Why You Should Use a Password Manager and How to Maximize Security

A good password manager stores, generates, and updates passwords for you with the press of a button. You don’t even need to spend a dime to start using one. Here’s why you should, and a few tips for getting started.

Only one password to remember: To access all of your passwords, you only have to remember one password. When you type that into the password manager, it unlocks the vault containing all of your actual passwords. Only needing to remember one password is great, but it means there’s a lot riding on that password. Make sure it’s a good one. If you’re having trouble coming up with that one password to rule them all, check out our guide to better password security. You might also consider using the Diceware method for generating a strong master password.

Apps and extensions: Most password managers are full systems, rather than a single piece of software. They consist of apps or browser extensions for each of your devices (Windows, Mac, Android phones, iPhone, and tablets), which have tools to help you create secure passwords, safely store them, and evaluate the security of your existing passwords. All that information is then sent to a central server where your passwords are encrypted, stored, and shared between devices.

Fixing compromised passwords: While password managers can help you create more secure passwords and keep them safe from prying eyes, they can’t protect your password if the website itself is breached. That doesn’t mean they don’t help in this scenario, though. All the cloud-based password managers we discuss offer tools to alert you to potentially compromised passwords. Password managers also make it easier to quickly change a compromised password and search through your credentials to ensure you didn’t reuse any compromised passwords.

Passkey storage and support: An increasing number of websites and services support passwordless login with a passkey. That makes logging in both safer and easier. Password managers like Bitwarden, 1Password, Proton Pass, and Dashlane support passkey storage and sync so you can easily access them across your devices.

You should disable auto form-filling: Some password managers will automatically fill in and even submit web forms for you. This is super convenient, but for additional security, we suggest you disable this feature. Automatically filling in forms in the browser has made password managers vulnerable to attacks in the past. For this reason, some, like 1Password, require you to opt into this feature. We suggest you do not.

Don’t panic about hacks: Software has bugs, even your password manager. The question is not what to do if it becomes known that your password manager has a flaw, but what you do when it becomes known that your password manager has a flaw. The answer is, first, don’t panic. Normally bugs are found, reported, and fixed before they’re exploited in the wild. Even if someone does manage to gain access to your password manager’s servers, you should still be fine. All of the services we list store only encrypted data, and none of them store your encryption key, meaning all an attacker gets from compromising their servers is encrypted data.

The best and most secure cryptographic algorithms are all available via open-source programming libraries. On the one hand, this is great, as any app can incorporate these ciphers and keep your data safe. Unfortunately, any encryption is only as strong as its weakest link, and cryptography alone won’t keep your passwords safe.

This is what I test for: What are the weakest links? Is your master password sent to the server? Every password manager says it isn’t, but if you watch network traffic while you enter a password, sometimes you find, well, it is. I also dig into how mobile apps work: Do they, for example, leave your password store unlocked but require a PIN to get back in? That’s convenient, but it sacrifices too much security.

The best security is built on the back of a broad ecosystem of shared knowledge. Bitwarden and Proton Pass have open-source apps, so while that isn’t a wholesale endorsement of their security, it makes security flaws in the apps much less likely. Dashlane and 1Password use proprietary apps, but they publish white papers detailing their security architecture. For password managers, the standard isn’t marketing bullet points. You need to show your work.

Security is the top priority, but usability is a close second. A password manager should make your digital life easier and more secure, not one or the other. Newer features like passkey support are paramount, and browser extensions with seamless autofill and credential capture are a prerequisite.

From there, it’s all about dressing. Do you need more encrypted storage like Proton offers? Do you want to host your own passwords with Bitwarden or KeePassXC? The password managers I’ve included here all get the essentials right. It’s up to you to decide what features you need on top of that core.