Password managers: what to check before you commit

Everyone tells you to use one, nobody tells you how to choose, and the choice is unusually hard to reverse. A password manager is software that generates, stores and fills your credentials behind a single key you control, and picking one means deciding where the most sensitive file you own is going to live for the next decade.

The feature lists are nearly identical, which is why comparing them is useless. What separates these products is what happens in four situations you hope never to be in.

The four situations that decide which password manager

Not the interface. These.

• You forget the master password. Some vaults are unrecoverable by design, some offer an emergency kit, some let an administrator reset it.
• The company is breached. What the attacker gets depends entirely on where decryption happens.
• The company shuts down or is sold. Can you take everything out in a format something else reads?
• You lose the device with the only session on it. Is there a second way in that you set up in advance?

Answer those four before comparing anything else, because every product has autofill and a browser extension, and only some of them have good answers here.

"We take security seriously" is on every homepage. "We cannot read your vault even if compelled to" is an architecture, and it is either true or not.

Zero-knowledge is the one technical term worth learning

It is the difference between a breach that is embarrassing and a breach that is catastrophic, and it is a property you can check.

In a zero-knowledge design, your vault is encrypted and decrypted on your device. The provider stores a blob it cannot read, because the key is derived from your master password and never sent. A breach of their servers yields encrypted data, which is why the well-run providers publish exactly this when it happens.

The alternative is a service that decrypts on the server so it can offer features that need to read your data. That is not automatically negligent, but it means their breach is your breach, and it means a subpoena or a rogue employee reaches your credentials.

Two things follow that people get wrong:

In a password manager, your master password is doing all the work. In a zero-knowledge system there is no reset, because there is nothing to reset with. A weak master password weakens everything, and it is the one password you cannot store in the password manager.

A published audit is meaningful, a claim is not. Look for a third-party security audit with a date and a report you can read. A page describing encryption in general terms is marketing copy.

Does it matter where the vault is stored?

Three models exist and the trade is convenience against exposure.

Provider cloud. Sync everywhere, works on a new device immediately, and your encrypted vault sits on someone else's infrastructure. With zero-knowledge this is a reasonable trade and it is what most people should use.

Your own cloud storage. The vault file lives in your storage; the app reads and writes it. Fewer parties, and you inherit the sync problems — two devices editing at once can produce a conflict, and conflict resolution on a vault file is unpleasant.

Local only. Nothing syncs, nothing leaves. Genuinely the most private and the least survivable: a lost phone with no backup is a lost vault, permanently.

The middle option is where people who care about this often land, and it is worth being honest that it trades a well-tested sync implementation for one you now operate. If you have ever had a conflicted copy of a file, you know the failure mode.

What about the one built into your browser or phone?

For a lot of people it is genuinely enough, and dismissing it is a mistake the enthusiast advice makes routinely.

The built-in managers now generate strong passwords, sync across a vendor's devices, warn about reuse and check against breach databases. If everything you own is from one vendor and you have no need to share credentials, that covers the actual threat — which is password reuse, not a sophisticated attacker.

Where the built-in option runs out:

• You use more than one ecosystem. An iPhone and a Windows desktop is where cross-platform managers earn their price.
• You need to share. Family and team vaults with separate keys are not something built-in tools do well.
• You store more than passwords. Recovery codes, licence keys, documents.
• You want your own export. Getting credentials out of a vendor's ecosystem is possible and awkward.

Our note on best tools covers the general case of when the built-in option is enough, and it applies here more than people expect.

What it costs, and what the free tier really is

Pricing is where the comparison gets deliberately confusing, and three patterns cover it.

Free with one-device sync is the common shape, and it is a trial rather than a plan. A password manager that works on your phone but not your laptop will be abandoned within a fortnight, because the friction lands exactly where you need it least.

Free and genuinely cross-device exists, usually open-source, often self-hostable. The trade is that support is a community rather than a company, and the recovery story is yours to build.

Paid, roughly the price of a coffee a month, per person or per family. The family tier is usually much better value and is the version worth pricing, since credential sharing between two people is otherwise done over messages.

What is not worth paying for: dark-web monitoring, "security scores", and most bundled extras. They are real features and they are not why you are here. Judge on the four situations, then let price break a tie.

Moving in, without a bad afternoon

Moving into a password manager is where this goes wrong, because the instinct is to change every password at once.

1. Import what you have from the browser first. It is a CSV, it takes a minute, and it gives the vault a shape.
2. Delete the CSV afterwards, properly. A plain-text file of every password in the downloads folder is the worst artefact this process creates.
3. Fix the top 10 accounts, not all 200. Email first, then anything with a payment method. Email is first because it is the reset path for everything else.
4. Let the rest change as you use them. A password you have not needed in a year does not need rotating today.
5. Set up recovery on day one — the emergency kit, the second device, the recovery code. Not later.

Step 5 is the one that gets postponed and the one that matters. A vault you cannot get back into is not more secure, it is destroyed. And step 3's ordering is not arbitrary: whoever controls the email controls the accounts, which is covered in reviews and in the alternatives guide when you decide to move again.

The relevant standard for how a master password becomes a key is OWASP's password storage guidance, and a provider that documents its key derivation against it is telling you something specific rather than something reassuring.

The short version

Choose a password manager on the four situations, not the features. Insist on zero-knowledge with a published audit, set up recovery before you need it, and check the export works while you still like the product.

And if you use one vendor's devices exclusively and only need passwords, the manager already on your phone is a defensible answer that costs nothing.