Why You Need This Now
By the end of this curriculum you'll have accounts at: Privacy.com, Proton Mail, Vultr, ChatGPT, and possibly more. Each one needs a unique, strong password. If you reuse passwords or keep them in a text file, you're building on sand.
Bitwarden is:
- Free for personal use
- Open source (you can audit the code)
- Self-hostable if you want to go further later
In this lesson you'll set it up on your phone only — no browser extension, no desktop app. The next section explains why.
Why Your Phone, Not Your Computer
Browser extensions and autofill live on the same machine where you run AI tools. If you give an AI agent broad access to your computer — screen control, browser automation, shell access — a password manager extension is within its reach. One prompt injection or one misconfigured permission, and every credential in your vault is exposed.
Your phone is a separate device. It's a natural air gap that no computer-side AI agent can cross. When you look up a password on your phone and type it into your computer, you're adding a small friction that buys real security.
This isn't paranoia — it's the direction the industry is heading. Companies like 1Password and Google are actively building guardrails around AI-agent access to credentials, precisely because this threat is real and growing.
The rule is simple: passwords stay on your phone, not on your computer.
What to Do
- Go to bitwarden.com on your computer and create a free account
- Choose a strong master password — this is the one password you memorize. Make it long (4+ random words) rather than complex. Pick random words like
correct-horse-battery-staple— length beats complexity - Install the Bitwarden mobile app on your phone (iOS / Android)
- Log in on the mobile app with your new account
- Enable two-factor authentication on your Bitwarden account (Settings → Security → Two-step Login)
How to Use It Day-to-Day
Logging into a website: Open Bitwarden on your phone, search for the entry, tap the eye icon by the password to see it, then type your username and password into the username and password fields.
Creating a new account: Open the Generator tab in the mobile app. Generate a password (20+ characters), copy it, and paste it into the signup form on your computer. Then save the new entry in Bitwarden on your phone.
Yes, this is slower than autofill. That's the point — the friction is the feature.
Back Up Your Vault
If you lose your phone, you can still get to your passwords from a browser by logging into bitwarden.com. A second line of security is to store an encrypted backup on hardware that's usually offline.
- Log into your Bitwarden account at bitwarden.com from a browser on a trusted computer
- Go to Tools → Export vault
- Choose .json (Encrypted) as the format
- Choose Password protected (not "Account restricted") — this lets you import the backup into any Bitwarden account
- Enter a strong password for the export and save the file
- Move the export file to an external drive (USB stick, SD card) and then delete the file from the computer
- Log out of Bitwarden in the browser
Store the drive somewhere physically safe. Do this periodically as you add new entries. This is your "break glass" backup.
Test It
Before moving on, verify the full workflow end to end:
- Save a login entry in Bitwarden on your phone (use your Privacy.com login from the previous lesson)
- Lock the Bitwarden app
- Reopen it and authenticate with your master password
- Find the Privacy.com entry and reveal the password
Tips
- Create a folder called "OpenClaw" in Bitwarden to keep all curriculum-related logins organized
- Your master password is the only one you need to remember — consider using the memory palace technique to memorize it (ask ChatGPT about this)
- If you already use 1Password, KeePassXC, or another password manager you trust, that's fine — but consider the phone-only approach for the same air-gap benefit
When You're Done
- Bitwarden account created
- Mobile app installed
- Two-factor authentication enabled
- "OpenClaw" folder created
- Privacy.com login saved in Bitwarden
- First encrypted backup exported