How to choose · Privacy tools
How to choose a password manager
Last updated 25 October 2026 · 3 sources listed · Reading time about 3 minutes
Short answer
Choose a password manager on its security design, recovery model and everyday usability. Look for zero-knowledge encryption, strong account protection, independent security assessments, secure sharing, a clear recovery path and good browser and phone integration. A tool nobody uses because it is awkward gives less protection than a simpler one adopted consistently.
Who this is for: An individual, family or small team moving away from reused or written-down passwords who needs a vault they can trust and will actually use.
What to evaluate
Encryption and zero-knowledge design
The provider should be unable to read vault contents, so a breach of their servers does not expose your passwords.
How to check: Read the security whitepaper for how vaults are encrypted and where keys are derived.
Account protection
The vault is protected by one master secret, so its strength and the second factor guarding it are decisive.
How to check: Confirm support for hardware keys or authenticator codes and a long passphrase approach.
Independent assessment and transparency
Claims are worth more when outside testers have examined the design and the supplier explains past issues openly.
How to check: Look for published audit summaries, a vulnerability disclosure policy and honest incident write-ups.
Recovery and emergency access
Forgetting the master secret can mean permanent loss in a zero-knowledge system, while weak recovery creates an attack route.
How to check: Understand exactly what recovery options exist and set up an emergency contact or printed recovery kit stored safely.
Sharing and team controls
Families and teams need to share credentials without sending them over chat.
How to check: Test shared folders, role-based permissions and an audit log for business use.
Usability across devices
Autofill that fails on a phone or in an app drives people back to reusing passwords.
How to check: Test browser extensions, mobile autofill and offline access on every device you use.
Comparison
| Option | Good when | Watch out for |
|---|---|---|
| Dedicated cloud-synced password manager | You use several devices and want sync and sharing | Depends on one master secret and the provider's security practices |
| Local-only encrypted vault file | You want full control and minimal third-party trust | You handle backups and sync yourself |
| Browser built-in password storage | Convenience for a single browser ecosystem | Weaker sharing and cross-browser support, and exposure if the device is unlocked |
| Operating system keychain | Tight integration inside one device family | Poor portability across different platforms |
| Team or business vault | Need shared credentials, policies and audit trails | Administrative configuration and onboarding effort |
Decision worksheet
Rate up to three options against this guide’s own criteria. It runs in your browser and saves only on this device. It is a thinking aid, not a recommendation.
1. Have you checked each criterion?
0 of 6 criteria checked.
2. Compare options (0 = fails or unknown, 3 = meets it well)
| Criterion | |||
|---|---|---|---|
| Encryption and zero-knowledge design | |||
| Account protection | |||
| Independent assessment and transparency | |||
| Recovery and emergency access | |||
| Sharing and team controls | |||
| Usability across devices | |||
| Total (max 18) | 0 | 0 | 0 |
Questions to ask before you commit
- Can the provider read my vault contents under any circumstances?
- What happens if I lose my master password and my second factor?
- Are independent security assessments published, and how are findings handled?
- How do I export my data if I want to leave, and in what format?
- What breach or incident has the provider disclosed and how did they respond?
- Does the product support hardware security keys and passkey storage?
- For teams, can administrators recover accounts and see sharing audit logs?
Typical trade-offs
Cloud sync versus local-only storage
- Upside
- Sync gives convenience across devices and easier sharing.
- Downside
- Adds dependence on the provider and a larger attack surface than a file you control.
Easy recovery versus strict zero-knowledge
- Upside
- Assisted recovery protects people who forget their master secret.
- Downside
- Any recovery mechanism is also a path an attacker might try to abuse.
Browser-integrated storage versus standalone manager
- Upside
- Browser storage is frictionless and already present.
- Downside
- Standalone tools generally offer better cross-platform use, sharing and security controls.
Common mistakes
- Choosing a weak master password. Use a long, memorable passphrase and a second factor that is not stored in the same vault.
- Never testing recovery. Practise restoring access before you rely on the vault.
- Importing everything and leaving old reused passwords unchanged. Prioritise changing email, banking and identity accounts first.
- Storing the second-factor codes for the manager inside the manager itself, which defeats the purpose.
- Sharing a single vault login among family or team members instead of using proper sharing features.
Related questions
Is it safe to keep all my passwords in one place?
For most people, a well-designed password manager is safer than the alternatives, which tend to be reuse, simple patterns or notes. The risk is concentrated: if the vault is compromised, much is exposed. You reduce that risk with a long unique master passphrase, strong second-factor protection, patched devices and care about which devices are logged in. National cyber agencies generally recommend password managers for individuals and organisations.
What if the password manager company is breached?
With a zero-knowledge design, attackers obtain encrypted vaults, not readable passwords. Strength of your master passphrase and the provider's key-derivation settings then determine how hard cracking would be. Weak master passwords are the exposure. Good providers disclose incidents clearly and advise on actions such as changing the master secret and rotating critical passwords. Choose providers with a track record of transparent communication.
Should families or teams share a vault?
Use the sharing features designed for it. Individual accounts with shared folders let each person keep private items, apply permissions and revoke access when someone leaves. Shared login to one account removes accountability and complicates second-factor protection. For businesses, choose a product with administrative controls, policy enforcement and audit logs, and include vault access in joiner and leaver procedures.
How do passkeys relate to password managers?
Passkeys replace passwords with cryptographic credentials tied to a device or synchronised store, and they resist phishing. Many password managers now store passkeys, letting you use them across devices. During the transition you will still hold many passwords, so a manager remains useful. Check whether a candidate product supports passkeys and how they sync and recover, since that influences portability and lock-in.
Sources and further reading
These pages were reachable when we last checked. They informed definitions and rules referred to above; they do not endorse this guide. Where rules differ by country, check the authority for your location.
- Passwords: Password guidance — National Cyber Security Centre (UK), retrieved 27 October 2026
- Use Strong Passwords — Cybersecurity and Infrastructure Security Agency, retrieved 27 October 2026
- Digital Identity Guidelines — National Institute of Standards and Technology, retrieved 27 October 2026
Related guides
Comparison · Privacy tools
VPN vs Tor vs private browsing: what each hides and from whom
Private browsing only stops your own device from saving history. A VPN shifts trust from your network provider to the VPN operator and hides your address from sites, but does not make you anonymous. Tor routes traffic through multiple volunteer relays to separate who you are from what you read, at the cost of speed. Each addresses a different adversary.
Suitability · Privacy tools
Do you actually need a consumer VPN?
A consumer VPN helps in specific situations: untrusted public networks, hiding your address from sites, accessing a work network or choosing a different apparent location where legal. It does little against phishing, malware or account tracking. For many people, device updates, strong unique passwords, second-factor sign-in and HTTPS provide more protection than a VPN subscription.
Alternatives · Privacy tools
Privacy-focused browser vs hardening your existing browser
You can reduce tracking either by adopting a browser with protective defaults or by tightening settings and adding a small set of vetted extensions in your current one. Switching offers stronger out-of-the-box protection; hardening keeps familiarity and compatibility. Whatever you pick, keep it updated, limit extensions, separate profiles for sensitive activity and understand that logins still identify you.
How to choose · Business operations
How to choose a business bank account
Judge a business account on how it fits your payment flows, not only on its monthly charges. Look at fee structure, payment methods and international capability, integration with accounting software, user permissions, deposit protection, lending relationship potential and service quality. Compare a full month of your expected activity against each fee schedule, and confirm what happens if you outgrow the account.
How to choose · Backup and recovery
How to choose a business backup solution
Choose backup by what you must restore and how fast, then test it. Look for protection of every data source including cloud applications, immutable or offline copies that attackers cannot erase, separate credentials from your main environment, encryption, and restore testing you can actually perform. A backup that has never been restored is an assumption, not a control.
How to choose · B2B software
How to run a security review of a SaaS vendor
Scale the review to the data and access the vendor will have. Collect independent assurance reports, a completed security questionnaire and documentation on encryption, access control, incident response and subprocessors, then verify claims rather than accepting them. Focus on what the vendor does with your data, how it detects and reports incidents, and how you can exit with your data intact.
How to choose · B2B software
How to choose an HRIS for a growing company
Choose an HRIS by first deciding which processes it must own: the employee record, onboarding, time off, performance, benefits administration, or payroll. Test role-based access, workflow configuration, reporting on your own org structure, and integrations with payroll and identity tools. Favor a system your HR team can administer without vendor tickets, and confirm how sensitive personal data is protected and exported.