Password managers are like vegetables on the internet. We know they are good for us, but many of us prefer the convenience of using simple and easy-to-remember passwords like “123456” and “password”, which are also the most common passwords. However, most of us do not know how to create strong passwords and cannot remember multiple complex passwords. The best (though unrealistic) way to store passwords is to memorize them, but most people need the help of a password manager to securely store and manage their passwords. Password managers make it easier to use better passwords and protect against password-based attacks. They also offer convenience and can help secure your online information. You can also use a virtual private network (VPN) and make backups of your data to improve your online security and protect against potential data loss.
Why Not Use Your Browser?
Most web browsers have a basic password manager that stores your passwords when you are asked if you want to save a password (for example, when using Google Chrome or Mozilla Firefox). This is better than using the same password for all your accounts, but browser-based password managers have limitations. In recent years, Google has improved the password manager in Chrome, but it is still not as advanced or widely supported as dedicated password managers. Security experts recommend using a dedicated password manager because they focus solely on password management and have added helpful features over the years. These features may include the ability to generate strong passwords and support for various devices and platforms. Apple’s MacOS password manager, called Keychain Access, works well and syncs through iCloud with Safari, but it is only available for Apple devices and cannot sync with non-Apple devices. If you only use Apple devices, this is a free and viable built-in option to consider.
Passkeys, FIDO, and the ‘Death of the Password’
The FIDO Alliance is an industry group that is trying to get rid of passwords by standardizing online authentication methods. Apple, Google, and Microsoft have all implemented the FIDO protocols in their systems, which use cryptographic keys instead of passwords. These keys, called passkeys, are generated by the user’s device and stored in a central location, so the user doesn’t have to remember them. However, passkeys are currently only supported by a few websites and services, and they rely on a single device or company to manage them, which could be a security risk. While passkeys are an improvement over traditional passwords, it may be safer to stick with a password manager for now.
1Password is a password manager that offers a number of extra features, such as alerts for weak or compromised passwords and the ability to delete sensitive data from devices before traveling. It has apps for multiple operating systems, including Windows, MacOS, iOS, Android, Linux, and Chrome OS, as well as browser plugins. It can also act as an authentication app and has a feature called Travel Mode, which allows users to delete and restore sensitive data when crossing national borders. In addition to managing passwords, 1Password offers integration with other apps and can autofill passwords. However, it has recently had some issues with its new version, 1Password 8, on MacOS and has reduced its free trial period. It also offers a secret key to the encryption key used for added security, but if this key is lost, the passwords cannot be decrypted.
Best Free Option
Bitwarden is a password manager that is both secure and free to use. It’s open source, which means the code can be examined and improved by anyone, and it has been audited to ensure its security. It’s available on a variety of platforms including Android, iOS, Windows, MacOS, and Linux, and can be installed on your own server for self-hosting. It offers a semiautomated password fill-in tool, and also supports fully automated form-filling. Bitwarden has a paid upgrade called Bitwarden Premium, which costs $10 per year and offers additional features such as encrypted file storage and two-factor authentication.
Best Full-Featured Manager
Dashlane is a password management service that helps you keep track of your passwords and personal information. It has apps for iOS and Android, as well as extensions for popular web browsers, so you can use it on a variety of devices. Dashlane offers a feature called Site Breach Alerts, which monitors the internet for leaked or stolen personal data and alerts you if your information has been compromised. It also offers a secret key encryption system to protect your passwords. Dashlane doesn’t have a desktop app, but it does offer a 30-day free trial to test out the service before committing.
Best DIY Option (Self-Hosted)
In simple terms, KeePassXC is a password management tool that allows you to securely store and manage your passwords. Instead of relying on a hosted service to sync your password database, you can use a file-syncing service like Dropbox to do it yourself. This allows you to have more control over your data in the cloud. KeePassXC uses encryption to keep your password database secure and can be accessed on any device with the KeePassXC client. One of the benefits of using KeePassXC is that it is open source, meaning that its code has been inspected for security vulnerabilities.
NordPass is a password manager that helps users keep their login information secure. It offers apps for various devices and browsers and has a feature that allows users to store personal information, such as addresses and phone numbers, in a secure location. NordPass also has a feature that allows users to grant emergency access to their account to trusted friends or family. It uses a zero-knowledge setup, which means that data is encrypted on the user’s device before being uploaded to the company’s servers. The free version of NordPass is limited to one device, but there is a premium version with syncing available for a fee. NordPass also supports two-factor authentication and has a built-in password generator.
Password managers are not a one-size-fits-all solution. Our top picks cover most use cases and are the best choices for most people, but your needs may be different. Fortunately, there are plenty of good password managers. Here are some more we’ve tested and like.
- Roboform ($24 Per Year, $48 Per Year for Five-User Family Plan): Roboform has most of same features as the rest in this list, but it lacks some of the things that differentiate our top picks, like the travel feature of 1Password or the open source aspect of Bitwarden. I’ve been testing the free plan for a while and haven’t run into any problems. There are apps for every common platform, and it’s easy to use. That said, Roboform hasn’t published a full, independent security audit.
- Enpass (Free, $24 Per Year or One-Time $80 for Premium): Like KeePassXC, Enpass does not store any data on its servers. Syncing is handled through third-party services like Dropbox or NextCloud. Enpass doesn’t do the syncing, but it does offer apps on every platform. That means once you have syncing set up, it works just like any other service. And you don’t have to worry about Enpass being hacked, because your data isn’t on its servers. If you’re comfortable setting up the secure syncing yourself, Enpass makes a great password manager.
- LastPass ($36 Per Year): LastPass used to be our favorite free option, but then it changed its free plan. It now limits you to a single device, so we removed it in favor of BitWarden. Lastpass’ paid plan offers most of the same features you’ll find in our other top picks, though it lacks the travel features of 1Password and isn’t open source like BitWarden. We just don’t see any reason to suggest it over our top picks. It has also been the target of a number of attacks over the years and was recently hacked again.
- Keeper Password Manager ($35 Per Year for Unlimited): Keeper offers a variety of security-related tools, including a password manager. Keeper works much like 1Password and others, storing only your encrypted data, and offers two-factor authentication for logging in to your account. Like Dashlane, Keeper has a lot of extras, including dark-web monitoring, meaning it will check publicly posted data to make sure yours isn’t available.
- Pass (Free): Pass is a command-line wrapper around GPG (GNU Privacy Guard), which is to say, this is only for the nerdiest of users. It has support for managing encrypted .gpg files in Git, and there are third-party mobile apps available. It’s definitely not for everyone, but since everyone asks, it’s what I use.
How We Test
password managers are a type of software that helps you securely store and manage your passwords and personal information. They use strong encryption to keep your data safe and can be accessed through apps on different devices. Some password managers also offer additional features such as alerting you if your password has been compromised or allowing you to easily switch between multiple accounts. It is important to choose a reputable and secure password manager to ensure the protection of your data.
Password Manager Basics
A password manager is a tool that helps you securely store and manage your passwords. It lets you only have to remember one password, which is used to unlock the password manager’s “vault” containing all of your actual passwords. The password manager also has apps or browser extensions for different devices and can generate, store, and update passwords for you. It can also alert you to potentially compromised passwords and make it easier to change them. Password managers can be cloud-based, which means they store your encrypted passwords on a central server, or they can be desktop-based, which means you have to sync your password database yourself using a file-syncing service. It’s important to make sure your master password for the password manager is strong and to disable the auto form-filling feature for added security. If a password manager’s servers are hacked, your data should still be safe because it is encrypted and the encryption key is not stored.