Step by step

Coming next

Entries queued, in the order the Floor needs them. Each gets the same shape: tested-on line, click path, reported differences.

Set up Bitwarden, from nothing

Why this order: the passphrase exists before the account, so it's chosen by chance instead of under a signup form's time pressure; the second factor and recovery code go on paper the same hour, because a vault can't hold the key to itself.

1. Get your words first. Four or five random words, chosen by chance. Best: dice against the EFF long wordlist (eff.org/dice) — five rolls per word, look up the number. Acceptable: Bitwarden's free generator page on bitwarden.com, passphrase mode. Take the words as they fall; the urge to swap one for a better one is exactly the predictability you're removing.
2. Paper, now. Write the passphrase down, twice. One copy where you live; one sealed with someone you trust. This is the backup; your memory is the primary.
3. Create the account at bitwarden.com with your identity email — the address you're protecting hardest. Bitwarden emails you a verification link first; it expires quickly and only works in the browser that started the signup — which is why the words are already on paper before you click it. Master password: the words. Confirm them. Leave the hint field blank. A hint that would help you helps whoever is guessing; the paper is your hint.
4. Pick an authenticator app, if you don't have one. Ente Auth (iOS, Android, desktop; works offline, optional end-to-end encrypted sync so a lost phone isn't a lockout), Aegis (Android, offline only) and 2FAS (iOS and Android) are open source; Proton Authenticator is too, and the natural pick if you're already on Proton — though that puts your second factors with the same company as your mail and aliases. Bitwarden Authenticator is fine too. Whichever: it's a separate app with its own storage, not the vault, which is the only rule that matters here. Install it from the app store by name; the QR code advertising it is just a link to the store drawn as a picture, and you can ignore it.
5. Turn on two-step login. Web vault → Settings → Security → Two-step login → Authenticator app. The QR code on this screen is the secret itself: scanning it copies the code-generating key into your app, nothing is transmitted, and the only risk is someone else photographing the screen — so do it in private and don't screenshot it. Every such screen also offers "enter the key manually" if you'd rather type. The recovery code it shows you — groups of four characters — goes on the paper, spaces and all: when it's needed, it has to be typed with the spaces between groups, never inside the vault. Skip the Email method: it's the weakest channel, and every extra method is an extra door.
6. Hardware key, optional, for people who could be targeted. A FIDO2/WebAuthn key (YubiKey, Google Titan and the like) works on Bitwarden's free tier under the same Two-step login menu and can't be phished. It's a physical object — the menu will ask you to plug it in or tap it, and there's nothing to do here without one in hand. Buy two, in the port shape your devices actually have; register both; one lives somewhere safe. The authenticator app from step 5 is already a complete second factor, so coming back to this later costs nothing. The "YubiKey OTP" and "Duo" options on that screen are the paid tier and add nothing you need.
7. Settings → Security → Keys: choose Argon2id, keep the defaults. This is the key-derivation function — the deliberately slow math that turns your passphrase into the real encryption key. Slow is the feature: every guess an attacker makes has to pay the same cost. The two choices differ in what the cost is. PBKDF2 has one knob, iterations (600,000 by default): pure time, which a cracking rig full of GPUs parallelizes cheaply. Argon2id adds a memory cost, so each guess must also hold a chunk of RAM — and a GPU has thousands of cores but not thousands of separate scratchpads. That memory-hardness is why OWASP recommends it and why we do. Its three knobs: memory (RAM per guess — the one that hurts attackers most), iterations (passes over that memory — a time multiplier), and parallelism (threads your device uses to compute it — helps you log in faster, doesn't help the attacker; set it near your core count). Bitwarden's Argon2id defaults are 32 MiB, 6 iterations, 4 threads. Keep them. If every device you unlock on is reasonably modern, memory to 64 MiB is a free upgrade; above 64, iOS autofill shows a warning every time it fills, so stop there. Changing this doesn't log you out or alter your vault. The honest sizing logic: the passphrase is the defense and the KDF is the seatbelt — dice words plus default Argon2id already exceeds what any realistic attacker will spend, and tuning beyond that is a hobby, not security. Checked against Bitwarden's KDF documentation, September 2026.
8. Install the apps and the browser extension on every device, and live in those rather than the website. Then set the timeout on each one — it's a separate setting per app. Look for Session timeout or Vault timeout (the name varies by version; in the web vault it's under Settings → Security). Set the action to Lock, not Log out: locked, your words open it; logged out, you're back to email, words, and a verification code. On the phone, a few minutes with biometric unlock; in the browser, lock on browser restart. Closing a website tab usually logs you out whatever you set — another reason to use the extension.
9. Move the five accounts that matter — email, bank, phone carrier, Apple or Google account, one social — generating a new password for each from the vault's generator. The rest migrate over the month as the extension prompts you. Save before you submit: generate the password in the vault item and save the item first, then paste it into the site's change-password form — if the site accepts a password the vault never saved, it's gone. Password, not passphrase: in the generator, pick Password, length 20 or more, and leave the minimum-numbers and minimum-special-characters settings at their defaults — length does the work, and raising the minimums adds almost nothing. Passphrases are for the few things you type from memory (this vault, your computer login); everything the vault holds gets pasted, so it can be gibberish. If a site rejects the symbols, turn special characters off and make it longer. The "Authenticator key" field: leave it blank. It's for storing a site's two-factor secret inside the vault; on the free plan it won't show codes, and keeping second factors in a separate authenticator app keeps both keys off the same ring.
10. Organize as you go — names, websites, folders, notes, re-prompt. Name is for your own search; autofill ignores it. Use Service — what it is: "Proton — identity", "Chase — checking". Two logins on one site get told apart here ("Gmail — old shopping"). Website goes in the URI field, always: it's what the extension and phone apps match on to offer a fill, and the default rule ("base domain") means chase.com covers its login pages. This is also your phishing alarm — on a lookalike domain the vault offers nothing, and that silence is the warning. Folders: few, flat, optional; search does most of the work. If you want them, five at most — Identity, Money, Work, Everyday, and To fix, where every account with a reused or breached password lives until it's been changed; the goal is an empty folder within a month. Nest by naming with a slash ("Money/Banks") if you must. Notes are encrypted, so they're the place for security-question answers (make them random words, not true answers), the carrier PIN, which address is the recovery email, the date you set it up; recovery codes for other services go in a Secure Note item. A custom field of the "hidden" type beats notes for anything you'll paste often. Two things never go in the vault: its own master passphrase and its own two-step recovery code — those are the paper. Master password re-prompt, a switch on each item: turn it on for identity email, bank, carrier, Apple or Google, anything government; leave it off elsewhere. It makes that one item ask for the passphrase even when the vault is already unlocked — protection against the unlocked laptop in a café or a borrowed phone, not against someone who has the passphrase, and it doesn't apply to exports. The short vault timeout in step 8 is still the real lock. Bitwarden’s documentation says re-prompt takes the typed master passphrase only, not a PIN, face or fingerprint.
11. Type the passphrase five or six times today so it lives in your hands. Then unlock the vault with it once more before bed. If it isn't in your hands by tomorrow, the paper is right there — that's what it's for.

Email aliases with Proton Pass

Why: one address per service means a leak tells you exactly who leaked it, and you can switch that one address off without touching anything else. A single address everywhere is what lets brokers stitch your accounts together.

1. Open Proton Pass (pass.proton.me, same login as your Proton Mail) → + Create item → Alias. An upgrade screen may appear along the way; it's an offer, not a requirement.
2. Title — your label for the item. Same convention as your password manager: Codeberg — account, Library — card. Heads up: Proton copies the title into the prefix automatically, so Codeberg — account becomes codeberg-account.randomwords@… unless you change it in the next step.
3. Prefix — the part before the random words and the @, and it's visible to whoever receives mail from it. Proton fills it in from your title; there's an option on the same form to edit it. For ordinary services, the service name is right: when spam arrives at that address, you know who sold it. For sensitive services, change it to something neutral before saving — if the address is ever seen or leaked, it shouldn't announce the relationship. Never your real name.
4. Note — which account uses it and the date. Future you will thank you.
5. Save, then use it. Sign up with the alias, and put the alias in that account's password-manager entry as the username, so the two never drift apart.

Reuse: don't. One alias, one service. A shared alias loses both things that make aliases worth having: you can't tell who leaked it, and you can't turn it off without breaking the other accounts. With a ten-alias ceiling on the free plan, spend aliases on the accounts that matter or are likely to leak (shopping, anything with a mailing list, developer platforms); for throwaway signups, plus-addressing (yourname+store@proton.me) is free and unlimited, though it shows your real address before the +.

Before you ever delete an alias: move the account to a different address first. The alias is where password resets go; deleting it locks you out of whatever uses it. Disable stops the mail and can be undone — use that for spam, delete only for accounts already closed or moved.