Password Managers and 2FA for Indians: A Practical Guide

The password you use for your bank is probably also the one you used for a food delivery app in 2019, a job portal in 2021, and a site that has since been breached. Attackers know this; they take leaked lists and try every email-and-password pair against banks, UPI apps and Gmail. Choosing a password manager India users will keep using is the way out, and it takes an evening to set up.

This guide is practical rather than theoretical: which manager to use, how to start without changing 200 passwords at once, which two-factor method to pick for each kind of account, and how to avoid the lockout that stops most people from turning any of this on.

Why a password manager India users will stick with matters

The attack is called credential stuffing. A site you used years ago leaks its user list. The list is sold. Software tries each email and password on hundreds of other sites. Where you reused the password, the attacker is in. No phishing, no malware, no SIM swap; just your own habit. The defence is a different password on every site, which no human can remember, which is why a manager exists.

A manager generates a long random password for each site, stores it encrypted behind one master password, and fills it in when you visit the real site. That last part is an anti-phishing control in itself: on a lookalike bank page, the manager will not offer the password, because the address is wrong. That pause is often the moment people realise something is off.

Which one

Pick the one already on your phone unless you have a reason not to. The best manager is the one you will actually use, and the built-in ones remove the barrier of installing anything.

How to start without drowning

Do not try to change every password on day one. Change four: your main email, your net banking, your UPI app login, and the manager's own master password. Make the master password a sentence of four or five unrelated words that you can type but nobody could guess. Then, over the next month, let the manager capture passwords as you log in to other sites, and change the ones it flags as reused or breached. Open passwords.google.com and run Password Checkup to see which those are.

Two-factor authentication, ranked

Two-factor authentication means a second proof after the password. In India, "2FA" usually means an SMS OTP, which is the weakest form. Here is the ladder, from bottom to top.

1. SMS OTP. Better than nothing, but a SIM swap or an SMS-reading malware app delivers the code to the attacker. Most Indian banks and government portals still use it, so you cannot avoid it; you can protect the SIM. How SIM swap works explains what to watch for.
2. Email OTP. Only as strong as the email account, which is why the email account gets the strongest protection of all.
3. Authenticator app. Google Authenticator, Microsoft Authenticator, Aegis, Authy and others generate codes on your phone with no network involved. SIM swap does not affect them. Use this wherever a site offers it, including Instagram, Facebook, Gmail and most international services.
4. Passkeys. A cryptographic key stored on your phone or laptop, unlocked by fingerprint, face or PIN. It only works on the real site, so phishing pages get nothing. Supported by Google, Apple, Microsoft, WhatsApp, Instagram and a growing list. Where offered, this is the one to choose.
5. Hardware security keys. A small USB or NFC device that holds the key. The strongest option, used by people who are deliberate targets; unnecessary for most personal accounts.

Avoiding the lockout

The reason people turn 2FA off, or never turn it on, is the fear of a lost phone. The fear is reasonable; the fix is a few minutes of preparation.

If a phone is lost or stolen, the sequence is: lock it remotely (Find Hub on Android, Find My on iPhone), block the IMEI on CEIR, get a replacement SIM from the operator, and restore the manager and authenticator on the new phone from backup. With the preparation above, that is an afternoon. Without it, it is weeks of recovery forms.

Setting this up for parents and a small team

For a parent, the built-in manager on their phone plus 2FA on their email and WhatsApp is enough, with you holding a copy of the backup codes. Family plans on paid managers let you see that passwords exist without seeing the passwords. For a small business, the same logic applies with one addition: shared logins (the company Instagram, the GST portal, the bank's corporate login) go into a shared vault with access removed the day someone leaves. Our small business guide covers the rest of that setup.

Start tonight with the four passwords and the Google 2-step page. Do the backup codes while you are there. Everything else can follow over the month, and the personal cyber safety checklist has the remaining phone settings when you are ready. If you want it done with you, in one sitting, our device and privacy audit includes the manager and 2FA setup for every account on the phone.