I recently switched from 1Password to Vaultwarden and decided to manually migrate each of my entries rather than moving everything over with an export file. The primary motivation for this was to perform an audit of all of my accounts — ensuring I had a good baseline level of security for my logins.

I’m, by no means, an expert in security, but think I have a pretty decent understanding of how to secure my accounts. If you haven’t taken the time to improve this component of your digital life, here are some suggestions of what you could do on that front.

1. Use a Password Manager — This will have the biggest impact on the security of your accounts. And although it seems pretty obvious, it’s worth mentioning on the off-chance anyone reading this isn’t already using one. With a password manager, you’ll just have to remember your master password and then you can let it do most of the heavy lifting for you — it can generate randomized passwords, store credentials, automatically fill in login details using a browser extension or system-level integration on mobile, and more. You can use Bitwarden or Proton Pass which offer free plans, self-host with Vaultwarden, or go with something like 1Password. But you should at least be using something.
2. Consider Deleting Accounts — If you still have an account for a service that you no longer use and are unlikely to ever return to, it’s probably a good idea to just to delete the account. As long as you’re already using a password manager with randomized passwords — you’re not re-using passwords — you don’t have to worry about the service having a security incident that puts your other accounts at risk. That’s not what deleting the account is about. Instead, you’re reducing the exposure of your email address and any other personal details that the service may have about you.
3. Update Account Email Addresses — If you’ve switched email addresses over the years, you may have some old accounts that are associated with an email addresses that you no longer have access to or simply don’t want to use anymore. In my case, I used to use Gmail and eventually migrated to using an email address with my own domain through Fastmail. Even though I have Gmail setup to forward messages to my current email address, I’d prefer to no longer use Gmail at all. So for any account that still uses Gmail, I’m slowly switching the associated email address to my current one.
4. Enable Two Factor Authentication for Accounts — If you’re using a password manager, it may very well offer a reports-type feature that will list all of the accounts you have that support two factor authentication where it doesn’t appear to be enabled. Vaultwarden and 1Password both offer this, for sure. Two factor adds an additional layer of security to each of your accounts, which will help prevent malicious actors from gaining access, even if your password becomes compromised.
5. Improve Weak Passwords — Another item that your password manager should be able to help with. Ensure you’re using sufficiently strong passwords to prevent brute force attacks.
6. Check for Missing Backup Codes — If you have an account with two factor authentication enabled, the service most likely offers backup codes that can be used in case you lose access to your authentication app. If you don’t have these backup codes saved, you risk getting locked out of your account.
7. Store Backup Codes Outside of Your Password Manager — It’s easy to drop these codes into the notes section of your password manager, but it’s much better to store them in a separate location. You could save them on a thumb drive and/or print a physical copy and keep those items in a fireproof safe. Perhaps even in a safe at a close friend or family member’s house. Just make sure they aren’t exclusively stored in the same place as where you’re generating two factor authentication codes, which would give you a single point of failure.
8. Move Two Factor Authentication to a Separate App — I recently polled my followers on Mastodon and the plurality of respondents just use their password manager to generate two factor codes. It is much more convenient and most password managers offer the feature. But it does come at the cost of some security. If you want to go above and beyond in securing your accounts, you can generate your two factor authentication codes using a separate app. I’ve heard good things about Ente Auth and 2FAS — if you wanted to go down this route, I’d start with one of those.
9. Setup an Emergency Plan — How could you ensure that someone else had access to your accounts if something happened to you? It’s not pleasant to think about, but it’s something that has to be considered at some point. Bitwarden offers an Emergency Access feature for just these circumstances, but another option would be to share the login credentials of your password manager with your spouse or a family member that you can trust.
10. Consider a Backup Solution — This is more applicable for those that are self-hosting their passwords and less relevant for cloud-based solutions. But may be worth the trouble if you wanted to prepare for the unknown. I don’t have any specific recommendations for how to store those backups, but taking into consideration the 3-2-1 backup guidelines — three copies, two different storage media, one being offsite — is a good start. And given how sensitive the data is, be sure the backups are encrypted. Your password may offer the option to encrypt an export file or you could encrypt it yourself with another tool — Bitwarden has some information about this that may be useful.