How to choose a password manager
A password manager is the single biggest step you can take for your online security. Here's what matters when choosing one, and what doesn't.
Why you need one
The only safe password is a long, random one that you use for a single site. Nobody can remember dozens of those, so without a manager people end up reusing passwords, and one breach then unlocks every account that shares it. A password manager remembers them for you, fills them in, and warns you when a site you use has been breached.
The main kinds
- Built into your browser or device (for example Apple Passwords or Google Password Manager). Free, already there, and far better than reusing passwords. The trade-off is that they work best inside one company's ecosystem.
- Dedicated cloud password managers (for example Bitwarden or 1Password). They work across every browser and operating system, sync between devices, and usually add secure sharing, breach alerts and emergency access.
- Local, offline managers (for example KeePassXC). Your vault is a file you control and sync yourself. Maximum control, but backups and syncing are your job.
What actually matters
- End-to-end encryption. Your vault should be encrypted on your device with a key only you have, so the company can't read it even if its servers are breached. Look for "zero-knowledge" or "end-to-end encrypted".
- Independent security audits, published, and recent. Open-source code is a bonus because anyone can check it.
- Works everywhere you do: every browser, phone and computer you use, with reliable autofill.
- Passkey support, so it can store passkeys as well as passwords as sites adopt them.
- Two-factor authentication on the vault itself.
- A recovery plan: emergency access for a trusted person, or a recovery kit you store safely offline.
- Export: you should be able to take your data with you if you ever switch.
Features like dark-web monitoring and built-in VPNs are nice extras, but they matter far less than the points above.
Your master password
Everything depends on the one password that unlocks the vault. Make it a random passphrase of seven or eight words, never use it anywhere else, and write it down somewhere physically safe until you know it by heart. See passphrases vs. passwords for why.
Switching safely
- Install the new manager and secure it with a strong master password and two-factor authentication.
- Import your passwords from your browser or old manager, then delete the export file; it isn't encrypted.
- Start with your email account, because it can reset everything else. Give it a new random password.
- Then work through banking, shopping and social accounts, replacing any reused or weak passwords as you go.
- Turn off password saving in your browser once everything is in the manager, so you have one source of truth.