Best Password Managers: A Complete Guide to Choosing One

Choosing one is less complicated than it seems: there are only a few serious contenders, and they distinguish themselves more by their usability than by quality. I’ll start with the criteria, then move on to the options that hold up in 2026 and family sharing—which is why many people upgrade to a paid plan.

How to evaluate a password manager #

Before looking at names, look at requirements. If a manager doesn’t meet these first three points, skip it regardless of the price.

• Zero-knowledge encryption. The vault is encrypted on your device: the service provider only keeps unreadable data and cannot see your passwords even if they wanted to.
• Independent audits. Reputable providers publish the results of security audits conducted by third parties. Open source helps, as it allows you to verify exactly what the software does.
• Incident history. Look at how the company reacted when something went wrong, not just that it happened.
• Real availability on your devices. A browser extension for the one you use, a mobile app, and autofill that works within apps as well.
• Passkeys. Passkeys are increasingly replacing passwords on more and more sites: a manager that doesn’t support them is already outdated. As of 2025, many also support the new standard for transferring passkeys from one manager to another.
• Account recovery. If you forget your master password, what happens? Serious options include an offline recovery code or emergency access granted to a trusted person.
• Data export. You must be able to leave whenever you want by exporting your vault in a readable format.

The best options #

Bitwarden #

For most people, this is the right choice. It’s open source, publishes security audits, has apps for all systems, and offers a free plan that isn’t just a demo: unlimited passwords, unlimited devices, full synchronization, and sharing with one other person.

The Premium plan costs $1.65 per month when billed annually ($19.80 per year) and adds an integrated authenticator, attachments, password health reports, and emergency access. The Families plan costs $3.99 per month (also on an annual basis) and covers six people with unlimited sharing.

You can also self-host the service on your own server: it only interests a few, but it says a lot about the project’s openness.

Proton Pass #

It comes from the same company as Proton Mail, based in Switzerland. The free plan is generous: unlimited credentials and notes, unlimited devices, passkey support, and ten email aliases via “hide my email,” which are useful for signing up for services without exposing your real address.

The Plus version removes the alias limit and adds integrated two-factor authentication, secure sharing, data breach monitoring, attachments, and emergency access. The Family plan extends these features to up to six people with an admin dashboard.

It makes sense especially if you already use other Proton services, as the Unlimited subscription includes all of them.

1Password #

It is the most polished to use and the one companies choose most often. It doesn’t have a free plan, only a fourteen-day trial, but in return, it offers features others don’t: separate “vaults” for different areas of your life, a Travel Mode that hides vaults when you cross a border, and very solid integration with enterprise systems.

The family plan is among the most mature regarding permissions: you decide who sees what, you can recover access for a family member who has lost their master password, and you can separate personal vaults from shared ones.

KeePassXC #

This is for those who want no service in the middle. It’s a free, open-source program that creates an encrypted file on your disk: no accounts, no servers, no subscription. You handle the synchronization between devices yourself—for example, by putting the file in a cloud folder; on your phone, you can open it with compatible apps like KeePassDX on Android or Strongbox on iPhone.

In exchange for total control, backups are your responsibility: if you lose the file and don’t have a copy, your passwords are gone.

Solutions already integrated into devices #

Apple’s Passwords app (from iOS 18 and macOS Sequoia) and the manager built into Google Chrome are free, work well, and are much better than reusing the same password. The downside is that they work best within their own ecosystem: if you use an iPhone and a Windows PC, or Android and a Mac, sharing and autofill become inconvenient, and family features are essential.

NordPass, Dashlane, and Keeper #

These are solid commercial services with polished interfaces and extra features like data breach monitoring and document storage. Consider them if you already have a subscription that includes them, such as alongside the same provider’s VPN. However, for the same price, Bitwarden and Proton Pass offer the same essential features for less or even for free. Dashlane, by the way, will no longer have a free plan starting in 2025.

The others from the old list #

RoboForm was built for filling out forms and still does it better than almost anyone. Zoho Vault makes sense for businesses, especially if you already use other Zoho services. mSecure and LogMeOnce still exist, but they have smaller communities and fewer public audits: among the names on this page, they aren’t the ones I would start with.

Sharing passwords in a family #

This is the most practical reason to upgrade to a paid plan, and it must be done properly: sending account or portal credentials via WhatsApp leaves copies everywhere without you knowing who reads them.

A family plan works like this: everyone has their own private vault that no one else can see, plus one or more shared vaults with common credentials, such as utility bills, streaming subscriptions, the home router, or school records. When you change a password, it changes for everyone at the same time.

Three tips that make a huge difference:

1. Separate your vaults by theme. One for home, one for the kids’ services, and one for documents. Avoid sharing everything with everyone.
2. Appoint a second administrator. If the only person who knows how to manage the plan is unreachable, everyone else stays locked out.
3. Enable emergency access. A person of your choosing can gain access to the vault after a waiting period if you don’t respond. This solves a very practical problem: what happens to family credentials in case of an emergency.

Your master password and 2FA #

The entire system relies on two things: the password that unlocks the vault and two-factor authentication (2FA).

For your master password, the best approach is a long passphrase made of four or five unrelated words: easy to remember, hard to guess. Don’t use it anywhere else and don’t build it using dates or names related to you.

Enable 2FA immediately. An authenticator app or a physical key is much better than SMS codes, which can be intercepted via SIM swapping.

FAQ #

Isn’t putting all your passwords in one place dangerous? #

That is the most common objection, but the real risk is the opposite. Vaults are encrypted on your device with a key that the provider does not have: even if they steal data from their servers, anyone who gets it will find only unreadable files—provided your master password is strong. The alternative—reusing three passwords across fifty sites—guarantees that the first data breach compromises everything else.

Is a free manager enough? #

For most people, yes. The free plans from Bitwarden and Proton Pass cover unlimited passwords, unlimited devices, and passkeys. Paid plans are for family sharing, emergency access, and data breach monitoring.

What happens if I forget my master password? #

With zero-knowledge services, the provider cannot recover it: if you lose it and don’t have your recovery code, the vault will never open again. This is why reputable services generate a recovery code when you sign up and offer emergency access: set them up on day one, not when you actually need them.

How do I switch from one manager to another? #

All of them allow you to export your vault as a CSV file and import it elsewhere. Two things to watch out for: the exported file contains passwords in plain text, so delete it immediately after importing (and empty your trash bin); and check that notes and 2FA codes were also transferred, as they sometimes require a separate step. Passkeys, however, often do not transfer via CSV: they must be moved using a specific function or recreated.

Will passkeys replace password managers? #

They replace passwords, not managers. A passkey is a cryptographic key that still needs to be stored and synced, which is exactly what managers do by keeping passkeys alongside traditional credentials. The two systems will coexist for years because many websites do not support them yet.