop and go straight to step 2 before doing anything else.

To check outside your password manager’s own tool, use Have I Been Pwned’s Pwned Passwords feature, which works on a k-anonymity model so your actual password is never transmitted. The code block below in step 11 automates this check for a whole exported list at once, but for a single password, the web form at haveibeenpwned.com/Passwords does the same job in seconds. Australians checking their own exposure should also glance at the Notifiable Data Breaches scheme published by the Office of the Australian Information Commissioner, which lists which local organisations reported breaches this year and gives a sense of which accounts to prioritise for a password reset.

Step 2: Rebuild your master password around length, not complexity

The National Institute of Standards and Technology’s password guidelines (SP 800-63B) have said for years that length beats complexity, and 2026’s infostealer numbers confirm why: brute-force guessing barely factors into how vaults get compromised. Extraction happens on an already-infected device where the attacker reads decrypted memory or an unlocked session, not where they crack a hash offline. Even so, a long, unique master password is your last line of defence if the vault file itself leaks.

Build a passphrase of at least five random, unrelated words, around 20 to 30 characters total. Every major manager includes a passphrase generator for exactly this purpose. Bitwarden’s generator, for instance, defaults to a five-word passphrase separated by hyphens with an optional number, which is both easier to type from memory than a random string and harder to brute force given its length. Do not reuse this passphrase anywhere else, and do not store it in a note, email draft, or another app’s password field. Write it down once, on paper, and keep that paper somewhere physically secure.

Step 3: Put a hardware key on the vault unlock itself

Most people who set up two-factor authentication protect their email and banking logins but leave the password manager’s own unlock screen on password-only. That is backwards. The vault is the single point of failure for every other account, so it deserves the strongest available second factor. Every manager on the prerequisites list supports FIDO2 hardware key unlock as of its 2026 builds.

In Bitwarden, go to Settings, then Security, then Two-step Login, and add a FIDO2 WebAuthn provider using your hardware key. In 1Password, this lives under Settings, then Security, then Two-Factor Authentication. NordPass and Proton Pass both use near-identical menu paths under their respective Security tabs. If you use a YubiKey, register it with the CLI first so you have a verified reference for troubleshooting later:

ykman fido credentials list
ykman fido access change-pin
ykman info

Register a second, backup hardware key and store it somewhere other than your main bag or desk. A single hardware key is a single point of failure of its own, losing it without a backup registered locks you out of the vault entirely, which is one of the most common support tickets password manager vendors field.

If you cannot justify buying two hardware keys immediately, a time-based one-time password (TOTP) authenticator app is an acceptable interim second factor, though it is weaker against phishing than a FIDO2 key because a TOTP code can still be typed into a fake site by a confused or rushed user. A hardware key cannot be phished this way, since the cryptographic challenge-response only completes on the genuine domain it was registered against. Treat a TOTP-only setup as a stepping stone toward a hardware key, not a permanent substitute, particularly on the account guarding every other password you own.

Step 4: Disable browser-saved passwords everywhere

This is the step most guides skip, and it is the one the Picus Red Report 2026 data points to directly. Chrome, Edge, Firefox, and Safari all offer to save passwords on their own, completely separate from any dedicated password manager you have installed. Those browser-native stores are exactly what infostealer malware families like RedLine and Raccoon are built to scrape, and DeepStrike’s analysis found 2024’s infections alone lifted 548 million passwords and 17 billion session cookies this way, averaging 44 passwords and 1,861 cookies per infected PC.

Turn browser-native saving off entirely and rely only on your dedicated manager’s autofill. In Chrome, this is under Settings, then Autofill and passwords, then Password Manager, where you switch off “Offer to save passwords.” On a managed Windows fleet, IT teams can push this as an enterprise policy instead of relying on every user to flip the switch manually:

{
  "PasswordManagerEnabled": false,
  "PasswordLeakDetectionEnabled": true,
  "AutofillAddressEnabled": true,
  "AutofillCreditCardEnabled": false
}

That JSON snippet is a Chrome Enterprise policy fragment. Deploy it through Group Policy on Windows or a configuration profile on macOS to enforce it across every device your organisation manages, rather than trusting individual settings toggles.

On a Windows machine without a full Group Policy deployment, the same setting can be pushed through a direct registry edit, which is useful for a home office or a small team running standalone PCs rather than a managed domain:

reg add "HKLMSOFTWAREPoliciesGoogleChrome" /v PasswordManagerEnabled /t REG_DWORD /d 0 /f
reg add "HKLMSOFTWAREPoliciesGoogleChrome" /v PasswordLeakDetectionEnabled /t REG_DWORD /d 1 /f

Run that from an elevated Command Prompt on each machine, then restart Chrome for the policy to take effect. Confirm it applied by visiting chrome://policy in the browser and checking that PasswordManagerEnabled shows a status of “OK” rather than “Not set.”

Step 5: Turn on breach and dark-web monitoring

1Password’s Watchtower, Bitwarden’s vault health reports, and NordPass’s Data Breach Scanner all monitor your saved logins against fresh breach dumps on an ongoing basis, not just at setup. Turn this on and set it to notify you immediately rather than in a weekly digest. Given that BrightDefense’s 2026 password statistics still put stolen credentials behind 22% of recorded breaches, a same-day alert is the difference between rotating one password and rotating a dozen accounts an attacker had days to work through.

Where the feature sits behind a premium tier, as it does on some plans, weigh the cost against what a single compromised banking or email login actually costs to fix. For most Australian households the premium tiers on Bitwarden, 1Password, or NordPass run somewhere between a coffee and a streaming subscription per month, and breach monitoring alone tends to justify it.

Step 6: Shorten vault lock and session timeouts

An unlocked vault sitting idle in a browser tab is exactly what infostealers are built to scrape without ever needing your master password again. Every manager lets you set an auto-lock timer. Set it to lock after 5 minutes of inactivity on a personal device and after 1 to 2 minutes on any shared or work-issued machine. Also enable “lock on system sleep” and “lock on browser restart” where available, since these close the two most common windows where a session stays open longer than the user realises.

In Bitwarden this sits under Settings, then Account Security, then Vault Timeout. In 1Password it is under Settings, then Security, then “Lock after computer is idle for.” Pair a short timeout with biometric unlock (Windows Hello, Touch ID, or Face ID) so re-entering the vault stays fast even with a tight timer.

Step 7: Set up passkeys the right way, and know how they get phished

The FIDO Alliance’s State of Passkeys 2026 report puts active passkeys at roughly 5 billion globally, with around 90% consumer awareness and about 75% of consumers having turned on at least one passkey somewhere. That is real progress against classic phishing, because a passkey is cryptographically bound to the exact domain it was created for and cannot be typed into a fake site. But 2026 also saw a new failure mode: passkey-relay phishing, where an attacker tricks a victim into approving a passkey prompt on their own device while the attacker’s session is what actually gets authenticated, using a real-time proxy between victim and target site.

To store passkeys safely, add them through your password manager rather than relying solely on your phone’s or browser’s built-in passkey store, since a manager syncs them across every device you use and includes them in the vault health checks from step 1. When creating a passkey, always confirm the domain shown in the prompt matches the exact site you intended to visit, not a lookalike. If a login prompt ever appears unexpectedly, on a device you did not just use to start a sign-in, decline it and change that account’s password immediately, because that pattern is the clearest sign of a relay attempt in progress.

One migration wrinkle worth planning for: the FIDO Alliance’s Credential Exchange Protocol (CXP) became a Proposed Standard in early 2026, and both 1Password and Bitwarden began testing passkey import and export tools built on it during the year. That makes switching managers without losing passkeys far less painful than it was previously, but it also creates a new phishing surface, since an export file containing multiple passkeys is a single, highly valuable target if intercepted. Only run a CXP-based export or import over a trusted, private connection, never on public Wi-Fi, and delete any temporary export file the moment the transfer completes, exactly as you would with the vault export in step 11.

Step 8: Defend against browser-in-the-browser attacks

Browser-in-the-browser attacks render a fake browser window, complete with a convincing fake address bar, inside the real browser tab, usually triggered by a “Sign in with Google” or “Sign in with Microsoft” button on a compromised or malicious site. The fake window is just an image or an iframe. It cannot be dragged outside the boundaries of the real browser tab, cannot be resized independently of it, and cannot be moved to a second monitor. That is the single most reliable tell.

A password manager’s autofill is your best practical defence here, and this is one more reason step 4 matters. A genuine password manager extension will refuse to autofill credentials into a fake popup window because it checks the actual domain the form is rendered on, not the domain painted inside the fake address bar. If your manager does not offer to autofill on a login popup you were expecting it to fill automatically, treat that as a red flag and close the window rather than typing your password in manually.

A second tell is the browser’s own full-screen or immersive mode. Press F11 (or the equivalent full-screen toggle on macOS) while the suspicious window is open. A real popup window will be forced to close or resize awkwardly when the parent browser goes full screen, since it is a genuine separate OS window rather than content rendered inside the page. A fake browser-in-the-browser window, being just an image, will scale strangely or simply vanish along with the rest of the page content. Teaching this two-second check to less technical family members or staff closes off one of the more convincing scams of 2026 without requiring them to understand anything about how the attack works under the hood.

Step 9: Harden your account recovery paths

Attackers who cannot get into your vault directly will often go after the recovery path instead: the email address tied to your password manager account, or the phone number used for SMS-based recovery codes. Move recovery SMS to an authenticator app wherever a service allows it, since SIM-swap fraud remains a live risk flagged by Scamwatch and defeats SMS-based recovery outright. Then apply everything in steps 2 through 6 to that recovery email account itself, since it is functionally a master key to your master key.

Store your password manager’s own emergency recovery codes (the ones generated at setup, separate from any recovery email) somewhere offline, such as a printed copy in a locked drawer or a fireproof safe. Do not store them as a note inside the same vault they are meant to unlock; if the vault becomes inaccessible, a recovery code stored inside it is useless.

Step 10: Configure emergency access for family or business continuity

Bitwarden, 1Password, and NordPass all support a form of emergency access or digital inheritance, letting a trusted person request access to your vault after a waiting period you set, typically between 24 hours and several days. This matters for two very different scenarios: a family member needing access after an incapacitating event, and a small business needing continuity if a single employee who managed shared logins is suddenly unreachable.

Set the waiting period long enough that you would notice and reject a fraudulent request (48 to 72 hours is a reasonable middle ground), and choose a trusted contact who already understands what the request notification looks like, so they do not mistake a legitimate request for phishing or vice versa. For a small business running a shared team vault, add at least two trusted contacts rather than one, since a single point of failure in emergency access defeats the purpose of setting it up.

Step 11: Build an automated breach-check project

This is the complete working project for this tutorial: a scheduled script that exports your vault, checks every password against Have I Been Pwned’s k-anonymity API, and emails you a summary, without ever sending a full password over the network. Start by exporting your vault as an encrypted JSON or CSV file (Bitwarden: Tools, then Export Vault, then choose the encrypted format). Then run the following Python script against that export:

import csv
import hashlib
import requests

def check_password(password):
    sha1 = hashlib.sha1(password.encode("utf-8")).hexdigest().upper()
    prefix, suffix = sha1[:5], sha1[5:]
    resp = requests.get(f"https://api.pwnedpasswords.com/range/{prefix}", timeout=10)
    hits = dict(line.split(":") for line in resp.text.splitlines())
    return int(hits.get(suffix, 0))

def audit_export(csv_path):
    flagged = []
    with open(csv_path, newline="", encoding="utf-8") as f:
        for row in csv.DictReader(f):
            count = check_password(row["password"])
            if count > 0:
                flagged.append((row["name"], row["login_uri"], count))
    return flagged

if __name__ == "__main__":
    results = audit_export("vault_export.csv")
    for name, uri, count in results:
        print(f"EXPOSED: {name} ({uri}) seen {count} times in breach data")

The k-anonymity model means the script only ever sends the first five characters of a SHA-1 hash to Have I Been Pwned’s API, never the password or its full hash, so nothing sensitive leaves your machine. Delete the exported CSV file immediately after running the script; an unencrypted vault export sitting on disk defeats every other step in this guide.

To run this automatically each week, schedule it with cron on macOS or Linux:

# Run every Sunday at 9am
0 9 * * 0 /usr/bin/python3 /home/you/vault-audit/audit.py >> /home/you/vault-audit/log.txt 2>&1

On Windows, register the same script as a scheduled task pointed at your Python interpreter with an identical weekly trigger. Either way, the export-check-delete cycle should complete inside a minute or two for a typical household vault of under 200 entries. A clean run against a well-maintained vault produces output like this:

$ python3 audit.py
EXPOSED: Old Forum Account (oldforum.example.com) seen 4213 times in breach data
EXPOSED: Streaming Trial (freetrial.example.net) seen 87 times in breach data
Audit complete: 2 of 143 entries flagged

Two flagged entries out of 143 is a realistic result for a vault that has been through steps 1 through 6, and both examples above are exactly the kind of low-value, rarely-used accounts where an old, reused password tends to survive unnoticed. Rotate those immediately, generating a fresh unique password through your manager rather than a memorable one.

To turn this into a proper alert rather than something you have to remember to read, extend the script to email itself a summary using your provider’s SMTP settings:

import smtplib
from email.message import EmailMessage

def send_summary(flagged, to_addr, smtp_host, smtp_user, smtp_pass):
    msg = EmailMessage()
    msg["Subject"] = f"Vault audit: {len(flagged)} exposed passwords found"
    msg["From"] = smtp_user
    msg["To"] = to_addr
    lines = [f"{n} ({u}): seen {c} times" for n, u, c in flagged]
    msg.set_content("n".join(lines) if lines else "No exposed passwords found this week.")
    with smtplib.SMTP_SSL(smtp_host, 465) as server:
        server.login(smtp_user, smtp_pass)
        server.send_message(msg)

Store the SMTP password itself in an environment variable rather than hardcoding it in the script, and never commit that script to a public repository with credentials embedded. If you use Gmail, generate a dedicated app password for this script rather than using your main account password, so the script’s access can be revoked independently if the machine it runs on is ever compromised.

Step 12: Set a recurring maintenance schedule

Security hardening decays without upkeep. Set three recurring calendar reminders: a monthly check of your manager’s built-in vault health report, a quarterly review of which browser extensions have autofill permissions (revoke anything you no longer use), and an annual rotation of your master password and hardware key PINs even if nothing has flagged as compromised. This is also the point to revisit shared logins in a family or team vault, since staff turnover and relationship changes are a common reason old shared credentials keep working long after they should have been revoked.

Password manager hardening features compared

Not every manager exposes every hardening feature at the same tier. Here is how the five covered in this guide stack up on the controls used above.

Manager	Hardware key vault unlock	Passkey storage	Breach monitoring	Emergency access	Typical price (AUD)
Bitwarden	Yes, free tier	Yes	Yes, free tier	Yes, Premium	Free / ~$14 per year Premium
1Password	Yes	Yes	Watchtower, included	Not built-in; family sharing instead	~A$8 per month
NordPass	Yes	Yes	Data Breach Scanner	No	~$1.99 per month, annual plan
Proton Pass	Yes	Yes	Dark Web Monitoring, paid tier	No	Free / paid tier available
KeePassXC	Yes, via plugin	Limited	Manual, via HIBP import	No, self-managed	Free, open source

2026 credential-theft data at a glance

The numbers behind this guide, gathered from separate 2025 and 2026 industry reports, show why password manager security now hinges on device hygiene as much as on the strength of any single password.

Metric	Figure	Source
Infostealer credential theft growth, 1H 2025	800% increase	Flashpoint
Credentials stolen from infected devices, 1H 2025	1.8 billion from ~5.8 million devices	Flashpoint
Compromised credentials tracked in 2026 report	~2.86 billion	KELA, State of Cybercrime 2026
Attacks using password-store harvesting (T1555)	23.49% of analysed attacks	Picus Red Report 2026
Passwords harvested by infostealers vs breached databases, 2025	~624 million vs ~34 million	Industry analysis, March 2026
Breaches involving stolen credentials, 2026	22% (down from 31%)	BrightDefense
Active passkeys worldwide, 2026	~5 billion	FIDO Alliance, State of Passkeys 2026

Common pitfalls when hardening a password manager

• Registering only one hardware key. Lose it and you lock yourself out of the vault protecting everything else. Always register a second key and store it separately.
• Leaving browser-native password saving on “ask every time.” Even on ask mode, saved entries from months ago often remain in the browser’s own store. Audit and clear it, not just disable it going forward.
• Storing recovery codes inside the vault they unlock. If the vault becomes inaccessible, a recovery code stored inside it is unreachable exactly when you need it.
• Setting the vault timeout too long “for convenience.” A 30-minute or “never” timeout on a laptop that leaves the house daily removes most of the benefit of steps 3 and 6 combined.
• Approving a passkey or push notification without reading the prompt. Prompt fatigue is exactly what passkey-relay phishing depends on; a rushed tap defeats the whole mechanism.
• Skipping the master password change after an export. A vault export, even encrypted, is a new copy of your data sitting outside the manager’s own protections. Treat every export as a reason to verify the master password has not appeared in a breach since.
• Assuming premium features are automatically enabled. Breach monitoring and Watchtower-style checks are often opt-in even on paid tiers; check the settings menu rather than assuming.

Troubleshooting password manager hardening issues

• Hardware key not recognised by the browser extension: update the extension to its latest version and check the key firmware with ykman info; older firmware sometimes lacks resident-key support required for passkeys.
• Autofill stopped working after disabling browser-saved passwords: confirm the manager’s own autofill permission is still granted in the browser’s extension settings, since disabling the native store sometimes resets extension permissions.
• Vault health report shows a false positive on a shared family login: shared logins often trigger “reused password” warnings by design; mark them as intentionally shared rather than rotating them unnecessarily.
• Python script in step 11 returns a connection timeout: the Have I Been Pwned API rate-limits by IP; add a half-second delay between requests in the loop if auditing more than a few hundred entries.
• Emergency access request never arrives for the trusted contact: check that the contact’s account email is verified, not just added, since most managers require verification before the waiting-period countdown can start.
• Passkey created on one device does not sync to another: confirm both devices are signed into the same manager account, not just the same browser, and that cloud sync is enabled rather than local-only storage.
• Vault locks unexpectedly mid-session: check for a “lock on system sleep” setting interacting with an OS-level sleep timer shorter than expected, common on laptops with aggressive power-saving profiles.
• Weekly cron job in step 11 does not produce output: verify the cron environment has the same PATH as your interactive shell; cron jobs often fail silently because python3 is not found under a minimal cron PATH. Use the full interpreter path shown in the crontab example.

Advanced tips for households and small businesses

For a small business managing a shared team vault, separate credentials into collections by role rather than one flat shared vault, so a compromised junior account cannot expose admin-level logins. Bitwarden and 1Password both support this natively through organisation collections with per-collection permissions. Rotate any shared login the moment an employee with access leaves, not on a quarterly schedule, since the window between departure and rotation is exactly when a disgruntled former staff member or their compromised personal device becomes a risk.

For households running the automation project from step 11, extend the script to check not just for breach exposure but for password reuse across entries by hashing and comparing each stored password against every other one in the export, flagging any duplicates before they get harvested together from a single infected device. Combine this with a browser policy that disables extensions from unknown sources entirely on any machine used to access financial accounts, since a malicious browser extension is one of the more common ways infostealers reach an already-hardened vault in the first place.

What a hardened setup looks like in practice

After working through all 12 steps, a typical setup looks like this: a five-word passphrase master password stored nowhere except memory and one paper backup, a registered hardware key plus a backup key in a separate location, browser-native password saving switched off across every browser on every device, a 5-minute vault timeout with biometric unlock, breach monitoring turned on with immediate alerts, passkeys stored in the manager rather than the OS-level store, emergency access configured for one or two trusted contacts with a 48-hour waiting period, and a weekly automated breach check running quietly in the background.

None of these steps individually stop a determined, well-resourced attacker. Together, they remove the specific weaknesses that the 2025 to 2026 infostealer wave, passkey-relay phishing, and browser-in-the-browser scams were built to exploit, which is what “hardened” actually means in practice rather than as a marketing term.

Frequently asked questions

Is a password manager still safer than remembering passwords myself in 2026?
Yes. The 2026 threat data shows attackers overwhelmingly target reused, weak, or previously breached passwords, which a manager eliminates by generating unique ones per site. The risk has shifted to protecting the vault itself, which is exactly what the 12 steps above address, rather than a reason to avoid using one.

Can an infostealer read my password manager vault even if it is locked?
A properly locked, encrypted vault resists direct extraction. The real risk is an unlocked or recently-unlocked session left in memory, or a compromised browser extension with autofill permissions, which is why steps 4 and 6 focus specifically on session timeouts and extension hygiene.

What is the single most important step in this guide if I only have time for one?
Adding a hardware key to the vault unlock itself, step 3. A stolen or guessed master password alone becomes far less useful to an attacker once a physical key is also required.

Do passkeys eliminate the need for a password manager?
No. Passkeys still need somewhere to live and sync across devices, and a password manager remains the safest place to store them alongside the passwords for sites that have not adopted passkeys yet, which in 2026 is still the majority of everyday logins.

How do I know if a login prompt is a browser-in-the-browser attack?
Try to drag the window past the edges of the browser tab it appeared in. A real OS-level popup window moves independently; a fake one rendered inside the page cannot, and will clip at the tab’s boundary.

Is it safe to run the Have I Been Pwned check in step 11 on a work computer?
Yes, provided you delete the exported CSV file immediately afterwards. The script never transmits full passwords or hashes, only a five-character hash prefix, which is the same k-anonymity method Have I Been Pwned’s own website uses.

How often should emergency access waiting periods be reviewed?
Annually, or immediately after any major life change such as a relationship breakdown, a new business partner, or an employee departure, since the trusted contact list itself can become a liability if left unreviewed.

Does KeePassXC support all of these hardening steps without a subscription?
Most of them. Hardware key unlock and passkey storage work through community plugins, and breach checking can be done manually by importing a Have I Been Pwned dataset, though it lacks the automatic, ongoing monitoring that hosted managers provide out of the box.