Password Managers

The problem a password manager solves is arithmetic. Secure accounts need long, unique, random passwords. A person has somewhere between fifty and three hundred accounts. Those two facts cannot both be satisfied by memory, so almost everyone quietly resolves the conflict by reusing passwords — which is precisely the behaviour that turns one site's breach into a compromise of your email, your bank and your work accounts.

A password manager resolves it properly: one strong secret you remember, and unique credentials everywhere else that you never have to.

How they work

Your vault is encrypted on your device with a key derived from your master password. What the provider stores is ciphertext. This is what "zero-knowledge" means — the provider cannot read your data, cannot hand it to anyone, and cannot recover it for you if you lose your master password.

That last consequence is not a footnote. It is the single most important thing to understand before you start: there is usually no password reset. Providers offer recovery mechanisms — recovery codes, emergency contacts, account recovery through an organisation — but they are things you must set up in advance. Do it on day one, before the vault holds anything you cannot afford to lose.

What actually differentiates them

Most reputable managers are more alike than the marketing suggests. The differences that change daily experience:

Autofill quality. This decides whether you still use it in three months. Does it fill reliably in your browser, in mobile apps, in awkward multi-step corporate logins? It is the thing to test hardest in a trial and the thing comparison tables measure worst.

Platform coverage. Not just "does it have an app", but whether the experience holds up on the specific mix you use — a Windows desktop and an iPhone, a Mac and an Android tablet, a Linux machine, a browser you prefer.

Sharing. Families share streaming and utility logins; teams share service accounts. Whether sharing is included, and how granular it is, varies significantly.

What else it stores. Payment cards, addresses, secure notes, documents, software licences, recovery codes. Two-factor codes too, though there is a live debate about whether keeping your second factor in the same vault as your password defeats part of the purpose. Convenience against isolation is a real trade-off; there is no single right answer, but you should make the choice deliberately.

Passkey support. Passkeys replace passwords with a key pair unlocked by your device. They are being adopted steadily, they need somewhere to live, and how well a manager stores and syncs them across platforms is now a genuine differentiator.

Auditability. Independent security audits, published results, a clear disclosure record and — for some products — open-source code that anyone can inspect. None of these guarantee safety. All of them are better than a claim on a marketing page.

Self-hosting. A minority option, but for people who want the encrypted vault on infrastructure they control, it exists and it is a genuine differentiator.

Choosing well

Ask, in this order:

1. Which devices and browsers must it work on, well? Rule out anything that treats one of your platforms as an afterthought.
2. Who else needs access? A partner, a family, a small team. This decides free versus paid faster than any other question.
3. Do you want passkey support? If you are adopting passkeys, make it a requirement.
4. How do you plan to recover? Look at the actual mechanism and confirm you can live with it.
5. What does the vendor publish about its security? Audits, architecture, incident history.
6. How do you get out? Every reputable manager exports to a portable format. Confirm it before you import a decade of credentials.

What it costs

Individual plans typically cost a few dollars a month, with family plans covering several people for not much more than a single one — which makes the family tier the obvious buy for a household. Business plans are priced per user and add administration, provisioning and policy controls.

Free tiers are common and some are genuinely good. The limits are usually sync across device types, sharing, emergency access, and storage for files.

Getting started without the painful week

The migration is the part people dread and it is easier than expected:

1. Choose a master password you can actually remember — a long passphrase of several unrelated words beats a short, complicated string.
2. Turn on two-factor authentication for the manager itself, immediately.
3. Set up recovery, and store the recovery code somewhere physical.
4. Import from your browser rather than typing anything in.
5. Do not try to change every password at once. Change the important ones first — email, banking, work — and let the rest update naturally as you sign in over the following months.

Email first, always. Whoever controls your email can reset almost everything else.

Working out what to use

These start from a situation rather than a product. All prices come from the vendors' own pricing pages with the date they were checked, and where a vendor did not display a price we say so rather than estimating one.

• The best free password manager — two free plans include unlimited devices, one is single-device, and that difference decides it.
• The best password manager for a small business — the problem is offboarding, not storage.
• The best password manager for a family — seat counts run from five to ten, and recovery is the conversation to have first.

Choosing between two products

• 1Password vs Bitwarden — both are secure, so the tiebreaker is price against adoption.
• 1Password vs Dashlane — neither is free, and the real split is five seats against ten.
• LastPass alternatives — three reasons to leave, three destinations, and how to migrate without leaving a plain-text copy behind.

Understanding the category

• Are password managers safe? — the concentration objection taken seriously, and what zero-knowledge encryption really buys.
• How to choose a password manager — six questions in the order that actually eliminates options.
• Is it safe to save passwords in your browser? — better than reuse, worse than a manager, and running both is worst of all.
• Passkeys vs passwords — what actually changes, and why portability is the open question.

Where to go next

Our buying guides go deeper on choosing, and comparisons cover specific products head to head. If you take nothing else from this page: the switch matters more than the choice. Almost any reputable manager, used consistently, leaves you dramatically safer than the best one you never got round to setting up.